cf 0.9.1 → 0.11.0

package/dist/zero-trust-DOFLlUz1.mjs

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-import{t as e}from"./local-DTyuGwTw.mjs";import{f as t,g as n,h as r}from"./oauth-BPizUUqP.mjs";import{a as i,r as a}from"./auth-DuLchM18.mjs";import{t as o}from"./output-DgW1hQGX.mjs";import{n as s,t as c}from"./progress-B84wYh91.mjs";import{n as l,r as u,t as d}from"./body-parser-CYD7PKFC.mjs";import{n as f,t as p}from"./input-validation-BBKJRoRB.mjs";import{a as m,i as h,n as g}from"./prompt-CDtLWxNv.mjs";import{t as _}from"./cli-types-BWdZbsFE.mjs";import{n as v,t as ee}from"./raw-fetch-Dz-QBoP_.mjs";function te(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const y={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:te,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/ca`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.applications.cas.create({account_id:l,app_id:r[`app-id`]})),{successLabel:`Created`})}};function b(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:b,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/ca`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.applications.cas.delete({account_id:l,app_id:r[`app-id`]})),{successLabel:`Deleted`})}};function S(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:S,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/ca`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.cas.get({account_id:l,app_id:r[`app-id`]})),{successLabel:`Loaded`})}};function w(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:w,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/ca`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.cas.list({account_id:u,...i})),{successLabel:`Loaded`})}},E={command:`cas`,describe:`Operations for access.applications.cas`,builder:e=>e.command(y).command(x).command(C).command(T).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function D(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const O={command:`create`,describe:`Adds a new application to Access.`,builder:D,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.applications.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function k(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const A={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:k,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.applications.delete({account_id:l,app_id:r[`app-id`]})),{successLabel:`Deleted`})}};function j(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const M={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:j,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.get({account_id:l,app_id:r[`app-id`]})),{successLabel:`Loaded`})}};function N(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`list`,describe:`Lists all Access applications in an account.`,builder:N,handler:async r=>{let i={name:r.name,domain:r.domain,aud:r.aud,target_attributes:r[`target-attributes`],exact:r.exact,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.list({account_id:u,...i})),{successLabel:`Loaded`})}};function F(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const I={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:F,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policies.create({body:e,account_id:u,app_id:r[`app-id`]})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function L(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const R={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:L,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.applications.policies.delete({account_id:l,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function z(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const B={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:z,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.policies.get({account_id:l,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function V(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const H={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:V,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies`,pathParams:{"app-id":String(r[`app-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policies.list({account_id:u,app_id:r[`app-id`],...i})),{successLabel:`Loaded`})}};function U(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const W={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:U,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.applications.policies.update({body:e,account_id:u,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},G={command:`policies`,describe:`Operations for access.applications.policies`,builder:e=>e.command(I).command(R).command(B).command(H).command(W).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function K(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const q={command:`create`,describe:`Starts an Access policy test.`,builder:K,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({...e,account_id:u})),{successLabel:`Created`});return}o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({account_id:u})),{successLabel:`Created`})}};function J(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Y={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:J,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.policyTests.get({account_id:l,policy_test_id:r[`policy-test-id`]})),{successLabel:`Loaded`})}};function X(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Z={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:_(X),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status};if(r.dryRun){s({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policyTests.users.list({account_id:u,policy_test_id:r[`policy-test-id`],...i})),{successLabel:`Loaded`})}},Q={command:`users`,describe:`Operations for access.applications.policy-tests.users`,builder:e=>e.command(Z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ne={command:`policy-tests`,describe:`Operations for access.applications.policy-tests`,builder:e=>e.command(q).command(Y).command(Q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function re(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ie={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:re,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.applications.revokeTokens({account_id:l,app_id:r[`app-id`]})),{successLabel:`Deleted`})}};function ae(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oe={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:ae,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/settings`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({allow_iframe:r[`allow-iframe`],skip_interstitial:r[`skip-interstitial`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.applications.settings.edit({body:e,account_id:u,app_id:r[`app-id`]})),{successLabel:`Updated`});return}let f=d({allow_iframe:r[`allow-iframe`],skip_interstitial:r[`skip-interstitial`]});o(await c(`Updating`,async()=>i.zeroTrust.access.applications.settings.edit({body:f,account_id:u,app_id:r[`app-id`]})),{successLabel:`Updated`})}};function se(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ce={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:se,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/settings`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({allow_iframe:r[`allow-iframe`],skip_interstitial:r[`skip-interstitial`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.applications.settings.update({body:e,account_id:u,app_id:r[`app-id`]})),{successLabel:`Updated`});return}let f=d({allow_iframe:r[`allow-iframe`],skip_interstitial:r[`skip-interstitial`]});o(await c(`Updating`,async()=>i.zeroTrust.access.applications.settings.update({body:f,account_id:u,app_id:r[`app-id`]})),{successLabel:`Updated`})}},le={command:`settings`,describe:`Operations for access.applications.settings`,builder:e=>e.command(oe).command(ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ue(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const de={command:`update <app-id>`,describe:`Updates an Access application.`,builder:ue,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.applications.update({body:e,account_id:u,app_id:r[`app-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fe(e){return e.option(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pe={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:fe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.userPolicyChecks.list({account_id:l,app_id:r[`app-id`]})),{successLabel:`Loaded`})}},me={command:`user-policy-checks`,describe:`Operations for access.applications.user-policy-checks`,builder:e=>e.command(pe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},he={command:`applications`,describe:`Operations for access.applications`,builder:e=>e.command(O).command(A).command(M).command(P).command(ie).command(de).command(E).command(G).command(ne).command(le).command(me).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ge(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _e={command:`list`,describe:`Returns a list of Authenticator Device AAGUIDs for MFA configuration.`,builder:ge,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access authenticator-device-aaguids list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/authenticator_device_aaguids`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.authenticatorDeviceAaguids.list({account_id:l})),{successLabel:`Loaded`})}},ve={command:`authenticator-device-aaguids`,describe:`Operations for access.authenticator-device-aaguids`,builder:e=>e.command(_e).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ye(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const be={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:ye,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.bookmarks.create({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Created`})}};function xe(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Se={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:xe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.bookmarks.delete({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Deleted`})}};function Ce(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const we={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ce,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.get({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Loaded`})}};function Te(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ee={command:`list`,describe:`Lists Bookmark applications.`,builder:Te,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.list({account_id:l})),{successLabel:`Loaded`})}};function De(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oe={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:De,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.access.bookmarks.update({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Updated`})}},ke={command:`bookmarks`,describe:`Operations for access.bookmarks`,builder:e=>e.command(be).command(Se).command(we).command(Ee).command(Oe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ae(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Ae,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({associated_hostnames:r[`associated-hostnames`],certificate:f(r.certificate,`certificate`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.certificates.create({...e,account_id:u})),{successLabel:`Created`});return}r.certificate===void 0&&(r.certificate=await m(`certificate`,`The certificate content.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the certificate.`));let p=d({associated_hostnames:r[`associated-hostnames`],certificate:f(r.certificate,`certificate`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.certificates.create({...p,account_id:u})),{successLabel:`Created`})}};function Me(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ne={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Me,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.certificates.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function Pe(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fe={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Pe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.certificates.get({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Loaded`})}};function Ie(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Le={command:`list`,describe:`Lists all mTLS root certificates.`,builder:Ie,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.certificates.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Re(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ze={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:Re,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.certificates.settings.get({account_id:l})),{successLabel:`Loaded`})}};function Be(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ve={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Be,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let u=await a(r),d=r.local?e:await t();if(r.accountId=d,r.body){let e=l(r.body);o(await c(`Updating`,async()=>u.zeroTrust.access.certificates.settings.update({...e,account_id:d})),{successLabel:`Updated`});return}o(await c(`Updating`,async()=>i(u,`PUT`,`/accounts/${d}/access/certificates/settings`)),{successLabel:`Updated`})}},He={command:`settings`,describe:`Operations for access.certificates.settings`,builder:e=>e.command(ze).command(Ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ue(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const We={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:Ue,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({associated_hostnames:r[`associated-hostnames`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.certificates.update({...e,account_id:u,certificate_id:r[`certificate-id`]})),{successLabel:`Updated`});return}if(r[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let p=d({associated_hostnames:r[`associated-hostnames`],name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.certificates.update({...p,account_id:u,certificate_id:r[`certificate-id`]})),{successLabel:`Updated`})}},Ge={command:`certificates`,describe:`Operations for access.certificates`,builder:e=>e.command(je).command(Ne).command(Fe).command(Le).command(We).command(He).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ke(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qe={command:`create`,describe:`Create a custom page`,builder:Ke,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:e,account_id:u})),{successLabel:`Created`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await m(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await m(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:p,account_id:u})),{successLabel:`Created`})}};function Je(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ye={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:Je,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.customPages.delete({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Deleted`})}};function Xe(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ze={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:Xe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.customPages.get({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Loaded`})}};function Qe(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $e={command:`list`,describe:`List custom pages`,builder:Qe,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.customPages.list({account_id:u,...i})),{successLabel:`Loaded`})}};function et(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const tt={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:et,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:e,account_id:u,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await m(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await m(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:p,account_id:u,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`})}};function nt(e){return e.option(`template`,{type:`string`,description:`The Liquid template to validate.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`version`,{type:`number`,description:`Contract version to validate against; omit for the latest.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A template to validate without persisting it.`})}const rt={command:`validate`,describe:`Validate a Liquid template and return its errors and warnings without persisting it.`,builder:nt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({template:f(r.template,`template`,`text`),type:f(r.type,`type`,`text`),version:r.version}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...e,account_id:u})),{successLabel:`Created`});return}r.template===void 0&&(r.template=await m(`template`,`The Liquid template to validate.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({template:f(r.template,`template`,`text`),type:f(r.type,`type`,`text`),version:r.version});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...p,account_id:u})),{successLabel:`Created`})}},it={command:`custom-pages`,describe:`Operations for access.custom-pages`,builder:e=>e.command(qe).command(Ye).command(Ze).command($e).command(tt).command(rt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function at(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ot={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:at,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.gatewayCa.create({account_id:l})),{successLabel:`Created`})}};function st(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ct={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:st,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.gatewayCa.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function lt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ut={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:lt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.gatewayCa.list({account_id:l})),{successLabel:`Loaded`})}},dt={command:`gateway-ca`,describe:`Operations for access.gateway-ca`,builder:e=>e.command(ot).command(ct).command(ut).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ft(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pt={command:`create`,describe:`Creates a new Access group.`,builder:ft,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({is_default:r[`is-default`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.groups.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the Access group.`));let p=d({is_default:r[`is-default`],name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.groups.create({...p,account_id:u})),{successLabel:`Created`})}};function mt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ht={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:mt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.groups.delete({account_id:l,group_id:r[`group-id`]})),{successLabel:`Deleted`})}};function gt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _t={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:gt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.groups.get({account_id:l,group_id:r[`group-id`]})),{successLabel:`Loaded`})}};function vt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yt={command:`list`,describe:`Lists all Access groups.`,builder:vt,handler:async r=>{let i={name:r.name,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/groups`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.groups.list({account_id:u,...i})),{successLabel:`Loaded`})}};function bt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:bt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({is_default:r[`is-default`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.groups.update({...e,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the Access group.`));let p=d({is_default:r[`is-default`],name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.groups.update({...p,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`})}},St={command:`groups`,describe:`Operations for access.groups`,builder:e=>e.command(pt).command(ht).command(_t).command(yt).command(xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ct(e){return e.option(`idp-id`,{type:`string`,description:`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wt={command:`create`,describe:`Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time.`,builder:Ct,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({idp_id:f(r[`idp-id`],`idp-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...e,account_id:u})),{successLabel:`Created`});return}r[`idp-id`]===void 0&&(r[`idp-id`]=await m(`idp-id`,`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`));let p=d({idp_id:f(r[`idp-id`],`idp-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...p,account_id:u})),{successLabel:`Created`})}};function Tt(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Et={command:`delete <grant-id>`,describe:`Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts.`,builder:Tt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.idpFederationGrants.delete({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Deleted`})}};function Dt(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ot={command:`get <grant-id>`,describe:`Retrieves a single IdP federation grant by its UID.`,builder:Dt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.get({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Loaded`})}};function kt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const At={command:`list`,describe:`Lists the IdP federation grants owned by the account.`,builder:kt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.list({account_id:l})),{successLabel:`Loaded`})}},jt={command:`idp-federation-grants`,describe:`Operations for access.idp-federation-grants`,builder:e=>e.command(wt).command(Et).command(Ot).command(At).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nt={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:Mt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.keys.get({account_id:l})),{successLabel:`Loaded`})}};function Pt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ft={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:Pt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.keys.rotate({account_id:l})),{successLabel:`Created`})}};function It(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lt={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:It,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({key_rotation_interval_days:r[`key-rotation-interval-days`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...e,account_id:u})),{successLabel:`Updated`});return}if(r[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let f=d({key_rotation_interval_days:r[`key-rotation-interval-days`]});o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...f,account_id:u})),{successLabel:`Updated`})}},Rt={command:`keys`,describe:`Operations for access.keys`,builder:e=>e.command(Nt).command(Ft).command(Lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
-When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bt={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:_(zt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,page:r.page,per_page:r[`per-page`],email:r.email,email_exact:r[`email-exact`],user_id:r[`user-id`],allowedOp:r[`allowed-op`],country_codeOp:r[`country-code-op`],app_typeOp:r[`app-type-op`],app_uidOp:r[`app-uid-op`],ray_idOp:r[`ray-id-op`],emailOp:r[`email-op`],idpOp:r[`idp-op`],non_identityOp:r[`non-identity-op`],user_idOp:r[`user-id-op`],fields:r.fields};if(r.dryRun){s({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.accessRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},Vt={command:`access-requests`,describe:`Operations for access.logs.access-requests`,builder:e=>e.command(Bt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ht(e){return e.positional(`knock-request-id`,{type:`string`,description:`Knock request ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ut={command:`get <knock-request-id>`,describe:`Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.`,builder:Ht,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access logs jit-requests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests/${r[`knock-request-id`]==null?`<knock-request-id>`:encodeURIComponent(String(r[`knock-request-id`]))}`,pathParams:{"knock-request-id":String(r[`knock-request-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.logs.jitRequests.get({account_id:l,knock_request_id:r[`knock-request-id`]})),{successLabel:`Loaded`})}};function Wt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`status`,{type:`string`,description:"JIT request status. `SPENT` is deprecated and interpreted as `APPROVED`.",choices:[`PENDING`,`APPROVED`,`DENIED`,`CANCELED`,`SPENT`]}).option(`search`,{type:`string`,description:`Case-insensitive search over request ID, requester email, application audience, and application hostname.`}).option(`since`,{type:`string`,description:`The earliest request timestamp to query. Defaults to 366 days before the current time.`}).option(`until`,{type:`string`,description:`The latest request timestamp to query. Defaults to the current time.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gt={command:`list`,describe:`Lists account-wide Access JIT request logs reconstructed from request lifecycle events.`,builder:_(Wt),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status,search:r.search,since:r.since,until:r.until};if(r.dryRun){s({command:`cf zero-trust access logs jit-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.jitRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},Kt={command:`jit-requests`,describe:`Operations for access.logs.jit-requests`,builder:e=>e.command(Ut).command(Gt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jt={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:_(qt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,idp_id:r[`idp-id`],status:r.status,resource_type:r[`resource-type`],request_method:r[`request-method`],resource_user_email:r[`resource-user-email`],resource_group_name:r[`resource-group-name`],cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.scim.updates.list({account_id:u,...i})),{successLabel:`Loaded`})}},Yt={command:`updates`,describe:`Operations for access.logs.scim.updates`,builder:e=>e.command(Jt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Xt={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(Yt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zt={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(Vt).command(Kt).command(Xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qt(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $t={command:`create`,describe:`Creates a new Access reusable policy.`,builder:Qt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:e,account_id:u})),{successLabel:`Created`});return}r.decision===void 0&&(r.decision=await h(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await m(`name`,`The name of the Access policy.`));let p=d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:p,account_id:u})),{successLabel:`Created`})}};function en(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tn={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:en,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.policies.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function nn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rn={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:nn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.policies.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function an(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const on={command:`list`,describe:`Lists Access reusable policies.`,builder:an,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.policies.list({account_id:u,...i})),{successLabel:`Loaded`})}};function sn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cn={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:sn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}r.decision===void 0&&(r.decision=await h(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await m(`name`,`The name of the Access policy.`));let p=d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:p,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},ln={command:`policies`,describe:`Operations for access.policies`,builder:e=>e.command($t).command(tn).command(rn).command(on).command(cn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function un(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dn={command:`get-pem <saml-cert-set-id>`,describe:`Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration.`,builder:un,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get-pem`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/pem`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.getPem({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function fn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pn={command:`get <saml-cert-set-id>`,describe:`Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.`,builder:fn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.get({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function mn(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Maximum number of results per page.`}).option(`id`,{type:`string`,description:`Filter by SAML certificate set UID. Accepts a comma-separated list of UIDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hn={command:`list`,describe:`Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.`,builder:mn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],id:r.id};if(r.dryRun){s({command:`cf zero-trust access saml-certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.samlCertificates.list({account_id:u,...i})),{successLabel:`Loaded`})}};function gn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set to rotate.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _n={command:`rotate <saml-cert-set-id>`,describe:`Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration.`,builder:gn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/rotate`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.samlCertificates.rotate({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Created`})}},vn={command:`saml-certificates`,describe:`Operations for access.saml-certificates`,builder:e=>e.command(pn).command(dn).command(hn).command(_n).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:yn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({client_secret_version:r[`client-secret-version`],duration:f(r.duration,`duration`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the service token.`));let p=d({client_secret_version:r[`client-secret-version`],duration:f(r.duration,`duration`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.create({...p,account_id:u})),{successLabel:`Created`})}};function xn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sn={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:xn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.serviceTokens.delete({account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Deleted`})}};function Cn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Cn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.serviceTokens.get({account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Loaded`})}};function Tn(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const En={command:`list`,describe:`Lists all service tokens.`,builder:Tn,handler:async r=>{let i={name:r.name,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.serviceTokens.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Dn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Dn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.refresh({account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function kn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const An={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:kn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...e,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Created`});return}let p=d({previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...p,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function jn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:jn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({client_secret_version:r[`client-secret-version`],duration:f(r.duration,`duration`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.serviceTokens.update({...e,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Updated`});return}let p=d({client_secret_version:r[`client-secret-version`],duration:f(r.duration,`duration`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.serviceTokens.update({...p,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Updated`})}},Nn={command:`service-tokens`,describe:`Operations for access.service-tokens`,builder:e=>e.command(bn).command(Sn).command(wn).command(En).command(On).command(An).command(Mn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fn={command:`create`,describe:`Create a tag`,builder:Pn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...e,account_id:u})),{successLabel:`Created`});return}let p=d({name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...p,account_id:u})),{successLabel:`Created`})}};function In(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ln={command:`delete <tag-name>`,describe:`Delete a tag`,builder:In,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.tags.delete({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Deleted`})}};function Rn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zn={command:`get <tag-name>`,describe:`Get a tag`,builder:Rn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.tags.get({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Loaded`})}};function Bn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vn={command:`list`,describe:`List tags`,builder:Bn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.tags.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Hn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const Un={command:`update <tag-name>`,describe:`Update a tag`,builder:Hn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...e,account_id:u,tag_name:r[`tag-name`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the tag`));let p=d({name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...p,account_id:u,tag_name:r[`tag-name`]})),{successLabel:`Updated`})}},Wn={command:`tags`,describe:`Operations for access.tags`,builder:e=>e.command(Fn).command(Ln).command(zn).command(Vn).command(Un).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gn(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kn={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:Gn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions/${r.nonce==null?`<nonce>`:encodeURIComponent(String(r.nonce))}`,pathParams:{"user-id":String(r[`user-id`]??``),nonce:String(r.nonce??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.get({account_id:l,user_id:r[`user-id`],nonce:r.nonce})),{successLabel:`Loaded`})}};function qn(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jn={command:`list`,describe:`Get active sessions for a single user.`,builder:qn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},Yn={command:`active-sessions`,describe:`Operations for access.users.active-sessions`,builder:e=>e.command(Kn).command(Jn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xn(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zn={command:`create`,describe:`Creates a new user.`,builder:Xn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...e,account_id:u})),{successLabel:`Created`});return}r.email===void 0&&(r.email=await m(`email`,`The email of the user.`));let p=d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...p,account_id:u})),{successLabel:`Created`})}};function Qn(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $n={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:Qn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.users.delete({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function er(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:er,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.failedLogins.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},nr={command:`failed-logins`,describe:`Operations for access.users.failed-logins`,builder:e=>e.command(tr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ir={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:rr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function ar(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const or={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:ar,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.lastSeenIdentity.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},sr={command:`last-seen-identity`,describe:`Operations for access.users.last-seen-identity`,builder:e=>e.command(or).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`list`,describe:`Gets a list of users for an account.`,builder:cr,handler:async r=>{let i={name:r.name,email:r.email,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.users.list({account_id:u,...i})),{successLabel:`Loaded`})}};function ur(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dr={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:ur,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...e,account_id:u,user_id:r[`user-id`]})),{successLabel:`Updated`});return}r.email===void 0&&(r.email=await m(`email`,`The email of the user.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the user.`));let p=d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...p,account_id:u,user_id:r[`user-id`]})),{successLabel:`Updated`})}},fr={command:`users`,describe:`Operations for access.users`,builder:e=>e.command(Zn).command($n).command(ir).command(lr).command(dr).command(Yn).command(nr).command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},pr={command:`access`,describe:`Operations for access`,builder:e=>e.command(he).command(ve).command(ke).command(Ge).command(it).command(dt).command(St).command(jt).command(Rt).command(Zt).command(ln).command(vn).command(Nn).command(Wn).command(fr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hr={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:mr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Creating`,async()=>t.zeroTrust.apps.ca.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Created`})}};function gr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _r={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:gr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.apps.ca.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function vr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yr={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:vr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps ca get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.ca.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function br(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xr={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:br,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/ca`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.ca.list({zone_id:n})),{successLabel:`Loaded`})}},Sr={command:`ca`,describe:`Operations for apps.ca`,builder:e=>e.command(hr).command(_r).command(yr).command(xr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wr={command:`create`,describe:`Adds a new application to Access.`,builder:Cr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.apps.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Tr(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Er={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Tr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.apps.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Dr(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Or={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:Dr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function kr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ar={command:`list`,describe:`List all Access Applications in a zone.`,builder:kr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.list({zone_id:n})),{successLabel:`Loaded`})}};function jr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mr={command:`create <app-id>`,describe:`Create a new Access policy for an application.`,builder:jr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({approval_required:e[`approval-required`],decision:f(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:f(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.apps.policies.create({...r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await h(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await m(`name`,`The name of the Access policy.`));let i=d({approval_required:e[`approval-required`],decision:f(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:f(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]});o(await c(`Creating`,async()=>t.zeroTrust.apps.policies.create({...i,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Created`})}};function Nr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Pr={command:`delete <policy-id>`,describe:`Delete an Access policy.`,builder:Nr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.apps.policies.delete({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function Fr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ir={command:`get <policy-id>`,describe:`Fetches a single Access policy.`,builder:Fr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.policies.get({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Lr(e){return e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rr={command:`list`,describe:`Lists Access policies configured for an application.`,builder:Lr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.policies.list({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function zr(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Br={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:zr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.apps.policies.make.reusable.update({account_id:l,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},Vr={command:`reusable`,describe:`Operations for apps.policies.make.reusable`,builder:e=>e.command(Br).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hr={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(Vr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ur(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wr={command:`update <policy-id>`,describe:`Update a configured Access policy.`,builder:Ur,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({approval_required:e[`approval-required`],decision:f(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:f(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.apps.policies.update({...r,zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await h(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await m(`name`,`The name of the Access policy.`));let i=d({approval_required:e[`approval-required`],decision:f(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:f(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]});o(await c(`Updating`,async()=>t.zeroTrust.apps.policies.update({...i,zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`})}},Gr={command:`policies`,describe:`Operations for apps.policies`,builder:e=>e.command(Mr).command(Pr).command(Ir).command(Rr).command(Wr).command(Hr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qr={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:Kr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.apps.review.status.list({account_id:l})),{successLabel:`Loaded`})}};function Jr(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yr={command:`update`,describe:`Update the statuses of your applications.`,builder:Jr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...e,account_id:u})),{successLabel:`Updated`});return}if(r[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(r[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(r[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let f=d({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]});o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...f,account_id:u})),{successLabel:`Updated`})}},Xr={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(qr).command(Yr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zr={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(Xr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qr(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $r={command:`create <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:Qr,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.apps.revoke.tokens.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}},ei={command:`tokens`,describe:`Operations for apps.revoke.tokens`,builder:e=>e.command($r).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ti={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(ei).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ni(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ri={command:`edit <app-id>`,describe:`Updates application settings.`,builder:ni,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let i=d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});o(await c(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:i,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}};function ii(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ai={command:`update <app-id>`,describe:`Updates application settings.`,builder:ii,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let i=d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});o(await c(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:i,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}},oi={command:`settings`,describe:`Operations for apps.settings`,builder:e=>e.command(ri).command(ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function si(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ci={command:`update <app-id>`,describe:`Updates an Access application.`,builder:si,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.apps.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function li(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ui={command:`get <app-id>`,describe:`Tests if a specific user has permission to access an application.`,builder:li,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust apps user policy checks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.apps.user.policy.checks.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}},di={command:`checks`,describe:`Operations for apps.user.policy.checks`,builder:e=>e.command(ui).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fi={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},pi={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(fi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mi={command:`apps`,describe:`Operations for apps`,builder:e=>e.command(wr).command(Er).command(Or).command(Ar).command(ci).command(Sr).command(Gr).command(Zr).command(ti).command(oi).command(pi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hi(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gi={command:`list`,describe:`Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.`,builder:_(hi),handler:async r=>{let i={page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications authMethods list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/auth-methods`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.authMethods.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},_i={command:`authMethods`,describe:`Operations for casb.applications.authMethods`,builder:e=>e.command(gi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vi(e){return e.positional(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yi={command:`get <application-id>`,describe:`Returns full application details including auth methods, use cases, and permissions.`,builder:_(vi),handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}`,pathParams:{"application-id":String(r[`application-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.applications.get({account_id:l,application_id:r[`application-id`]})),{successLabel:`Loaded`})}};function bi(e){return e.option(`environment`,{type:`string`,description:`Filter by supported environment (standard, fedramp).`}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xi={command:`list`,describe:`Returns a list of available applications with use cases and permissions.`,builder:bi,handler:async r=>{let i={environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Si(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`auth-method`,{type:`string`,description:`Filter by auth method id. Get available ids from GET /v2/applications.`}).option(`environment`,{type:`string`,description:`Filter by environment.`,choices:[`fedramp`,`standard`]}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ci={command:`list`,describe:`Returns all available setup flows for the application, one per auth method.`,builder:_(Si),handler:async r=>{let i={auth_method:r[`auth-method`],environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications setupFlows list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/setup-flows`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.setupFlows.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},wi={command:`setupFlows`,describe:`Operations for casb.applications.setupFlows`,builder:e=>e.command(Ci).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ti={command:`applications`,describe:`Operations for casb.applications`,builder:e=>e.command(yi).command(xi).command(_i).command(wi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ei(e){return e.option(`application`,{type:`string`,description:"Vendor/application slug (e.g., GOOGLE_WORKSPACE).\n\n* `ANTHROPIC` - ANTHROPIC\n* `AWS` - AWS\n* `BITBUCKET` - BITBUCKET\n* `BOX` - BOX\n* `CONFLUENCE` - CONFLUENCE\n* `DROPBOX` - DROPBOX\n* `GITHUB` - GITHUB\n* `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM\n* `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE\n* `JIRA` - JIRA\n* `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL\n* `OPENAI` - OPENAI\n* `SALESFORCE` - SALESFORCE\n* `SERVICENOW` - SERVICENOW\n* `SLACK` - SLACK",choices:[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`]}).option(`auth-method`,{type:`string`,description:`Authentication method slug (uses default if omitted).`}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes (uses policy defaults if empty).`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration create requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Di={command:`create`,describe:"Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor.",builder:Ei,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({application:f(r.application,`application`,`text`),auth_method:f(r[`auth-method`],`auth-method`,`text`),dlp_profiles:r[`dlp-profiles`],name:f(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):l(r.body)});return}let g=await a(r),_=r.local?e:await t();if(r.accountId=_,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Created`});return}if(r.body){let e=l(r.body);o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:e})),{successLabel:`Created`});return}r.application===void 0&&(r.application=await h(`application`,"Vendor/application slug (e.g., GOOGLE_WORKSPACE).  * `ANTHROPIC` - ANTHROPIC * `AWS` - AWS * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `OPENAI` - OPENAI * `SALESFORCE` - SALESFORCE * `SERVICENOW` - SERVICENOW * `SLACK` - SLACK",[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`])),r.name===void 0&&(r.name=await m(`name`,`Name of the integration.`));let v={};r.application!==void 0&&u(v,[`application`],f(r.application,`application`,`text`)),r[`auth-method`]!==void 0&&u(v,[`auth_method`],f(r[`auth-method`],`auth-method`,`text`)),r[`dlp-profiles`]!==void 0&&u(v,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&u(v,[`name`],f(r.name,`name`,`text`)),r.permissions!==void 0&&u(v,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&u(v,[`use_cases`],r[`use-cases`]),o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:Object.keys(v).length>0?v:void 0})),{successLabel:`Created`})}};function Oi(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ki={command:`delete <id>`,describe:`Delete an integration by soft-deleting it.`,builder:Oi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.casb.integrations.delete({account_id:l,id:r.id})),{successLabel:`Deleted`})}};function Ai(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ji={command:`get <id>`,describe:`Returns full integration details including use cases and permissions.`,builder:Ai,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.integrations.get({account_id:l,id:r.id})),{successLabel:`Loaded`})}};function Mi(e){return e.option(`application`,{type:`string`,description:`Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL).`}).option(`direction`,{type:`string`,description:`Direction to order results.`,choices:[`asc`,`desc`]}).option(`dlp-enabled`,{type:`boolean`,description:`Filter by DLP enabled status (true/false).`}).option(`order`,{type:`string`,description:`Field to order results by.`,choices:[`application`,`created`,`name`,`status`]}).option(`page`,{type:`number`,description:`Page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results per page.`}).option(`search`,{type:`string`,description:`Search integrations by name or application.`}).option(`status`,{type:`string`,description:`Filter by integration status.`,choices:[`Healthy`,`Initializing`,`Offline`,`Unhealthy`]}).option(`use-cases`,{type:`string`,description:`Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ni={command:`list`,describe:`Returns a paginated list of integrations for the account.`,builder:_(Mi),handler:async r=>{let i={application:r.application,direction:r.direction,dlp_enabled:r[`dlp-enabled`],order:r.order,page:r.page,page_size:r[`page-size`],search:r.search,status:r.status,use_cases:r[`use-cases`]};if(r.dryRun){s({command:`cf zero-trust casb integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.integrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Pi(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fi={command:`pause <id>`,describe:`Pauses an integration, stopping all crawlers.`,builder:Pi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations pause`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/pause`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.pause({account_id:l,id:r.id})),{successLabel:`Created`})}};function Ii(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Li={command:`resume <id>`,describe:`Resumes a paused integration, restarting crawlers.`,builder:Ii,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations resume`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/resume`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.resume({account_id:l,id:r.id})),{successLabel:`Created`})}};function Ri(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate with the integration.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes granted to the integration.`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration PATCH requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const zi={command:`update <id>`,describe:`Updates an integration's name, permissions, DLP profiles, use cases, or credentials.`,builder:Ri,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`json`,body:r.body===void 0?d({dlp_profiles:r[`dlp-profiles`],name:f(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):l(r.body)});return}let m=await a(r),h=r.local?e:await t();if(r.accountId=h,r.file){let e=p(r.file);o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Updated`});return}if(r.body){let e=l(r.body);o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e})),{successLabel:`Updated`});return}let g={};r[`dlp-profiles`]!==void 0&&u(g,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&u(g,[`name`],f(r.name,`name`,`text`)),r.permissions!==void 0&&u(g,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&u(g,[`use_cases`],r[`use-cases`]),o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated`})}},Bi={command:`integrations`,describe:`Operations for casb.integrations`,builder:e=>e.command(Di).command(ki).command(ji).command(Ni).command(Fi).command(Li).command(zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Vi={command:`casb`,describe:`Operations for casb`,builder:e=>e.command(Ti).command(Bi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Hi(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ui={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Hi,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({associated_hostnames:e[`associated-hostnames`],certificate:f(e.certificate,`certificate`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.certificates.create({...r,zone_id:n})),{successLabel:`Created`});return}e.certificate===void 0&&(e.certificate=await m(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await m(`name`,`The name of the certificate.`));let i=d({associated_hostnames:e[`associated-hostnames`],certificate:f(e.certificate,`certificate`,`text`),name:f(e.name,`name`,`text`)});o(await c(`Creating`,async()=>t.zeroTrust.certificates.create({...i,zone_id:n})),{successLabel:`Created`})}};function Wi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gi={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Wi,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.certificates.delete({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function Ki(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Ki,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.certificates.get({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function Ji(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`list`,describe:`Lists all mTLS certificates.`,builder:Ji,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.certificates.list({zone_id:n})),{successLabel:`Loaded`})}};function Xi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zi={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:Xi,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates settings list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.certificates.settings.list({zone_id:n})),{successLabel:`Loaded`})}};function Qi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $i={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Qi,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.certificates.settings.update({...r,zone_id:n})),{successLabel:`Updated`});return}o(await c(`Updating`,async()=>i(t,`PUT`,`/zones/${e.zoneId}/access/certificates/settings`)),{successLabel:`Updated`})}},ea={command:`settings`,describe:`Operations for certificates.settings`,builder:e=>e.command(Zi).command($i).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ta(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const na={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:ta,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({associated_hostnames:e[`associated-hostnames`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.certificates.update({...r,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let i=d({associated_hostnames:e[`associated-hostnames`],name:f(e.name,`name`,`text`)});o(await c(`Updating`,async()=>t.zeroTrust.certificates.update({...i,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`})}},ra={command:`certificates`,describe:`Operations for certificates`,builder:e=>e.command(Ui).command(Gi).command(qi).command(Yi).command(na).command(ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ia(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const aa={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:ia,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...e,account_id:u})),{successLabel:`Updated`});return}let f=d({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...f,account_id:u})),{successLabel:`Updated`})}};function oa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sa={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:oa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.connectivitySettings.get({account_id:l})),{successLabel:`Loaded`})}},ca={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(aa).command(sa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function la(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ua={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:la,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.client.target.environments.list({account_id:l})),{successLabel:`Loaded`})}},da={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(ua).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fa={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(da).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pa(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ma={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:_(pa),handler:async r=>{let i={target_environment:r[`target-environment`],release_track:r[`release-track`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.client.versions.list({account_id:u,...i})),{successLabel:`Loaded`})}},ha={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(ma).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ga={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(fa).command(ha).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _a(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const va={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:_a,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`A user-friendly name for the deployment group.`));let p=d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]});o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...p,account_id:u})),{successLabel:`Created`})}};function ya(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ba={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:ya,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.deployment.groups.delete({account_id:l,group_id:r[`group-id`]})),{successLabel:`Deleted`})}};function xa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sa={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:xa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.deployment.groups.get({account_id:l,group_id:r[`group-id`]})),{successLabel:`Loaded`})}};function Ca(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wa={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:Ca,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.deployment.groups.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Ta(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ea={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:Ta,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...e,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`});return}let p=d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...p,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`})}},Da={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(va).command(ba).command(Sa).command(wa).command(Ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oa={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(Da).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ka(e){return e.positional(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Aa={command:`get <device-id>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:ka,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.get({account_id:l,device_id:r[`device-id`]})),{successLabel:`Loaded`})}};function ja(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ma={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:ja,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),r.name===void 0&&(r.name=await m(`name`,`A user-friendly name for the Device IP profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);r[`subnet-id`]===void 0&&(r[`subnet-id`]=await m(`subnet-id`,`The ID of the Subnet.`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function Na(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Pa={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:Na,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.ipProfiles.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function Fa(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ia={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Fa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.ipProfiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function La(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ra={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:La,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.ipProfiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function za(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ba={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:za,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Va={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(Ma).command(Pa).command(Ia).command(Ra).command(Ba).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ha(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ua={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:Ha,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.list({account_id:l})),{successLabel:`Loaded`})}};function Wa(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ga={command:`create`,describe:`Creates a new device managed network.`,builder:Wa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...e,account_id:u})),{successLabel:`Created`});return}r[`config-tls-sockaddr`]===void 0&&(r[`config-tls-sockaddr`]=await m(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the device managed network. This name must be unique.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device managed network.`,[`tls`]));let p=d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...p,account_id:u})),{successLabel:`Created`})}};function Ka(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qa={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:Ka,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.networks.delete({account_id:l,network_id:r[`network-id`]})),{successLabel:`Deleted`})}};function Ja(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ya={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:Ja,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.get({account_id:l,network_id:r[`network-id`]})),{successLabel:`Loaded`})}};function Xa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Za={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:Xa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.list({account_id:l})),{successLabel:`Loaded`})}};function Qa(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const $a={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:Qa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...e,account_id:u,network_id:r[`network-id`]})),{successLabel:`Updated`});return}let p=d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...p,account_id:u,network_id:r[`network-id`]})),{successLabel:`Updated`})}},eo={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(Ga).command(qa).command(Ya).command(Za).command($a).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function to(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const no={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:to,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.get({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Loaded`})}};function ro(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const io={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:ro,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/override_codes`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.list({account_id:l,device_id:r[`device-id`]})),{successLabel:`Loaded`})}},ao={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command(no).command(io).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const so={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:oo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices physical-devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrustDevicesPhysicalDevices.delete({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}};function co(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lo={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:co,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices physical-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrustDevicesPhysicalDevices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function uo(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`last-seen-registration-policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the device registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fo={command:`list`,describe:`Lists WARP devices.`,builder:_(uo),handler:async r=>{let i={cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],"last_seen_user.email":r[`last-seen-user-email`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],per_page:r[`per-page`],search:r.search,active_registrations:r[`active-registrations`],id:r.id,"last_seen_registration.policy.id":r[`last-seen-registration-policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices physical-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrustDevicesPhysicalDevices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function po(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mo={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:po,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices physical-devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/revoke`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrustDevicesPhysicalDevices.revoke({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}},ho={command:`physical-devices`,describe:`Operations for devices.physical-devices`,builder:e=>e.command(so).command(lo).command(fo).command(mo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function go(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const _o={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:go,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),r.name===void 0&&(r.name=await m(`name`,`The name of the device settings profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function vo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yo={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:vo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.policies.custom.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function bo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const xo={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:bo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:f(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:f(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...p,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}};function So(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Co={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:So,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.excludes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function wo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const To={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:wo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.excludes.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Eo={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(Co).command(To).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Do(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oo={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:Do,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function ko(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ao={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:ko,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},jo={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(Oo).command(Ao).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const No={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:Mo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function Po(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fo={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Po,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.includes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function Io(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lo={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Io,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.includes.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ro={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command(Fo).command(Lo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bo={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:zo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.list({account_id:l})),{successLabel:`Loaded`})}},Vo={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(_o).command(yo).command(xo).command(No).command(Bo).command(Eo).command(jo).command(Ro).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ho(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uo={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:Ho,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=d({enabled:e.enabled});o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:i,zone_id:n})),{successLabel:`Updated`})}};function Wo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Go={command:`get`,describe:`Fetches device certificate provisioning.`,builder:Wo,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get({zone_id:n})),{successLabel:`Loaded`})}},Ko={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(Uo).command(Go).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qo(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Jo={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:qo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...p,account_id:u})),{successLabel:`Updated`})}};function Yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xo={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:Yo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.excludes.get({account_id:l})),{successLabel:`Loaded`})}};function Zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qo={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:Zo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.excludes.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$o={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(Xo).command(Qo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function es(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ts={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:es,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:l})),{successLabel:`Loaded`})}};function ns(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const rs={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:ns,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},is={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(ts).command(rs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function as(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const os={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:as,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.get({account_id:l})),{successLabel:`Loaded`})}};function ss(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cs={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:ss,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.includes.get({account_id:l})),{successLabel:`Loaded`})}};function ls(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const us={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:ls,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.includes.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ds={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(cs).command(us).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fs={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(Jo).command(os).command(Ko).command($o).command(is).command(ds).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ps={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(Vo).command(fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ms(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const hs={command:`create`,describe:`Creates a new device posture rule.`,builder:ms,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...p,account_id:u})),{successLabel:`Created`})}};function gs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _s={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:gs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function vs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ys={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:vs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function bs(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const xs={command:`create`,describe:`Create a new device posture integration.`,builder:bs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...e,account_id:u})),{successLabel:`Created`});return}r.interval===void 0&&(r.interval=await m(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),r.name===void 0&&(r.name=await m(`name`,`The name of the device posture integration.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let p=d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function Ss(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cs={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:Ss,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function ws(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const Ts={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:ws,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...e,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}let p=d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...p,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}};function Es(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ds={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:Es,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function Os(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ks={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:Os,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.list({account_id:l})),{successLabel:`Loaded`})}},As={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(xs).command(Cs).command(Ts).command(Ds).command(ks).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function js(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ms={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:js,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.list({account_id:l})),{successLabel:`Loaded`})}};function Ns(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Ps={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:Ns,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Fs={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(hs).command(_s).command(ys).command(Ms).command(Ps).command(As).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Is(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ls={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:Is,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.bulkDelete({account_id:u,...i})),{successLabel:`Deleted`})}};function Rs(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const zs={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Rs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.registrations.delete({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Deleted`})}};function Bs(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vs={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:Bs,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.get({account_id:u,registration_id:r[`registration-id`],...i})),{successLabel:`Loaded`})}};function Hs(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Us={command:`list`,describe:`Lists WARP registrations.`,builder:_(Hs),handler:async r=>{let i={"user.id":r[`user-id`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],status:r.status,per_page:r[`per-page`],search:r.search,sort_by:r[`sort-by`],sort_order:r[`sort-order`],cursor:r.cursor,id:r.id,"device.id":r[`device-id`],"policy.id":r[`policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Ws(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gs={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:Ws,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.revoke({account_id:u,...i})),{successLabel:`Deleted`})}};function Ks(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qs={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Ks,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Creating`,async()=>l.zeroTrust.devices.registrations.unrevoke({account_id:u,...i})),{successLabel:`Created`})}},Js={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(Ls).command(zs).command(Vs).command(Us).command(Gs).command(qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ys(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xs={command:`create`,describe:`Sets the Global WARP override state.`,builder:Ys,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disconnect:r.disconnect,justification:f(r.justification,`justification`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let p=d({disconnect:r.disconnect,justification:f(r.justification,`justification`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...p,account_id:u})),{successLabel:`Created`})}};function Zs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qs={command:`get`,describe:`Fetch the Global WARP override state.`,builder:Zs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:l})),{successLabel:`Loaded`})}},$s={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(Xs).command(Qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ec={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command($s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`})}const nc={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:tc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
-`);return}if(r.body){let e=l(r.body);o(await c(`Deleting`,async()=>i.zeroTrust.devices.revoke.create({body:e,account_id:u})),{successLabel:`Deleted`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},rc={command:`revoke`,describe:`Operations for devices.revoke`,builder:e=>e.command(nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ic(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ac={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:ic,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function oc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sc={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:oc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function cc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lc={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:cc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.settings.get({account_id:l})),{successLabel:`Loaded`})}};function uc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dc={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:uc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},fc={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(ac).command(sc).command(lc).command(dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`})}const mc={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:pc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.unrevoke.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},hc={command:`unrevoke`,describe:`Operations for devices.unrevoke`,builder:e=>e.command(mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gc={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(Aa).command(Ua).command(ga).command(Oa).command(Va).command(eo).command(ao).command(ho).command(ps).command(Fs).command(Js).command(ec).command(rc).command(fc).command(hc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _c(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vc={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:_(_c),handler:async r=>{let i={from:r.from,to:r.to,sortBy:r[`sort-by`]};if(r.dryRun){s({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/colos`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.colos.list({account_id:u,...i})),{successLabel:`Loaded`})}},yc={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(vc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xc={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:bc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let u=await a(r),d=r.local?e:await t();if(r.accountId=d,r.body){let e=l(r.body);o(await c(`Creating`,async()=>u.zeroTrust.dex.commands.create({...e,account_id:d})),{successLabel:`Created`});return}o(await c(`Creating`,async()=>i(u,`POST`,`/accounts/${d}/dex/commands`)),{successLabel:`Created`})}};function Sc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cc={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:Sc,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],search:r.search};if(r.dryRun){s({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.eligibleDevices.list({account_id:u,...i})),{successLabel:`Loaded`})}},wc={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(Cc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ec={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:_(Tc),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,device_id:r[`device-id`],user_email:r[`user-email`],command_type:r[`command-type`],status:r.status};if(r.dryRun){s({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Dc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oc={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:Dc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.commands.quota.get({account_id:l})),{successLabel:`Loaded`})}},kc={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(Oc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ac(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const jc={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:Ac,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/${r[`command-id`]==null?`<command-id>`:encodeURIComponent(String(r[`command-id`]))}/downloads/${r.filename==null?`<filename>`:encodeURIComponent(String(r.filename))}`,pathParams:{"command-id":String(r[`command-id`]??``),filename:String(r.filename??``)},bodyKind:`none`});return}await a(r);let i=r.local?e:await t();r.accountId=i;let o=await c(`Loading`,async()=>ee(`/accounts/${i}/dex/commands/${encodeURIComponent(String(r[`command-id`]))}/downloads/${encodeURIComponent(String(r.filename))}`,{method:`GET`,local:r.local===!0,persistTo:r.persistTo}));v(r.text===!0?o.toString(`utf-8`):o)}},Mc={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(jc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nc={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(xc).command(Ec).command(wc).command(kc).command(Mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pc(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fc={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:Pc,handler:async r=>{let i={since_minutes:r[`since-minutes`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.live.get({account_id:u,...i})),{successLabel:`Loaded`})}},Ic={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command(Fc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rc={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:Lc,handler:async r=>{let i={to:r.to,from:r.from,colo:r.colo,device_id:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.overTime.get({account_id:u,...i})),{successLabel:`Loaded`})}},zc={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(Rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Bc={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(Ic).command(zc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hc={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:Vc,handler:async r=>{let i={since_minutes:r[`since-minutes`],time_now:r[`time-now`],colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function Uc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wc={command:`list`,describe:`List details of devices using WARP.`,builder:_(Uc),handler:async r=>{let i={to:r.to,from:r.from,page:r.page,per_page:r[`per-page`],sort_by:r[`sort-by`],colo:r.colo,device_id:r[`device-id`],mode:r.mode,status:r.status,platform:r.platform,version:r.version,source:r.source};if(r.dryRun){s({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Gc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kc={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:_(Gc),handler:async r=>{let i={from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.overTime.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},qc={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(Kc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Jc={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(Hc).command(Wc).command(Bc).command(qc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yc(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xc={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:_(Yc),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],from:r.from,to:r.to};if(r.dryRun){s({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/isps`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.isps.list({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},Zc={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(Xc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qc(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $c={command:`list`,describe:`List DEX tests with overview metrics.`,builder:_(Qc),handler:async r=>{let i={colo:r.colo,testName:r[`test-name`],deviceId:r[`device-id`],registration_id:r[`registration-id`],page:r.page,per_page:r[`per-page`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function el(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tl={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:el,handler:async r=>{let i={testName:r[`test-name`],deviceId:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:u,...i})),{successLabel:`Loaded`})}},nl={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(tl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rl={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command($c).command(nl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},il={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(rl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function al(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ol={command:`create`,describe:`Create a DEX Rule.`,builder:al,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the Rule.`));let p=d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function sl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const cl={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:sl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function ll(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ul={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:ll,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function dl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fl={command:`list`,describe:`List DEX Rules.`,builder:_(dl),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],sort_order:r[`sort-order`],sort_by:r[`sort-by`],name:r.name};if(r.dryRun){s({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.rules.list({account_id:u,...i})),{successLabel:`Loaded`})}};function pl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ml={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:pl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},hl={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(ol).command(cl).command(ul).command(fl).command(ml).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _l={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:_(gl),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function vl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yl={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:vl,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},bl={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(yl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xl={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(_l).command(bl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:_(Sl),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function wl(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tl={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:wl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-test-results/${r[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(r[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(r[`test-result-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:l,test_result_id:r[`test-result-id`]})),{successLabel:`Loaded`})}},El={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(Tl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ol={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:Dl,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},kl={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(Ol).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Al={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(Cl).command(El).command(kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jl={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(xl).command(Al).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ml(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nl={command:`create`,describe:`Create a DEX test.`,builder:Ml,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await m(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await h(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await m(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:p,account_id:u})),{successLabel:`Created`})}};function Pl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fl={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:Pl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.tests.delete({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Deleted`})}};function Il(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ll={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:Il,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.tests.get({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Loaded`})}};function Rl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zl={command:`list`,describe:`Fetch all DEX tests.`,builder:_(Rl),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],testName:r[`test-name`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Bl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vl={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:_(Bl),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval};if(r.dryRun){s({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/network-path`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.networkPath.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},Hl={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(Vl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ul(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wl={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:Ul,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:e,account_id:u,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await m(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await h(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await m(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:p,account_id:u,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`})}},Gl={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(Nl).command(Fl).command(Ll).command(zl).command(Wl).command(Hl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ql={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:_(Kl),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,type:r.type,toggle:r.toggle,config_name:r[`config-name`],account_name:r[`account-name`],sort_order:r[`sort-order`]};if(r.dryRun){s({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.warpChangeEvents.list({account_id:u,...i})),{successLabel:`Loaded`})}},Jl={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(ql).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Yl={command:`dex`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(yc).command(Nc).command(Jc).command(Zc).command(il).command(hl).command(jl).command(Gl).command(Jl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xl(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new custom prompt topic to create.`})}const Zl={command:`create`,describe:`Creates a DLP custom prompt topic entry.`,builder:Xl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`),topic:f(r.topic,`topic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r.topic===void 0&&(r.topic=await m(`topic`,`The topic field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`),topic:f(r.topic,`topic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...p,account_id:u})),{successLabel:`Created`})}};function Ql(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $l={command:`delete <entry-id>`,describe:`Deletes a DLP custom prompt topic entry.`,builder:Ql,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.customPromptTopics.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function eu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tu={command:`get <entry-id>`,describe:`Fetches a DLP custom prompt topic entry by ID.`,builder:eu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function nu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ru={command:`list`,describe:`Lists all DLP custom prompt topic entries in an account.`,builder:nu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.list({account_id:l})),{successLabel:`Loaded`})}};function iu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the custom prompt topic.`})}const $={command:`update <entry-id>`,describe:`Updates a DLP custom prompt topic entry.`,builder:iu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),topic:f(r.topic,`topic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r.topic===void 0&&(r.topic=await m(`topic`,`The topic field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),topic:f(r.topic,`topic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},au={command:`custom-prompt-topics`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Zl).command($l).command(tu).command(ru).command($).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ou(e){return e.option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data class.`})}const su={command:`create`,describe:`Creates a data class for use in DLP profiles.`,builder:ou,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...e,account_id:u})),{successLabel:`Created`});return}if(r[`data-tags`]===void 0)throw Error(`--data-tags is required (or pass --body with this field set).`);r.expression===void 0&&(r.expression=await m(`expression`,`The expression field`)),r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...p,account_id:u})),{successLabel:`Created`})}};function cu(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lu={command:`delete <data-class-id>`,describe:`Deletes a data class from the account.`,builder:cu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataClasses.delete({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Deleted`})}};function uu(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const du={command:`get <data-class-id>`,describe:`Gets the configuration for a data class.`,builder:uu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.get({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Loaded`})}};function fu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pu={command:`list`,describe:`Lists data classes configured for the account.`,builder:fu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.list({account_id:l})),{successLabel:`Loaded`})}};function mu(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data class to update.`})}const hu={command:`update <data-class-id>`,describe:`Updates the configuration for a data class.`,builder:mu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...e,account_id:u,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`});return}let p=d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...p,account_id:u,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`})}},gu={command:`data-classes`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(su).command(lu).command(du).command(pu).command(hu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _u(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag category.`})}const vu={command:`create`,describe:`Creates a data tag category, optionally from a template.`,builder:_u,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...p,account_id:u})),{successLabel:`Created`})}};function yu(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bu={command:`delete <category-id>`,describe:`Deletes a data tag category and its tags.`,builder:yu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTagCategories.delete({account_id:l,category_id:r[`category-id`]})),{successLabel:`Deleted`})}};function xu(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Su={command:`get <category-id>`,describe:`Gets a data tag category and its tags.`,builder:xu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.get({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function Cu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wu={command:`list`,describe:`Lists data tag categories configured for the account.`,builder:Cu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.list({account_id:l})),{successLabel:`Loaded`})}};function Tu(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag category to update.`})}const Eu={command:`update <category-id>`,describe:`Updates a data tag category and its tags.`,builder:Tu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...e,account_id:u,category_id:r[`category-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...p,account_id:u,category_id:r[`category-id`]})),{successLabel:`Updated`})}},Du={command:`data-tag-categories`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(vu).command(bu).command(Su).command(wu).command(Eu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ou(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ku={command:`get <template-id>`,describe:`Gets an available data tag category template.`,builder:Ou,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function Au(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ju={command:`list`,describe:`Lists available data tag category templates.`,builder:Au,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.list({account_id:l})),{successLabel:`Loaded`})}},Mu={command:`data-tag-category-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ku).command(ju).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nu(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag.`})}const Pu={command:`create <category-id>`,describe:`Creates a data tag in a category.`,builder:Nu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:e,account_id:u,category_id:r[`category-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:p,account_id:u,category_id:r[`category-id`]})),{successLabel:`Created`})}};function Fu(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Iu={command:`delete <tag-id>`,describe:`Deletes a data tag from a category.`,builder:Fu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTags.delete({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Deleted`})}};function Lu(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ru={command:`get <tag-id>`,describe:`Gets a data tag from a category.`,builder:Lu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.get({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Loaded`})}};function zu(e){return e.option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bu={command:`list`,describe:`Lists data tags in a category.`,builder:zu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.list({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function Vu(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag to update.`})}const Hu={command:`update <tag-id>`,describe:`Updates a data tag in a category.`,builder:Vu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...e,account_id:u,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...p,account_id:u,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`})}},Uu={command:`data-tags`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Pu).command(Iu).command(Ru).command(Bu).command(Hu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wu(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
-Determines if the words should be matched in a case-sensitive manner
-Cannot be set to false if \`secret\` is true or undefined`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version
-
-Non-secret custom word lists with no header are always version 1.
-Secret EDM lists with no header are version 1.
-Multicolumn CSV with headers are version 2.
-Omitting this field provides the default value 0, which is interpreted
-the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.
-
-If true, the response will include a secret to use with the EDM encoder.
-If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Gu={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:Wu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:f(r.name,`name`,`text`),secret:r.secret}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:f(r.name,`name`,`text`),secret:r.secret});o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...p,account_id:u})),{successLabel:`Created`})}};function Ku(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qu={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:Ku,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.datasets.delete({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Deleted`})}};function Ju(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yu={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:Ju,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.get({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Loaded`})}};function Xu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zu={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Xu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.list({account_id:l})),{successLabel:`Loaded`})}};function Qu(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
-
-Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const $u={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Qu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...e,account_id:u,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`});return}let p=d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...p,account_id:u,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`})}};function ed(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const td={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:ed,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.upload.create({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Created`})}};function nd(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const rd={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:nd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},id={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(td).command(rd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ad(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const od={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:ad,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.versions.create({body:e,account_id:u,dataset_id:r[`dataset-id`],version:r.version})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function sd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const cd={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:sd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``),"entry-id":String(r[`entry-id`]??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ld={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(cd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ud={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(od).command(ld).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},dd={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Gu).command(qu).command(Yu).command(Zu).command($u).command(id).command(ud).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fd(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const pd={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:fd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:f(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...e,account_id:u})),{successLabel:`Created`});return}r[`auth-requirements-type`]===void 0&&(r[`auth-requirements-type`]=await h(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let p=d({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:f(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...p,account_id:u})),{successLabel:`Created`})}};function md(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hd={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:md,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.accountMapping.get({account_id:l})),{successLabel:`Loaded`})}},gd={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(pd).command(hd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _d(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const vd={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:_d,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.bulkEdit({...e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function yd(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const bd={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:yd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await h(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:p,account_id:u})),{successLabel:`Created`})}};function xd(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sd={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:xd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.email.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function Cd(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wd={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:Cd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function Td(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ed={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:Td,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.list({account_id:l})),{successLabel:`Loaded`})}};function Dd(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const Od={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:Dd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await h(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},kd={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(vd).command(bd).command(Sd).command(wd).command(Ed).command(Od).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ad={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(gd).command(kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jd(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const Md={command:`create`,describe:`Creates a DLP custom entry.`,builder:jd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await m(`pattern-regex`,`The pattern.regex field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...p,account_id:u})),{successLabel:`Created`})}};function Nd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Pd={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:Nd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/custom/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.name===void 0&&(r.name=await m(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await m(`pattern-regex`,`The pattern.regex field`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Fd={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Pd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Id(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ld={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:Id,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Rd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zd={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Rd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function Bd(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Vd={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:Bd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await m(`entry-id`,`The entry_id field`));let p=d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:p,account_id:u})),{successLabel:`Created`})}};function Hd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ud={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:Hd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.integration.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Wd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const Gd={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Wd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:f,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Kd={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Vd).command(Ud).command(Gd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jd={command:`list`,describe:`Lists all DLP entries in an account.`,builder:qd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.list({account_id:l})),{successLabel:`Loaded`})}};function Yd(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Xd={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Yd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await m(`entry-id`,`The entry_id field`));let p=d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:p,account_id:u})),{successLabel:`Created`})}};function Zd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qd={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Zd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.predefined.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function $d(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const ef={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:$d,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:f,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},tf={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Xd).command(Qd).command(ef).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nf(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`type`,{type:`string`,description:`The type field`,choices:[`custom`,`predefined`,`integration`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`}).check(e=>{if([`pattern-regex`,`pattern-validation`].some(t=>e[t]!==void 0)){let t=[`pattern-regex`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --pattern-* flag is set`)}return!0})}const rf={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:nf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},type:f(r.type,`type`,`text`),enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.type===void 0&&(r.type=await h(`type`,`The type field`,[`custom`,`predefined`,`integration`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},type:f(r.type,`type`,`text`),enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},af={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Md).command(Ld).command(zd).command(Jd).command(rf).command(Fd).command(Kd).command(tf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function of(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sf={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:of,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.limits.list({account_id:l})),{successLabel:`Loaded`})}},cf={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lf(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const uf={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:lf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({max_match_bytes:r[`max-match-bytes`],regex:f(r.regex,`regex`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...e,account_id:u})),{successLabel:`Created`});return}r.regex===void 0&&(r.regex=await m(`regex`,`The regex field`));let p=d({max_match_bytes:r[`max-match-bytes`],regex:f(r.regex,`regex`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...p,account_id:u})),{successLabel:`Created`})}},df={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(uf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ff(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pf={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:ff,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.payloadLogs.get({account_id:l})),{successLabel:`Loaded`})}};function mf(e){return e.option(`masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
-
-- Set to null or empty string to disable payload logging.
-- Set to a non-empty base64 string to enable payload logging with the given key.
-
-For customers with configurable payload masking feature rolled out:
-- If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.
-
-For all other customers:
-- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const hf={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:mf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({masking_level:f(r[`masking-level`],`masking-level`,`text`),public_key:f(r[`public-key`],`public-key`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({masking_level:f(r[`masking-level`],`masking-level`,`text`),public_key:f(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...p,account_id:u})),{successLabel:`Updated`})}},gf={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(pf).command(hf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _f(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const vf={command:`create`,describe:`Creates a DLP custom profile.`,builder:_f,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function yf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bf={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:yf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.custom.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function xf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sf={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:xf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.custom.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Cf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const wf={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:Cf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Tf={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(vf).command(bf).command(Sf).command(wf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ef(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Df={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:Ef,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Of(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kf={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:Of,handler:async r=>{let i={all:r.all};if(r.dryRun){s({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dlp.profiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Af(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const jf={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Af,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Created`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Created`})}};function Mf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Nf={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:Mf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.predefined.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function Pf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ff={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:Pf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function If(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const Lf={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:If,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Rf={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(jf).command(Nf).command(Ff).command(Lf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},zf={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Df).command(kf).command(Tf).command(Rf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bf(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vf={command:`get <template-id>`,describe:`Gets an available sensitivity group template.`,builder:Bf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function Hf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uf={command:`list`,describe:`Lists available sensitivity group templates.`,builder:Hf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.list({account_id:l})),{successLabel:`Loaded`})}},Wf={command:`sensitivity-group-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Vf).command(Uf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gf(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity group.`})}const Kf={command:`create`,describe:`Creates a sensitivity group, optionally from a template.`,builder:Gf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...p,account_id:u})),{successLabel:`Created`})}};function qf(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Jf={command:`delete <sensitivity-group-id>`,describe:`Deletes a sensitivity group and its levels.`,builder:qf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityGroups.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Deleted`})}};function Yf(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xf={command:`get-level-order <sensitivity-group-id>`,describe:`Gets the current order of sensitivity levels in a group.`,builder:Yf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get-level-order`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.getLevelOrder({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Zf(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qf={command:`get <sensitivity-group-id>`,describe:`Gets a sensitivity group and its levels.`,builder:Zf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function $f(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ep={command:`list`,describe:`Lists sensitivity groups configured for the account.`,builder:$f,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.list({account_id:l})),{successLabel:`Loaded`})}};function tp(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`level-ids`,{type:`string`,array:!0,description:`The level_ids field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Desired ordered list of level IDs.`})}const np={command:`update-level-order <sensitivity-group-id>`,describe:`Updates the order of sensitivity levels in a group.`,builder:tp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update-level-order`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({level_ids:r[`level-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}if(r[`level-ids`]===void 0)throw Error(`--level-ids is required (or pass --body with this field set).`);let f=d({level_ids:r[`level-ids`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:f,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}};function rp(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity group to update.`})}const ip={command:`update <sensitivity-group-id>`,describe:`Updates a sensitivity group and its levels.`,builder:rp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}},ap={command:`sensitivity-groups`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Kf).command(Jf).command(Qf).command(Xf).command(ep).command(ip).command(np).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function op(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity level.`})}const sp={command:`create <sensitivity-group-id>`,describe:`Creates a sensitivity level in a group.`,builder:op,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`})}};function cp(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lp={command:`delete <sensitivity-level-id>`,describe:`Deletes a sensitivity level from a group.`,builder:cp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityLevels.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Deleted`})}};function up(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dp={command:`get <sensitivity-level-id>`,describe:`Gets a sensitivity level from a group.`,builder:up,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Loaded`})}};function fp(e){return e.option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pp={command:`list`,describe:`Lists sensitivity levels in a sensitivity group.`,builder:fp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.list({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function mp(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity level to update.`})}const hp={command:`update <sensitivity-level-id>`,describe:`Updates a sensitivity level in a group.`,builder:mp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`})}},gp={command:`sensitivity-levels`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(sp).command(lp).command(dp).command(pp).command(hp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_p={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(au).command(gu).command(Du).command(Mu).command(Uu).command(dd).command(Ad).command(af).command(cf).command(df).command(gf).command(zf).command(Wf).command(ap).command(gp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vp(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const yp={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:vp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...e,account_id:u})),{successLabel:`Created`});return}if(r[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...p,account_id:u})),{successLabel:`Created`})}},bp={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(yp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xp(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const Sp={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:xp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...e,account_id:u,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`});return}let p=d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...p,account_id:u,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`})}},Cp={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(Sp).command(bp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wp(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Tp={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:wp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.documentFingerprints.delete({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function Ep(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dp={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:Ep,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},Op={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Dp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ap={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:kp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:l})),{successLabel:`Loaded`})}},jp={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Ap).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Mp={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(Op).command(jp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Np(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Pp={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:Np,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=p(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e})),{successLabel:`Updated`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Fp={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Tp).command(Pp).command(Cp).command(Mp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ip(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lp={command:`list`,describe:`List all application and application type mappings.`,builder:Ip,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.appTypes.list({account_id:l})),{successLabel:`Loaded`})}},Rp={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(Lp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bp={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:zp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.auditSshSettings.get({account_id:l})),{successLabel:`Loaded`})}};function Vp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hp={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:Vp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:l})),{successLabel:`Created`})}};function Up(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wp={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:Up,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({public_key:f(r[`public-key`],`public-key`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...e,account_id:u})),{successLabel:`Updated`});return}r[`public-key`]===void 0&&(r[`public-key`]=await m(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let p=d({public_key:f(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...p,account_id:u})),{successLabel:`Updated`})}},Gp={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(Bp).command(Hp).command(Wp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qp={command:`list`,describe:`List all categories.`,builder:Kp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.categories.list({account_id:l})),{successLabel:`Loaded`})}},Jp={command:`categories`,describe:`Operations for gateway.categories`,builder:e=>e.command(qp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yp(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xp={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:Yp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.activate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function Zp(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qp={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:Zp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({validity_period_days:r[`validity-period-days`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...e,account_id:u})),{successLabel:`Created`});return}let f=d({validity_period_days:r[`validity-period-days`]});o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...f,account_id:u})),{successLabel:`Created`})}};function $p(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const em={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:$p,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.deactivate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function tm(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nm={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:tm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.certificates.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function rm(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const im={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:rm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.get({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Loaded`})}};function am(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const om={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:am,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.list({account_id:l})),{successLabel:`Loaded`})}},sm={command:`certificates`,describe:`Operations for gateway.certificates`,builder:e=>e.command(Xp).command(Qp).command(em).command(nm).command(im).command(om).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lm={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:cm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.customCertificate.get({account_id:l})),{successLabel:`Loaded`})}},um={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dm(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const fm={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:dm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function pm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mm={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:pm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.get({account_id:l})),{successLabel:`Loaded`})}};function hm(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const gm={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:hm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:p,account_id:u})),{successLabel:`Updated`})}},_m={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(fm).command(mm).command(gm).command(um).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ym={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:vm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.create({account_id:l})),{successLabel:`Created`})}};function bm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xm={command:`list`,describe:`List Zero Trust Gateway IPv4 address pairs for an account.`,builder:bm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway dns-destination-ips list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/dns_destination_ips`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.dnsDestinationIps.list({account_id:l})),{successLabel:`Loaded`})}},Sm={command:`dns-destination-ips`,describe:`Operations for gateway.dns-destination-ips`,builder:e=>e.command(xm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wm={command:`list`,describe:`Retrieve the list of egress CIDRs allocated to this Zero Trust account.`,builder:Cm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway egress-cidr-pairs list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/egress_cidr_pairs`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.egressCidrPairs.list({account_id:l})),{successLabel:`Loaded`})}},Tm={command:`egress-cidr-pairs`,describe:`Operations for gateway.egress-cidr-pairs`,builder:e=>e.command(wm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Em(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dm={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:Em,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.list({account_id:l})),{successLabel:`Loaded`})}};function Om(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const km={command:`create`,describe:`Creates a new Zero Trust list.`,builder:Om,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the list name.`)),r.type===void 0&&(r.type=await h(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...p,account_id:u})),{successLabel:`Created`})}};function Am(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const jm={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:Am,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.lists.delete({account_id:l,list_id:r[`list-id`]})),{successLabel:`Deleted`})}};function Mm(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nm={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:Mm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({remove:r.remove}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...e,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`});return}let f=d({remove:r.remove});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...f,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function Pm(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fm={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:Pm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.get({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}};function Im(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lm={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:Im,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}/items`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.items.list({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}},Rm={command:`items`,describe:`Operations for gateway.lists.items`,builder:e=>e.command(Lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zm(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bm={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:_(zm),handler:async r=>{let i={type:r.type};if(r.dryRun){s({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.lists.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Vm(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hm={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Vm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...e,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the list name.`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...p,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function Um(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Wm={command:`upload`,describe:"Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status.",builder:Um,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists upload`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/upload`,pathParams:{},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=p(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Gm={command:`lists`,describe:`Operations for gateway.lists`,builder:e=>e.command(km).command(jm).command(Nm).command(Fm).command(Bm).command(Hm).command(Wm).command(Rm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Km(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const qm={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:Km,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the location name.`));let p=d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...p,account_id:u})),{successLabel:`Created`})}};function Jm(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ym={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:Jm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.locations.delete({account_id:l,location_id:r[`location-id`]})),{successLabel:`Deleted`})}};function Xm(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zm={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:Xm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.locations.get({account_id:l,location_id:r[`location-id`]})),{successLabel:`Loaded`})}};function Qm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $m={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:Qm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.locations.list({account_id:l})),{successLabel:`Loaded`})}};function eh(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const th={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:eh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...e,account_id:u,location_id:r[`location-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the location name.`));let p=d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...p,account_id:u,location_id:r[`location-id`]})),{successLabel:`Updated`})}},nh={command:`locations`,describe:`Operations for gateway.locations`,builder:e=>e.command(qm).command(Ym).command(Zm).command($m).command(th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ih={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:rh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.logging.get({account_id:l})),{successLabel:`Loaded`})}};function ah(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oh={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:ah,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:e,account_id:u})),{successLabel:`Updated`});return}let f=d({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:f,account_id:u})),{successLabel:`Updated`})}},sh={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(ih).command(oh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ch(e){return e.positional(`operation-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lh={command:`get <operation-id>`,describe:`Fetch a single Zero Trust Gateway operation by its ID.`,builder:ch,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations/${r[`operation-id`]==null?`<operation-id>`:encodeURIComponent(String(r[`operation-id`]))}`,pathParams:{"operation-id":String(r[`operation-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.get({account_id:l,operation_id:r[`operation-id`]})),{successLabel:`Loaded`})}};function uh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dh={command:`list`,describe:`List all Zero Trust Gateway operations for an account.`,builder:uh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.list({account_id:l})),{successLabel:`Loaded`})}},fh={command:`operations`,describe:`Operations for gateway.operations`,builder:e=>e.command(lh).command(dh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ph(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mh={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:ph,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),slug:f(r.slug,`slug`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...e,account_id:u})),{successLabel:`Created`});return}r.contents===void 0&&(r.contents=await m(`contents`,`Actual contents of the PAC file`)),r.name===void 0&&(r.name=await m(`name`,`Name of the PAC file.`));let p=d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),slug:f(r.slug,`slug`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function hh(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gh={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:hh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.pacfiles.delete({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Deleted`})}};function _h(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vh={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:_h,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.get({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Loaded`})}};function yh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bh={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:yh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.list({account_id:l})),{successLabel:`Loaded`})}};function xh(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sh={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:xh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...e,account_id:u,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`});return}r.contents===void 0&&(r.contents=await m(`contents`,`Actual contents of the PAC file`)),r.description===void 0&&(r.description=await m(`description`,`Detailed description of the PAC file.`)),r.name===void 0&&(r.name=await m(`name`,`Name of the PAC file.`));let p=d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...p,account_id:u,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`})}},Ch={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command(mh).command(gh).command(vh).command(bh).command(Sh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wh(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Th={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:wh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({kind:f(r.kind,`kind`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:e,account_id:u})),{successLabel:`Created`});return}r.kind===`identity`&&r.kind===void 0&&(r.kind=await m(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let p=d({kind:f(r.kind,`kind`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:p,account_id:u})),{successLabel:`Created`})}};function Eh(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Dh={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:Eh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.proxyEndpoints.delete({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function Oh(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kh={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:Oh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ips:r.ips,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...e,account_id:u,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let p=d({ips:r.ips,name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...p,account_id:u,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function Ah(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jh={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:Ah,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.proxyEndpoints.get({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function Mh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nh={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:Mh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.proxyEndpoints.list({account_id:l})),{successLabel:`Loaded`})}},Ph={command:`proxy-endpoints`,describe:`Operations for gateway.proxy-endpoints`,builder:e=>e.command(Th).command(Dh).command(kh).command(jh).command(Nh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ih={command:`bulk-edit`,describe:`Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated.`,builder:Fh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.bulkEdit({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Lh(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Rh={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:Lh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r.action===void 0&&(r.action=await h(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await m(`name`,`Specify the rule name.`));let p=d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function zh(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Bh={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:zh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function Vh(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hh={command:`edit <rule-id>`,describe:"Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement.",builder:Vh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),precedence:r.precedence}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),precedence:r.precedence});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}};function Uh(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wh={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Uh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function Gh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kh={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:Gh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.listTenant({account_id:l})),{successLabel:`Loaded`})}};function qh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jh={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:qh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.list({account_id:l})),{successLabel:`Loaded`})}};function Yh(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xh={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Yh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.resetExpiration({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Created`})}};function Zh(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Qh={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Zh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.action===void 0&&(r.action=await h(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await m(`name`,`Specify the rule name.`));let p=d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},$h={command:`rules`,describe:`Operations for gateway.rules`,builder:e=>e.command(Ih).command(Rh).command(Bh).command(Hh).command(Wh).command(Jh).command(Kh).command(Xh).command(Qh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},eg={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(ym).command(Dm).command(Rp).command(Gp).command(Jp).command(sm).command(_m).command(Sm).command(Tm).command(Gm).command(nh).command(sh).command(fh).command(Ch).command(Ph).command($h).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tg(e){return e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ng={command:`create`,describe:`Creates a new Access group.`,builder:tg,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.groups.create({...r,zone_id:n})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await m(`name`,`The name of the Access group.`));let i=d({name:f(e.name,`name`,`text`)});o(await c(`Creating`,async()=>t.zeroTrust.groups.create({...i,zone_id:n})),{successLabel:`Created`})}};function rg(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ig={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:rg,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.groups.delete({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function ag(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const og={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:ag,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.groups.get({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function sg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cg={command:`list`,describe:`Lists all Access groups.`,builder:sg,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.groups.list({zone_id:n})),{successLabel:`Loaded`})}};function lg(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ug={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:lg,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.groups.update({...r,zone_id:n,group_id:e[`group-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await m(`name`,`The name of the Access group.`));let i=d({name:f(e.name,`name`,`text`)});o(await c(`Updating`,async()=>t.zeroTrust.groups.update({...i,zone_id:n,group_id:e[`group-id`]})),{successLabel:`Updated`})}},dg={command:`groups`,describe:`Operations for groups`,builder:e=>e.command(ng).command(ig).command(og).command(cg).command(ug).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pg={command:`create`,describe:`Adds a new identity provider to Access.`,builder:fg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.identityProviders.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function mg(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hg={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:mg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.identityProviders.delete({account_id:l,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Deleted`})}};function gg(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _g={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:gg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.identityProviders.get({account_id:l,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Loaded`})}};function vg(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yg={command:`list`,describe:`Lists all configured identity providers.`,builder:vg,handler:async r=>{let i={scim_enabled:r[`scim-enabled`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.list({account_id:u,...i})),{successLabel:`Loaded`})}};function bg(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xg={command:`create <identity-provider-id>`,describe:"Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider",builder:bg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers saml-certificate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/saml_certificate`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.identityProviders.samlCertificate.create({account_id:l,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Created`})}},Sg={command:`saml-certificate`,describe:`Operations for identity-providers.saml-certificate`,builder:e=>e.command(xg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cg(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wg={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Cg,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.groups.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},Tg={command:`groups`,describe:`Operations for identity-providers.scim.groups`,builder:e=>e.command(wg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Eg(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dg={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Eg,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],username:r.username,email:r.email,name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.users.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},Og={command:`users`,describe:`Operations for identity-providers.scim.users`,builder:e=>e.command(Dg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},kg={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(Tg).command(Og).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ag(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jg={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:Ag,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.identityProviders.update({body:e,account_id:u,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Mg={command:`identity-providers`,describe:`Operations for identity-providers`,builder:e=>e.command(pg).command(hg).command(_g).command(yg).command(jg).command(Sg).command(kg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ng(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`,default:!1}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pg={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:Ng,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_authenticate_via_warp:r[`allow-authenticate-via-warp`],auth_domain:f(r[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:r[`auto-redirect-to-identity`],deny_unmatched_requests:r[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:r[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:r[`is-ui-read-only`],login_design:{background_color:f(r[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(r[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(r[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(r[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(r[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(r[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(r[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(r[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:r[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:r[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:r[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(r[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:r[`mfa-required-for-all-apps`],name:f(r.name,`name`,`text`),session_duration:f(r[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(r[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(r[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:r[`warp-auth-non-browser-401`],warp_auth_session_duration:f(r[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.organizations.create({...e,account_id:u})),{successLabel:`Created`});return}r[`auth-domain`]===void 0&&(r[`auth-domain`]=await m(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),r.name===void 0&&(r.name=await m(`name`,`The name of your Zero Trust organization.`));let p=d({allow_authenticate_via_warp:r[`allow-authenticate-via-warp`],auth_domain:f(r[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:r[`auto-redirect-to-identity`],deny_unmatched_requests:r[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:r[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:r[`is-ui-read-only`],login_design:{background_color:f(r[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(r[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(r[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(r[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(r[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(r[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(r[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(r[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:r[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:r[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:r[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(r[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:r[`mfa-required-for-all-apps`],name:f(r.name,`name`,`text`),session_duration:f(r[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(r[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(r[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:r[`warp-auth-non-browser-401`],warp_auth_session_duration:f(r[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.organizations.create({...p,account_id:u})),{successLabel:`Created`})}};function Fg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ig={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:Fg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.organizations.doh.get({account_id:l})),{successLabel:`Loaded`})}};function Lg(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rg={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:Lg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({doh_jwt_duration:f(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(r[`service-token-id`],`service-token-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({doh_jwt_duration:f(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(r[`service-token-id`],`service-token-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...p,account_id:u})),{successLabel:`Updated`})}},zg={command:`doh`,describe:`Operations for organizations.doh`,builder:e=>e.command(Ig).command(Rg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vg={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Bg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.organizations.list({account_id:l})),{successLabel:`Loaded`})}};function Hg(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ug={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:Hg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({devices:r.devices,email:f(r.email,`email`,`text`),user_uid:f(r[`user-uid`],`user-uid`,`text`),warp_session_reauth:r[`warp-session-reauth`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
-`);return}if(r.body){let e=l(r.body);o(await c(`Deleting`,async()=>i.zeroTrust.organizations.revokeUsers({...e,account_id:u})),{successLabel:`Deleted`});return}r.email===void 0&&(r.email=await m(`email`,`The email of the user to revoke.`));let p=d({devices:r.devices,email:f(r.email,`email`,`text`),user_uid:f(r[`user-uid`],`user-uid`,`text`),warp_session_reauth:r[`warp-session-reauth`]});o(await c(`Deleting`,async()=>i.zeroTrust.organizations.revokeUsers({...p,account_id:u})),{successLabel:`Deleted`})}};function Wg(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gg={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Wg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_authenticate_via_warp:r[`allow-authenticate-via-warp`],auth_domain:f(r[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:r[`auto-redirect-to-identity`],custom_pages:{forbidden:f(r[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(r[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:r[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:r[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:r[`is-ui-read-only`],login_design:{background_color:f(r[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(r[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(r[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(r[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(r[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(r[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(r[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(r[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:r[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:r[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:r[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(r[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:r[`mfa-required-for-all-apps`],name:f(r.name,`name`,`text`),session_duration:f(r[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(r[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(r[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:r[`warp-auth-non-browser-401`],warp_auth_session_duration:f(r[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.organizations.update({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({allow_authenticate_via_warp:r[`allow-authenticate-via-warp`],auth_domain:f(r[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:r[`auto-redirect-to-identity`],custom_pages:{forbidden:f(r[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(r[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:r[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:r[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:r[`is-ui-read-only`],login_design:{background_color:f(r[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(r[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(r[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(r[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(r[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(r[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(r[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(r[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:r[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:r[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:r[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(r[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:r[`mfa-required-for-all-apps`],name:f(r.name,`name`,`text`),session_duration:f(r[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(r[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(r[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:r[`warp-auth-non-browser-401`],warp_auth_session_duration:f(r[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.organizations.update({...p,account_id:u})),{successLabel:`Updated`})}},Kg={command:`organizations`,describe:`Operations for organizations`,builder:e=>e.command(Pg).command(Vg).command(Ug).command(Gg).command(zg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jg={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:qg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.custom.list({account_id:l})),{successLabel:`Loaded`})}},Yg={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(Jg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xg(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Zg={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Xg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`],profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...e,account_id:u})),{successLabel:`Created`});return}r[`profile-id`]===void 0&&(r[`profile-id`]=await m(`profile-id`,`The profile_id field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`],profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...p,account_id:u})),{successLabel:`Created`})}};function Qg(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $g={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:Qg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function e_(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const t_={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:e_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},n_={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(Zg).command($g).command(t_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},r_={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(Yg).command(n_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function i_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const a_={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:i_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.behaviours.get({account_id:l})),{successLabel:`Loaded`})}};function o_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const s_={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:o_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.behaviours.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},c_={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(a_).command(s_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function l_(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const u_={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:l_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function d_(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const f_={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:d_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({integration_type:f(r[`integration-type`],`integration-type`,`text`),reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...e,account_id:u})),{successLabel:`Created`});return}r[`integration-type`]===void 0&&(r[`integration-type`]=await h(`integration-type`,`The integration_type field`,[`Okta`])),r[`tenant-url`]===void 0&&(r[`tenant-url`]=await m(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({integration_type:f(r[`integration-type`],`integration-type`,`text`),reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function p_(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const m_={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:p_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function h_(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const g_={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:h_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function __(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const v_={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:__,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.list({account_id:l})),{successLabel:`Loaded`})}};function y_(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const b_={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:y_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${r[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(r[`reference-id`]))}`,pathParams:{"reference-id":String(r[`reference-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.references.get({account_id:l,reference_id:r[`reference-id`]})),{successLabel:`Loaded`})}},x_={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(b_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function S_(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const C_={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:S_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({active:r.active,reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...e,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}if(r.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);r[`tenant-url`]===void 0&&(r[`tenant-url`]=await m(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({active:r.active,reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...p,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}},w_={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(f_).command(m_).command(g_).command(v_).command(C_).command(x_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function T_(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const E_={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:T_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/reset`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.reset({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function D_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const O_={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:D_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.summary.get({account_id:l})),{successLabel:`Loaded`})}},k_={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(O_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},A_={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(u_).command(E_).command(c_).command(w_).command(k_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const M_={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:j_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.seats.edit({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},N_={command:`seats`,describe:`Operations for seats`,builder:e=>e.command(M_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function P_(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const F_={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:P_,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.serviceTokens.create({...r,zone_id:n})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await m(`name`,`The name of the service token.`));let i=d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>t.zeroTrust.serviceTokens.create({...i,zone_id:n})),{successLabel:`Created`})}};function I_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const L_={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:I_,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.serviceTokens.delete({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Deleted`})}};function R_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const z_={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:R_,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.serviceTokens.get({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Loaded`})}};function B_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const V_={command:`list`,describe:`Lists all service tokens.`,builder:B_,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.serviceTokens.list({zone_id:n})),{successLabel:`Loaded`})}};function H_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const U_={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:H_,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...r,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`});return}let i=d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...i,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`})}},W_={command:`service-tokens`,describe:`Operations for service-tokens`,builder:e=>e.command(F_).command(L_).command(z_).command(V_).command(U_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function G_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const K_={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:G_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function q_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
-
-- Set to a non-empty base64 string to enable payload logging with the given key.
-- Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const J_={command:`edit`,describe:`Missing fields keep their existing values.`,builder:q_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function Y_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const X_={command:`get`,describe:`Gets the account-level DLP settings.`,builder:Y_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.settings.get({account_id:l})),{successLabel:`Loaded`})}};function Z_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
-
-- Set to a non-empty base64 string to enable payload logging with the given key.
-- Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const Q_={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:Z_,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},$_={command:`settings`,describe:`Settings operations`,builder:e=>e.command(K_).command(J_).command(X_).command(Q_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ev(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tv={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result.`,builder:ev,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/mfa_authenticators/${r[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(r[`authenticator-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``),"authenticator-id":String(r[`authenticator-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.users.mfa.authenticators.delete({account_id:l,user_id:r[`user-id`],authenticator_id:r[`authenticator-id`]})),{successLabel:`Deleted`})}},nv={command:`authenticators`,describe:`Operations for users.mfa.authenticators`,builder:e=>e.command(tv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rv={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(nv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},iv={command:`users`,describe:`Operations for users`,builder:e=>e.command(rv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function av(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ov={command:`create`,describe:`Adds a new identity provider to Access.`,builder:av,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.zoneIdentityProviders.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function sv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const cv={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:sv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>t.zeroTrust.zoneIdentityProviders.delete({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Deleted`})}};function lv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uv={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:lv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.get({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Loaded`})}};function dv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fv={command:`list`,describe:`Lists all configured identity providers.`,builder:dv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.list({zone_id:n})),{successLabel:`Loaded`})}};function pv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mv={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:pv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.zoneIdentityProviders.update({body:r,zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},hv={command:`zone-identity-providers`,describe:`Operations for zone-identity-providers`,builder:e=>e.command(ov).command(cv).command(uv).command(fv).command(mv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _v={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:gv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(e.name,`name`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Creating`,async()=>t.zeroTrust.zoneOrganizations.create({...r,zone_id:n})),{successLabel:`Created`});return}e[`auth-domain`]===void 0&&(e[`auth-domain`]=await m(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await m(`name`,`The name of your Zero Trust organization.`));let i=d({auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(e.name,`name`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});o(await c(`Creating`,async()=>t.zeroTrust.zoneOrganizations.create({...i,zone_id:n})),{successLabel:`Created`})}};function vv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yv={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:vv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-organizations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.zoneOrganizations.get({zone_id:n})),{successLabel:`Loaded`})}};function bv(e){return e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xv={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:bv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations/revoke_user`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({email:f(e.email,`email`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await g({force:!!e.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
-`);return}if(e.body){let r=l(e.body);o(await c(`Deleting`,async()=>t.zeroTrust.zoneOrganizations.revokeUserCreate({...r,zone_id:n})),{successLabel:`Deleted`});return}e.email===void 0&&(e.email=await m(`email`,`The email of the user to revoke.`));let i=d({email:f(e.email,`email`,`text`)});o(await c(`Deleting`,async()=>t.zeroTrust.zoneOrganizations.revokeUserCreate({...i,zone_id:n})),{successLabel:`Deleted`})}};function Sv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Cv={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Sv,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(e.name,`name`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...r,zone_id:n})),{successLabel:`Updated`});return}let i=d({auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(e.name,`name`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});o(await c(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...i,zone_id:n})),{successLabel:`Updated`})}},wv={command:`zone-organizations`,describe:`Operations for zone-organizations`,builder:e=>e.command(_v).command(yv).command(xv).command(Cv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tv={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(pr).command(mi).command(Vi).command(ra).command(ca).command(gc).command(Yl).command(_p).command(Fp).command(eg).command(dg).command(Mg).command(Kg).command(r_).command(A_).command(N_).command(W_).command($_).command(iv).command(hv).command(wv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Tv as default};