diff --git a/.changeset/update-openapi-d35bb4402f38.md b/.changeset/update-openapi-d35bb4402f38.md new file mode 100644 index 0000000000..522a387f2a --- /dev/null +++ b/.changeset/update-openapi-d35bb4402f38.md @@ -0,0 +1,6 @@ +--- +"cf": minor +--- + +Update the generated command surface for Forge OpenAPI release +`d35bb4402f3864b83e802be14ca7f58eb920528b`. diff --git a/packages/cli/generate.ts b/packages/cli/generate.ts index 94fe8710c0..89b3798532 100644 --- a/packages/cli/generate.ts +++ b/packages/cli/generate.ts @@ -17,7 +17,7 @@ import type { ForgeOpenApiDocument } from "./generator/openapi.js"; const bundle = process.env.FORGE_OPENAPI_BUNDLE; // Bump this SHA to generate the commands from a new release. -const FORGE_OPENAPI_VERSION = "fdc1aa8a39e2e515f26c2fc6109d7e93050e811c"; +const FORGE_OPENAPI_VERSION = "d35bb4402f3864b83e802be14ca7f58eb920528b"; const FORGE_OPENAPI_RELEASE = `openapi@${FORGE_OPENAPI_VERSION}`; const FORGE_OPENAPI_ASSET = "openapi.forge.json"; const FORGE_OPENAPI_ASSET_URL = `https://github.com/cloudflare/forge/releases/download/${FORGE_OPENAPI_RELEASE}/${FORGE_OPENAPI_ASSET}`; diff --git a/packages/cli/src/commands/_generated/_meta/commands.json b/packages/cli/src/commands/_generated/_meta/commands.json index 1c49cae6d3..090d2ad16d 100644 --- a/packages/cli/src/commands/_generated/_meta/commands.json +++ b/packages/cli/src/commands/_generated/_meta/commands.json @@ -831,6 +831,12 @@ "required": false, "description": "The data.zip_code field" }, + { + "name": "explanation", + "type": "string", + "required": false, + "description": "Optional explanation for a \"content_removed\" appeal, such as how the content was removed. Not accepted for other appeal types." + }, { "name": "type", "type": "string", @@ -13035,7 +13041,7 @@ "command": "cf ai-security custom-topics update", "name": "update", "fullPath": ["ai-security", "custom-topics", "update"], - "description": "Update the custom topic list of the zone, overwriting it entirely with the topics in the request, so include every topic you want to keep. Changes can take up to a minute to propagate. Each entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic` description, which the classifier scores prompts against while AI Security for Apps is enabled. The following rules apply: - A zone can hold at most 20 topics. - `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens. - `topic` must be 2–50 printable ASCII characters. - Labels must be unique within the zone, and so must topic descriptions.", + "description": "Update the custom topic list of the zone, overwriting it entirely with the topics in the request, so include every topic you want to keep. Changes can take up to a minute to propagate. Each entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic` description, which the classifier scores prompts against while AI Security for Apps is enabled. The following rules apply: - A zone can hold at most 20 topics. - `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens. - `topic` must be 2–50 UTF-8 bytes. Text in any language is supported, including spaces, numbers, punctuation, and symbols. Tabs, line breaks, invalid text, and invisible formatting characters are not allowed. - Labels must be unique within the zone, and so must topic descriptions.", "summary": "Update the AI Security for Apps custom topics of a zone.", "usage": "cf ai-security custom-topics update [options]", "arguments": [], @@ -19339,7 +19345,7 @@ "fullPath": ["basin-catalog", "enable"], "description": "Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files.", "summary": "Enable R2 bucket as a catalog", - "usage": "cf basin-catalog enable ", + "usage": "cf basin-catalog enable [options]", "arguments": [ { "name": "bucket-name", @@ -19350,16 +19356,28 @@ } ], "options": [ + { + "name": "credential-token", + "type": "string", + "required": false, + "description": "Provides the Cloudflare API token for accessing R2." + }, { "name": "dry-run", "type": "boolean", "required": false, "description": "Validate and show what would happen without executing", "default": false + }, + { + "name": "body", + "type": "string", + "required": false, + "description": "Raw JSON request body (bypasses individual flags)" } ], "category": "action", - "hasRequestBody": false, + "hasRequestBody": true, "httpMethod": "POST", "apiPath": "/accounts/{account_id}/basin-catalog/{bucket_name}/enable", "operationId": "basin-catalog.enable", @@ -35501,6 +35519,47 @@ "operationId": "cloudforce-one.threat-intel.indicators.bulk-create", "hideCommand": false }, + { + "command": "cf cloudforce-one threat-intel indicators bulk-delete", + "name": "bulk-delete", + "fullPath": [ + "cloudforce-one", + "threat-intel", + "indicators", + "bulk-delete" + ], + "description": "Deletes up to 200 indicators from a dataset. Pass the indicator UUIDs in `indicatorIds`; UUIDs that are not found are returned in `missingUUIDs`.", + "summary": "Delete indicators in bulk", + "usage": "cf cloudforce-one threat-intel indicators bulk-delete [options]", + "arguments": [], + "options": [ + { + "name": "dataset-id", + "type": "string", + "required": true, + "description": "Dataset ID." + }, + { + "name": "indicatorIds", + "type": "string", + "required": true, + "description": "Indicator UUIDs to delete, 1-200 per request." + }, + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + } + ], + "category": "action", + "hasRequestBody": false, + "httpMethod": "DELETE", + "apiPath": "/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators", + "operationId": "cloudforce-one.threat-intel.indicators.bulk-delete", + "hideCommand": false + }, { "command": "cf cloudforce-one threat-intel indicators create", "name": "create", @@ -37315,7 +37374,7 @@ "articles", "aggregate-relevance" ], - "description": "Beta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. All counts are read together and are exact.", + "description": "Beta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. read counts only read or only unread articles. All counts are read together and are exact.", "summary": "Count Threat Signals articles by relevance band", "usage": "cf cloudforce-one threat-signals articles aggregate-relevance [options]", "arguments": [], @@ -37332,6 +37391,12 @@ "required": false, "description": "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC." }, + { + "name": "read", + "type": "boolean", + "required": false, + "description": "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles." + }, { "name": "dry-run", "type": "boolean", @@ -37356,7 +37421,7 @@ "articles", "aggregate-severity" ], - "description": "Beta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the severity level nearest its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact.", + "description": "Beta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the one reported as its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. read counts only read or only unread articles, in both articles and priorities. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact.", "summary": "Count Threat Signals articles by severity band", "usage": "cf cloudforce-one threat-signals articles aggregate-severity [options]", "arguments": [], @@ -37373,6 +37438,12 @@ "required": false, "description": "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC." }, + { + "name": "read", + "type": "boolean", + "required": false, + "description": "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles." + }, { "name": "pir-id", "type": "string", @@ -44706,7 +44777,7 @@ "command": "cf dns settings account nameserver-sets create", "name": "create", "fullPath": ["dns", "settings", "account", "nameserver-sets", "create"], - "description": "Creates an immutable Custom Nameserver Set. To change a set, create a new one, move any zone assignments, and delete the old set.", + "description": "Creates a named Custom Nameserver Set. Only the customer-defined name can be changed later. To change nameservers or addresses, create a new set, move any zone assignments, and delete the old set.", "summary": "Create Custom Nameserver Set", "usage": "cf dns settings account nameserver-sets create [options]", "arguments": [], @@ -44725,6 +44796,12 @@ "description": "Selects the account-specific IP set that supplies the nameserver addresses. Nameserver sets with the same `ip_set` and `advanced` value may reuse addresses; otherwise, they use disjoint address groups.", "default": 1 }, + { + "name": "name", + "type": "string", + "required": true, + "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses." + }, { "name": "nameservers", "type": "string", @@ -44784,6 +44861,50 @@ "operationId": "dns.settings.account.nameserver-sets.delete", "hideCommand": false }, + { + "command": "cf dns settings account nameserver-sets edit", + "name": "edit", + "fullPath": ["dns", "settings", "account", "nameserver-sets", "edit"], + "description": "Renames a Custom Nameserver Set owned by the account. Only name may be supplied; immutable and unknown fields are rejected even if unchanged. An empty object or the existing name is a successful no-op. Requires the account-scoped creation entitlements for the existing set.", + "summary": "Update Custom Nameserver Set", + "usage": "cf dns settings account nameserver-sets edit [options]", + "arguments": [ + { + "name": "nameserver-set-id", + "position": 0, + "type": "string", + "required": true, + "description": "Identifier for a nameserver set." + } + ], + "options": [ + { + "name": "name", + "type": "string", + "required": false, + "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses." + }, + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + }, + { + "name": "body", + "type": "string", + "required": false, + "description": "Raw JSON request body (bypasses individual flags)" + } + ], + "category": "update", + "hasRequestBody": true, + "httpMethod": "PATCH", + "apiPath": "/accounts/{account_id}/dns_settings/nameserver_sets/{nameserver_set_id}", + "operationId": "dns.settings.account.nameserver-sets.edit", + "hideCommand": false + }, { "command": "cf dns settings account nameserver-sets get", "name": "get", @@ -52774,7 +52895,7 @@ "httpMethod": "DELETE", "apiPath": "/accounts/{account_id}/field_extractors/{extractor}", "operationId": "field-extractors.delete", - "hideCommand": true + "hideCommand": false }, { "command": "cf field-extractors get", @@ -52806,7 +52927,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/field_extractors/{extractor}", "operationId": "field-extractors.get", - "hideCommand": true + "hideCommand": false }, { "command": "cf field-extractors update", @@ -52850,7 +52971,7 @@ "httpMethod": "PUT", "apiPath": "/accounts/{account_id}/field_extractors/{extractor}", "operationId": "field-extractors.update", - "hideCommand": true + "hideCommand": false }, { "command": "cf firewall access-rules create", @@ -53402,6 +53523,90 @@ "operationId": "firewall.lockdowns.update", "hideCommand": false }, + { + "command": "cf firewall payload-logging delete", + "name": "delete", + "fullPath": ["firewall", "payload-logging", "delete"], + "description": "Deletes the payload logging public key of the account or zone.", + "summary": "Delete the payload logging key", + "usage": "cf firewall payload-logging delete", + "arguments": [], + "options": [ + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + } + ], + "category": "delete", + "hasRequestBody": false, + "httpMethod": "DELETE", + "apiPath": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "operationId": "firewall.payload-logging.delete", + "hideCommand": false + }, + { + "command": "cf firewall payload-logging get", + "name": "get", + "fullPath": ["firewall", "payload-logging", "get"], + "description": "Fetches the public key that payload logging uses to encrypt matched payloads for the account or zone.", + "summary": "Get the payload logging key", + "usage": "cf firewall payload-logging get", + "arguments": [], + "options": [ + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + } + ], + "category": "read", + "hasRequestBody": false, + "httpMethod": "GET", + "apiPath": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "operationId": "firewall.payload-logging.get", + "hideCommand": false + }, + { + "command": "cf firewall payload-logging update", + "name": "update", + "fullPath": ["firewall", "payload-logging", "update"], + "description": "Creates or replaces the public key that payload logging uses to encrypt matched payloads for the account or zone. It applies to every zone in the account or zone that has no zone key. Requires a plan that includes payload logging (Enterprise); otherwise it returns 403.", + "summary": "Set the payload logging key", + "usage": "cf firewall payload-logging update [options]", + "arguments": [], + "options": [ + { + "name": "public-key", + "type": "string", + "required": true, + "description": "Defines the X25519 public key, as standard base64 of exactly 32 bytes, that encrypts matched payloads. Cloudflare stores only the public key; keep the private key to decrypt logged payloads." + }, + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + }, + { + "name": "body", + "type": "string", + "required": false, + "description": "Raw JSON request body (bypasses individual flags)" + } + ], + "category": "update", + "hasRequestBody": true, + "httpMethod": "PUT", + "apiPath": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "operationId": "firewall.payload-logging.update", + "hideCommand": false + }, { "command": "cf firewall ua-rules create", "name": "create", @@ -63467,6 +63672,7 @@ "enum": [ "access_requests", "account_abuse_protection_events", + "ai_gateway_events", "audit_logs", "audit_logs_v2", "biso_user_actions", @@ -126470,7 +126676,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/responses/{response_id}", "operationId": "url-scanner.responses.get", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans bulk-create", @@ -126500,7 +126706,7 @@ "httpMethod": "POST", "apiPath": "/accounts/{account_id}/urlscanner/v2/bulk", "operationId": "url-scanner.scans.bulk-create", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans create", @@ -126523,199 +126729,144 @@ "required": false, "description": "Country to geo egress from", "enum": [ - "AF", + "AE", "AL", - "DZ", - "AD", + "AM", "AO", - "AG", "AR", - "AM", - "AU", "AT", + "AU", "AZ", - "BH", - "BD", "BB", - "BY", + "BD", "BE", - "BZ", - "BJ", - "BM", - "BT", + "BF", + "BG", + "BH", + "BN", "BO", - "BA", - "BW", "BR", - "BN", - "BG", - "BF", - "BI", - "KH", - "CM", + "BT", + "BW", + "BY", "CA", - "CV", - "KY", - "CF", - "TD", + "CD", + "CH", + "CI", "CL", - "CN", + "CM", "CO", - "KM", - "CG", "CR", - "CI", - "HR", - "CU", + "CW", "CY", "CZ", - "CD", - "DK", + "DE", "DJ", - "DM", + "DK", "DO", + "DZ", "EC", - "EG", - "SV", - "GQ", - "ER", "EE", - "SZ", + "EG", + "ES", "ET", - "FJ", "FI", + "FJ", "FR", - "GA", + "GB", + "GD", "GE", - "DE", "GH", "GR", - "GL", - "GD", "GT", - "GN", - "GW", + "GU", "GY", - "HT", + "HK", "HN", + "HR", + "HT", "HU", - "IS", - "IN", "ID", - "IR", - "IQ", "IE", "IL", + "IN", + "IQ", + "IS", "IT", "JM", - "JP", "JO", - "KZ", + "JP", "KE", - "KI", - "KW", "KG", + "KH", + "KR", + "KW", + "KZ", "LA", - "LV", "LB", - "LS", + "LK", "LR", - "LY", - "LI", "LT", "LU", - "MO", + "LV", + "MA", + "MD", "MG", - "MW", - "MY", - "MV", - "ML", - "MR", + "MK", + "MM", + "MN", + "MO", + "MT", "MU", + "MV", + "MW", "MX", - "FM", - "MD", - "MC", - "MN", - "MS", - "MA", + "MY", "MZ", - "MM", "NA", - "NR", - "NP", - "NL", - "NZ", - "NI", - "NE", + "NC", "NG", - "KP", - "MK", + "NL", "NO", + "NP", + "NZ", "OM", - "PK", - "PS", "PA", - "PG", - "PY", "PE", + "PF", "PH", + "PK", "PL", + "PR", + "PS", "PT", + "PY", "QA", + "RE", "RO", + "RS", "RU", "RW", - "SH", - "KN", - "LC", - "VC", - "WS", - "SM", - "ST", "SA", - "SN", - "RS", - "SC", - "SL", - "SK", + "SE", + "SG", "SI", - "SB", - "SO", - "ZA", - "KR", - "SS", - "ES", - "LK", - "SD", + "SK", + "SN", "SR", - "SE", - "CH", - "SY", - "TW", - "TJ", - "TZ", "TH", - "BS", - "GM", - "TL", - "TG", - "TO", - "TT", + "TJ", "TN", "TR", - "TM", - "UG", + "TT", + "TW", + "TZ", "UA", - "AE", - "GB", + "UG", "US", - "UY", "UZ", - "VU", - "VE", "VN", - "YE", + "ZA", "ZM", "ZW" ] @@ -126777,7 +126928,7 @@ "httpMethod": "POST", "apiPath": "/accounts/{account_id}/urlscanner/v2/scan", "operationId": "url-scanner.scans.create", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans dom", @@ -126809,7 +126960,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/dom/{scan_id}", "operationId": "url-scanner.scans.dom", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans get", @@ -126841,7 +126992,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/result/{scan_id}", "operationId": "url-scanner.scans.get", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans har", @@ -126873,7 +127024,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/har/{scan_id}", "operationId": "url-scanner.scans.har", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans list", @@ -126909,7 +127060,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/search", "operationId": "url-scanner.scans.list", - "hideCommand": true + "hideCommand": false }, { "command": "cf url-scanner scans screenshot", @@ -126948,7 +127099,7 @@ "httpMethod": "GET", "apiPath": "/accounts/{account_id}/urlscanner/v2/screenshots/{scan_id}.png", "operationId": "url-scanner.scans.screenshot", - "hideCommand": true + "hideCommand": false }, { "command": "cf user audit-logs list", @@ -140353,6 +140504,12 @@ "required": true, "description": "The name of the Access policy." }, + { + "name": "policy-resolution-account-id", + "type": "string", + "required": false, + "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy." + }, { "name": "require", "type": "string", @@ -140588,6 +140745,12 @@ "required": true, "description": "The name of the Access policy." }, + { + "name": "policy-resolution-account-id", + "type": "string", + "required": false, + "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy." + }, { "name": "require", "type": "string", @@ -161831,6 +161994,114 @@ "operationId": "zero-trust.organization.get", "hideCommand": false }, + { + "command": "cf zero-trust organization trust-settings get", + "name": "get", + "fullPath": ["zero-trust", "organization", "trust-settings", "get"], + "description": "Returns the trust settings for your Zero Trust organization.", + "summary": "Get Zero Trust organization trust settings", + "usage": "cf zero-trust organization trust-settings get", + "arguments": [], + "options": [ + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + } + ], + "category": "read", + "hasRequestBody": false, + "httpMethod": "GET", + "apiPath": "/accounts/{account_id}/access/organizations/trust_settings", + "operationId": "zero-trust.organization.trust-settings.get", + "hideCommand": false + }, + { + "command": "cf zero-trust organization trust-settings replace", + "name": "replace", + "fullPath": ["zero-trust", "organization", "trust-settings", "replace"], + "description": "Replaces the trust settings for your Zero Trust organization.", + "summary": "Replace Zero Trust organization trust settings", + "usage": "cf zero-trust organization trust-settings replace [options]", + "arguments": [], + "options": [ + { + "name": "grant-trust-to-all-accounts-in-org", + "type": "boolean", + "required": true, + "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources." + }, + { + "name": "trusting-accounts", + "type": "string", + "required": false, + "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty." + }, + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + }, + { + "name": "body", + "type": "string", + "required": false, + "description": "Raw JSON request body (bypasses individual flags)" + } + ], + "category": "action", + "hasRequestBody": true, + "httpMethod": "PUT", + "apiPath": "/accounts/{account_id}/access/organizations/trust_settings", + "operationId": "zero-trust.organization.trust-settings.replace", + "hideCommand": false + }, + { + "command": "cf zero-trust organization trust-settings update", + "name": "update", + "fullPath": ["zero-trust", "organization", "trust-settings", "update"], + "description": "Updates the trust settings for your Zero Trust organization.", + "summary": "Update Zero Trust organization trust settings", + "usage": "cf zero-trust organization trust-settings update [options]", + "arguments": [], + "options": [ + { + "name": "grant-trust-to-all-accounts-in-org", + "type": "boolean", + "required": false, + "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources." + }, + { + "name": "trusting-accounts", + "type": "string", + "required": false, + "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty." + }, + { + "name": "dry-run", + "type": "boolean", + "required": false, + "description": "Validate and show what would happen without executing", + "default": false + }, + { + "name": "body", + "type": "string", + "required": false, + "description": "Raw JSON request body (bypasses individual flags)" + } + ], + "category": "update", + "hasRequestBody": true, + "httpMethod": "PATCH", + "apiPath": "/accounts/{account_id}/access/organizations/trust_settings", + "operationId": "zero-trust.organization.trust-settings.update", + "hideCommand": false + }, { "command": "cf zero-trust organization update", "name": "update", @@ -164904,6 +165175,7 @@ "firewall": "Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages", "firewall access-rules": "IP-based access rules that allow, block, challenge, or whitelist traffic globally or per-zone", "firewall lockdowns": "Zone lockdown rules that restrict access to URLs by IP address or range", + "firewall payload-logging": "Account-level public key that WAF payload logging uses to encrypt matched payloads", "firewall ua-rules": "Block or challenge requests based on the User-Agent header string", "flagship": "flagship", "flagship apps": "Operations for apps", @@ -165686,6 +165958,7 @@ "zero-trust identity-providers scim users": "Operations for identity-providers.scim.users", "zero-trust organization": "Operations for organization", "zero-trust organization doh": "Operations for organization.doh", + "zero-trust organization trust-settings": "Operations for organization.trust-settings", "zero-trust risk-scoring": "User Risk Scoring - retrieve and reset user risk scores", "zero-trust risk-scoring behaviours": "User Risk Scoring - manage behaviors used to calculate user risk scores", "zero-trust risk-scoring integrations": "User Risk Scoring - manage integrations that provide risk score signals", diff --git a/packages/cli/src/commands/_generated/_meta/schemas.json b/packages/cli/src/commands/_generated/_meta/schemas.json index c0d29244ab..f6171579b9 100644 --- a/packages/cli/src/commands/_generated/_meta/schemas.json +++ b/packages/cli/src/commands/_generated/_meta/schemas.json @@ -664,6 +664,12 @@ "required": false, "description": "The data.zip_code field" }, + { + "name": "explanation", + "type": "string", + "required": false, + "description": "Optional explanation for a \"content_removed\" appeal, such as how the content was removed. Not accepted for other appeal types." + }, { "name": "type", "type": "string", @@ -13529,8 +13535,15 @@ } ], "queryParams": [], - "hasRequestBody": false, - "requestBodyFields": [] + "hasRequestBody": true, + "requestBodyFields": [ + { + "name": "credential-token", + "type": "string", + "required": false, + "description": "Provides the Cloudflare API token for accessing R2." + } + ] }, "basin-catalog get": { "operationId": "basin-catalog.get", @@ -25214,6 +25227,32 @@ } ] }, + "cloudforce-one threat-intel indicators bulk-delete": { + "operationId": "cloudforce-one.threat-intel.indicators.bulk-delete", + "httpMethod": "DELETE", + "path": "/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators", + "pathParams": [ + { + "name": "account_id", + "type": "string", + "required": true + }, + { + "name": "dataset_id", + "type": "string", + "required": true + } + ], + "queryParams": [ + { + "name": "indicatorIds", + "type": "array", + "required": true + } + ], + "hasRequestBody": false, + "requestBodyFields": [] + }, "cloudforce-one threat-intel indicators create": { "operationId": "cloudforce-one.threat-intel.indicators.create", "httpMethod": "POST", @@ -26490,6 +26529,11 @@ "name": "published_before", "type": "string", "required": false + }, + { + "name": "read", + "type": "boolean", + "required": false } ], "hasRequestBody": false, @@ -26517,6 +26561,11 @@ "type": "string", "required": false }, + { + "name": "read", + "type": "boolean", + "required": false + }, { "name": "pir_id", "type": "string", @@ -31332,6 +31381,12 @@ "required": false, "description": "Selects the account-specific IP set that supplies the nameserver addresses. Nameserver sets with the same `ip_set` and `advanced` value may reuse addresses; otherwise, they use disjoint address groups." }, + { + "name": "name", + "type": "string", + "required": true, + "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses." + }, { "name": "nameservers", "type": "string", @@ -31360,6 +31415,33 @@ "hasRequestBody": false, "requestBodyFields": [] }, + "dns settings account nameserver-sets edit": { + "operationId": "dns.settings.account.nameserver-sets.edit", + "httpMethod": "PATCH", + "path": "/accounts/{account_id}/dns_settings/nameserver_sets/{nameserver_set_id}", + "pathParams": [ + { + "name": "account_id", + "type": "string", + "required": true + }, + { + "name": "nameserver_set_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": true, + "requestBodyFields": [ + { + "name": "name", + "type": "string", + "required": false, + "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses." + } + ] + }, "dns settings account nameserver-sets get": { "operationId": "dns.settings.account.nameserver-sets.get", "httpMethod": "GET", @@ -37414,6 +37496,73 @@ } ] }, + "firewall payload-logging delete": { + "operationId": "firewall.payload-logging.delete", + "httpMethod": "DELETE", + "path": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "pathParams": [ + { + "name": "account_or_zone", + "type": "string", + "required": true + }, + { + "name": "account_or_zone_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": false, + "requestBodyFields": [] + }, + "firewall payload-logging get": { + "operationId": "firewall.payload-logging.get", + "httpMethod": "GET", + "path": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "pathParams": [ + { + "name": "account_or_zone", + "type": "string", + "required": true + }, + { + "name": "account_or_zone_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": false, + "requestBodyFields": [] + }, + "firewall payload-logging update": { + "operationId": "firewall.payload-logging.update", + "httpMethod": "PUT", + "path": "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key", + "pathParams": [ + { + "name": "account_or_zone", + "type": "string", + "required": true + }, + { + "name": "account_or_zone_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": true, + "requestBodyFields": [ + { + "name": "public-key", + "type": "string", + "required": true, + "description": "Defines the X25519 public key, as standard base64 of exactly 32 bytes, that encrypts matched payloads. Cloudflare stores only the public key; keep the private key to decrypt logged payloads." + } + ] + }, "firewall ua-rules create": { "operationId": "firewall.ua-rules.create", "httpMethod": "POST", @@ -97677,6 +97826,12 @@ "required": true, "description": "The name of the Access policy." }, + { + "name": "policy-resolution-account-id", + "type": "string", + "required": false, + "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy." + }, { "name": "require", "type": "string", @@ -97860,6 +98015,12 @@ "required": true, "description": "The name of the Access policy." }, + { + "name": "policy-resolution-account-id", + "type": "string", + "required": false, + "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy." + }, { "name": "require", "type": "string", @@ -113142,6 +113303,77 @@ "hasRequestBody": false, "requestBodyFields": [] }, + "zero-trust organization trust-settings get": { + "operationId": "zero-trust.organization.trust-settings.get", + "httpMethod": "GET", + "path": "/accounts/{account_id}/access/organizations/trust_settings", + "pathParams": [ + { + "name": "account_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": false, + "requestBodyFields": [] + }, + "zero-trust organization trust-settings replace": { + "operationId": "zero-trust.organization.trust-settings.replace", + "httpMethod": "PUT", + "path": "/accounts/{account_id}/access/organizations/trust_settings", + "pathParams": [ + { + "name": "account_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": true, + "requestBodyFields": [ + { + "name": "grant-trust-to-all-accounts-in-org", + "type": "boolean", + "required": true, + "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources." + }, + { + "name": "trusting-accounts", + "type": "string", + "required": false, + "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty." + } + ] + }, + "zero-trust organization trust-settings update": { + "operationId": "zero-trust.organization.trust-settings.update", + "httpMethod": "PATCH", + "path": "/accounts/{account_id}/access/organizations/trust_settings", + "pathParams": [ + { + "name": "account_id", + "type": "string", + "required": true + } + ], + "queryParams": [], + "hasRequestBody": true, + "requestBodyFields": [ + { + "name": "grant-trust-to-all-accounts-in-org", + "type": "boolean", + "required": false, + "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources." + }, + { + "name": "trusting-accounts", + "type": "string", + "required": false, + "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty." + } + ] + }, "zero-trust organization update": { "operationId": "zero-trust.organization.update", "httpMethod": "PUT", diff --git a/packages/cli/src/commands/_generated/_operations/basin-catalog/enable.ts b/packages/cli/src/commands/_generated/_operations/basin-catalog/enable.ts index 7644b36f95..725157847c 100644 --- a/packages/cli/src/commands/_generated/_operations/basin-catalog/enable.ts +++ b/packages/cli/src/commands/_generated/_operations/basin-catalog/enable.ts @@ -5,6 +5,7 @@ export default { method: "POST", path: (request: Record) => path`/accounts/${request.account_id}/basin-catalog/${request.bucket_name}/enable`, + body: "json", errors: { 400: "BadRequestError", 401: "UnauthorizedError", diff --git a/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-intel/indicators/bulk-delete.ts b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-intel/indicators/bulk-delete.ts new file mode 100644 index 0000000000..3b14afbb63 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-intel/indicators/bulk-delete.ts @@ -0,0 +1,13 @@ +/** @generated from cloudforce-one.threat-intel.indicators.bulk-delete */ +import { path } from "#api"; + +export default { + method: "DELETE", + path: (request: Record) => + path`/accounts/${request.account_id}/cloudforce-one/events/dataset/${request.dataset_id}/indicators`, + query: ["indicatorIds"], + errors: { + 400: "BadRequestError", + 404: "NotFoundError", + }, +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-relevance.ts b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-relevance.ts index d92857f803..96b931898a 100644 --- a/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-relevance.ts +++ b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-relevance.ts @@ -5,5 +5,5 @@ export default { method: "GET", path: (request: Record) => path`/accounts/${request.account_id}/cloudforce-one/v2/threat-signals/articles/relevance/aggregate`, - query: ["published_after", "published_before"], + query: ["published_after", "published_before", "read"], } as const; diff --git a/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-severity.ts b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-severity.ts index 37efab3393..1bfd7b3f0d 100644 --- a/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-severity.ts +++ b/packages/cli/src/commands/_generated/_operations/cloudforce-one/threat-signals/articles/aggregate-severity.ts @@ -5,5 +5,11 @@ export default { method: "GET", path: (request: Record) => path`/accounts/${request.account_id}/cloudforce-one/v2/threat-signals/articles/severity/aggregate`, - query: ["published_after", "published_before", "pir_id", "min_relevance"], + query: [ + "published_after", + "published_before", + "read", + "pir_id", + "min_relevance", + ], } as const; diff --git a/packages/cli/src/commands/_generated/_operations/dns/settings/account/nameserver-sets/edit.ts b/packages/cli/src/commands/_generated/_operations/dns/settings/account/nameserver-sets/edit.ts new file mode 100644 index 0000000000..c4bcdd2804 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/dns/settings/account/nameserver-sets/edit.ts @@ -0,0 +1,9 @@ +/** @generated from dns.settings.account.nameserver-sets.edit */ +import { path } from "#api"; + +export default { + method: "PATCH", + path: (request: Record) => + path`/accounts/${request.account_id}/dns_settings/nameserver_sets/${request.nameserver_set_id}`, + body: "json", +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/delete.ts b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/delete.ts new file mode 100644 index 0000000000..96d1afd30c --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/delete.ts @@ -0,0 +1,8 @@ +/** @generated from firewall.payload-logging.delete */ +import { path } from "#api"; + +export default { + method: "DELETE", + path: (request: Record) => + path`/${request.account_or_zone}/${request.account_or_zone_id}/firewall/payload_logging/key`, +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/get.ts b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/get.ts new file mode 100644 index 0000000000..a9127460d3 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/get.ts @@ -0,0 +1,8 @@ +/** @generated from firewall.payload-logging.get */ +import { path } from "#api"; + +export default { + method: "GET", + path: (request: Record) => + path`/${request.account_or_zone}/${request.account_or_zone_id}/firewall/payload_logging/key`, +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/update.ts b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/update.ts new file mode 100644 index 0000000000..6db556aba5 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/firewall/payload-logging/update.ts @@ -0,0 +1,9 @@ +/** @generated from firewall.payload-logging.update */ +import { path } from "#api"; + +export default { + method: "PUT", + path: (request: Record) => + path`/${request.account_or_zone}/${request.account_or_zone_id}/firewall/payload_logging/key`, + body: "json", +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/r2-data-catalog/enable.ts b/packages/cli/src/commands/_generated/_operations/r2-data-catalog/enable.ts index f381fed039..38b9764c23 100644 --- a/packages/cli/src/commands/_generated/_operations/r2-data-catalog/enable.ts +++ b/packages/cli/src/commands/_generated/_operations/r2-data-catalog/enable.ts @@ -5,6 +5,7 @@ export default { method: "POST", path: (request: Record) => path`/accounts/${request.account_id}/r2-catalog/${request.bucket_name}/enable`, + body: "json", errors: { 400: "BadRequestError", 401: "UnauthorizedError", diff --git a/packages/cli/src/commands/_generated/_operations/reporting/industry/get.ts b/packages/cli/src/commands/_generated/_operations/reporting/industry/get.ts index addfeaec30..e3251b82cf 100644 --- a/packages/cli/src/commands/_generated/_operations/reporting/industry/get.ts +++ b/packages/cli/src/commands/_generated/_operations/reporting/industry/get.ts @@ -5,4 +5,7 @@ export default { method: "GET", path: (request: Record) => path`/accounts/${request.account_id}/reporting/industry`, + errors: { + 400: "BadRequestError", + }, } as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/response/get.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/response/get.ts deleted file mode 100644 index 495ad180df..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/response/get.ts +++ /dev/null @@ -1,13 +0,0 @@ -/** @generated from url-scanner.response.get */ -import { path } from "#api"; - -export default { - method: "GET", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/response/${request.response_id}`, - response: "text", - errors: { - 400: "BadRequestError", - 404: "NotFoundError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/create.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/scan/create.ts deleted file mode 100644 index f03dc5825d..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/create.ts +++ /dev/null @@ -1,14 +0,0 @@ -/** @generated from url-scanner.scan.create */ -import { path } from "#api"; - -export default { - method: "POST", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/scan`, - body: "json", - errors: { - 400: "BadRequestError", - 409: "ConflictError", - 429: "TooManyRequestsError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scan.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scan.ts deleted file mode 100644 index 35be3825cd..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scan.ts +++ /dev/null @@ -1,13 +0,0 @@ -/** @generated from url-scanner.scan.get.urlscanner.scan */ -import { path } from "#api"; - -export default { - method: "GET", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/scan/${request.scan_id}`, - query: ["full"], - errors: { - 400: "BadRequestError", - 404: "NotFoundError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scans.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scans.ts deleted file mode 100644 index 32320933d3..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/get/urlscanner/scans.ts +++ /dev/null @@ -1,30 +0,0 @@ -/** @generated from url-scanner.scan.get.urlscanner.scans */ -import { path } from "#api"; - -export default { - method: "GET", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/scan`, - query: [ - "scan_id", - "limit", - "next_cursor", - "date_start", - "date_end", - "url", - "hostname", - "path", - "ip", - "hash", - "page_url", - "page_hostname", - "page_path", - "page_asn", - "page_ip", - "account_scans", - "is_malicious", - ], - errors: { - 400: "BadRequestError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/har/get.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/scan/har/get.ts deleted file mode 100644 index 3d702e4cad..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/har/get.ts +++ /dev/null @@ -1,12 +0,0 @@ -/** @generated from url-scanner.scan.har.get */ -import { path } from "#api"; - -export default { - method: "GET", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/scan/${request.scan_id}/har`, - errors: { - 400: "BadRequestError", - 404: "NotFoundError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/screenshot/get.ts b/packages/cli/src/commands/_generated/_operations/url-scanner/scan/screenshot/get.ts deleted file mode 100644 index 8903fcecf7..0000000000 --- a/packages/cli/src/commands/_generated/_operations/url-scanner/scan/screenshot/get.ts +++ /dev/null @@ -1,14 +0,0 @@ -/** @generated from url-scanner.scan.screenshot.get */ -import { path } from "#api"; - -export default { - method: "GET", - path: (request: Record) => - path`/accounts/${request.account_id}/urlscanner/scan/${request.scan_id}/screenshot`, - query: ["resolution"], - response: "binary-response", - errors: { - 400: "BadRequestError", - 404: "NotFoundError", - }, -} as const; diff --git a/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/get.ts b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/get.ts new file mode 100644 index 0000000000..d4252facb5 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/get.ts @@ -0,0 +1,8 @@ +/** @generated from zero-trust.organization.trust-settings.get */ +import { path } from "#api"; + +export default { + method: "GET", + path: (request: Record) => + path`/accounts/${request.account_id}/access/organizations/trust_settings`, +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/replace.ts b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/replace.ts new file mode 100644 index 0000000000..cef46418c7 --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/replace.ts @@ -0,0 +1,9 @@ +/** @generated from zero-trust.organization.trust-settings.replace */ +import { path } from "#api"; + +export default { + method: "PUT", + path: (request: Record) => + path`/accounts/${request.account_id}/access/organizations/trust_settings`, + body: "json", +} as const; diff --git a/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/update.ts b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/update.ts new file mode 100644 index 0000000000..308e9a7d7b --- /dev/null +++ b/packages/cli/src/commands/_generated/_operations/zero-trust/organization/trust-settings/update.ts @@ -0,0 +1,9 @@ +/** @generated from zero-trust.organization.trust-settings.update */ +import { path } from "#api"; + +export default { + method: "PATCH", + path: (request: Record) => + path`/accounts/${request.account_id}/access/organizations/trust_settings`, + body: "json", +} as const; diff --git a/packages/cli/src/commands/_generated/abuse-reports/mitigations/review.ts b/packages/cli/src/commands/_generated/abuse-reports/mitigations/review.ts index 8a627a1a11..8eb1d6a9b9 100644 --- a/packages/cli/src/commands/_generated/abuse-reports/mitigations/review.ts +++ b/packages/cli/src/commands/_generated/abuse-reports/mitigations/review.ts @@ -88,6 +88,11 @@ function builder(yargs: Argv) { type: "string", description: "The data.zip_code field", }) + .option("explanation", { + type: "string", + description: + 'Optional explanation for a "content_removed" appeal, such as how the content was removed. Not accepted for other appeal types.', + }) .option("type", { type: "string", description: "The type of appeal being submitted.", @@ -102,7 +107,7 @@ function builder(yargs: Argv) { .option("body", { type: "string", description: - 'Submit an appeal for a report. Provide either a list of mitigations to appeal, or an appeal type with its supporting details, but not both. When type is "counter_notice", the counter-notice details are required.', + 'Submit an appeal for a report. Provide either a list of mitigations to appeal, or an appeal type with its supporting details, but not both. When type is "counter_notice", the counter-notice details are required. A "content_removed" appeal takes an optional explanation instead and is accepted only while the report is in its Notice and Takedown notice period (\`has_pending_notice\` on the eligibility response). Reports that allow a single appeal (\`max_appeals\` of 1) never have a notice period and accept it whenever \`appealable\` is true.', }) .check((argv) => { const groupSet = [ @@ -242,6 +247,11 @@ const command: CommandModule = { "text" ), }, + explanation: resolveFileToken( + argv["explanation"] as string | undefined, + "explanation", + "text" + ), type: argv["type"], }), }); @@ -327,6 +337,11 @@ const command: CommandModule = { "text" ), }, + explanation: resolveFileToken( + argv["explanation"] as string | undefined, + "explanation", + "text" + ), type: argv["type"], }); const result = await withProgress(`Creating`, async () => diff --git a/packages/cli/src/commands/_generated/ai-security/custom-topics/update.ts b/packages/cli/src/commands/_generated/ai-security/custom-topics/update.ts index 66ce46dc49..ba430e9357 100644 --- a/packages/cli/src/commands/_generated/ai-security/custom-topics/update.ts +++ b/packages/cli/src/commands/_generated/ai-security/custom-topics/update.ts @@ -17,7 +17,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js"; function builder(yargs: Argv) { return yargs .usage( - "$0 ai-security custom-topics update\n\nUpdate the custom topic list of the zone, overwriting it entirely with the topics in the request, so include every topic you want to keep. Changes can take up to a minute to propagate. Each entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic` description, which the classifier scores prompts against while AI Security for Apps is enabled. The following rules apply: - A zone can hold at most 20 topics. - `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens. - `topic` must be 2–50 printable ASCII characters. - Labels must be unique within the zone, and so must topic descriptions." + "$0 ai-security custom-topics update\n\nUpdate the custom topic list of the zone, overwriting it entirely with the topics in the request, so include every topic you want to keep. Changes can take up to a minute to propagate. Each entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic` description, which the classifier scores prompts against while AI Security for Apps is enabled. The following rules apply: - A zone can hold at most 20 topics. - `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens. - `topic` must be 2–50 UTF-8 bytes. Text in any language is supported, including spaces, numbers, punctuation, and symbols. Tabs, line breaks, invalid text, and invisible formatting characters are not allowed. - Labels must be unique within the zone, and so must topic descriptions." ) .option("topics", { type: "string", diff --git a/packages/cli/src/commands/_generated/basin-catalog/credentials/create.ts b/packages/cli/src/commands/_generated/basin-catalog/credentials/create.ts index 47398c9e78..f16573dfee 100644 --- a/packages/cli/src/commands/_generated/basin-catalog/credentials/create.ts +++ b/packages/cli/src/commands/_generated/basin-catalog/credentials/create.ts @@ -79,6 +79,7 @@ const command: CommandModule = { "text" ), }), + sensitiveBodyPaths: [["token"]], }); return; } @@ -101,7 +102,8 @@ const command: CommandModule = { if (argv["token"] === undefined) { argv["token"] = await promptForRequiredField( "token", - "Provides the Cloudflare API token for accessing R2." + "Provides the Cloudflare API token for accessing R2.", + { kind: "secret" } ); } diff --git a/packages/cli/src/commands/_generated/basin-catalog/enable.ts b/packages/cli/src/commands/_generated/basin-catalog/enable.ts index cf43aaaa37..afd14ada73 100644 --- a/packages/cli/src/commands/_generated/basin-catalog/enable.ts +++ b/packages/cli/src/commands/_generated/basin-catalog/enable.ts @@ -11,7 +11,9 @@ import { getAccountId, resolveAccountIdSilent, } from "#lib/auth.js"; +import { compactBody, parseBody } from "#lib/body-parser.js"; import { formatDryRun } from "#lib/dry-run.js"; +import { resolveFileToken } from "#lib/input-validation.js"; import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; import { formatOutput } from "#lib/output.js"; import { withProgress } from "#lib/progress.js"; @@ -27,10 +29,33 @@ function builder(yargs: Argv) { description: "Specifies the R2 bucket name to enable as catalog.", demandOption: true, }) + .option("credential-token", { + type: "string", + description: "Provides the Cloudflare API token for accessing R2.", + }) .option("dry-run", { type: "boolean", description: "Validate and show what would happen without executing", default: false, + }) + .option("body", { + type: "string", + description: + "Contains the optional request to enable a catalog. Send an empty body to keep the defaults. If you include \`credential\`, the service checks that the token can access the bucket, then stores it as the catalog's maintenance credential, like the store credentials operation. ", + }) + .check((argv) => { + const groupSet = ["credential-token"].some((k) => argv[k] !== undefined); + if (groupSet) { + const missing = ["credential-token"].filter( + (k) => argv[k] === undefined + ); + if (missing.length > 0) { + throw new Error( + `${missing.map((m) => "--" + m).join(", ")} ${missing.length === 1 ? "is" : "are"} required when any --credential-* flag is set` + ); + } + } + return true; }); } @@ -57,7 +82,20 @@ const command: CommandModule = { method: "POST", url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/basin-catalog/${argv["bucket-name"] == null ? "" : encodeURIComponent(String(argv["bucket-name"]))}/enable`, pathParams: { "bucket-name": String(argv["bucket-name"] ?? "") }, - bodyKind: "none", + bodyKind: "json", + body: + argv.body !== undefined + ? parseBody(argv.body) + : compactBody({ + credential: { + token: resolveFileToken( + argv["credential-token"] as string | undefined, + "credential-token", + "text" + ), + }, + }), + sensitiveBodyPaths: [["credential", "token"]], }); return; } @@ -65,8 +103,32 @@ const command: CommandModule = { const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); argv.accountId = accountId; + if (argv.body) { + const bodyData = parseBody(argv.body); + const result = await withProgress(`Creating`, async () => + client.send(operation, { + body: bodyData, + account_id: accountId, + bucket_name: argv["bucket-name"], + }) + ); + formatOutput(result, { successLabel: `Created` }); + return; + } + + // Assemble request body from individual flags + const bodyData = compactBody({ + credential: { + token: resolveFileToken( + argv["credential-token"] as string | undefined, + "credential-token", + "text" + ), + }, + }); const result = await withProgress(`Creating`, async () => client.send(operation, { + body: bodyData, account_id: accountId, bucket_name: argv["bucket-name"], }) diff --git a/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/bulk-delete.ts b/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/bulk-delete.ts new file mode 100644 index 0000000000..05228cff1e --- /dev/null +++ b/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/bulk-delete.ts @@ -0,0 +1,102 @@ +import operation from "../../../_operations/cloudforce-one/threat-intel/indicators/bulk-delete.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * bulk-delete command + * @generated from apis/overlays/cloudforce-one.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { confirmDelete } from "#lib/prompt.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 cloudforce-one threat-intel indicators bulk-delete\n\nDeletes up to 200 indicators from a dataset. Pass the indicator UUIDs in `indicatorIds`; UUIDs that are not found are returned in `missingUUIDs`." + ) + .option("dataset-id", { + type: "string", + description: "Dataset ID.", + demandOption: true, + }) + .option("indicator-ids", { + type: "string", + array: true, + description: "Indicator UUIDs to delete, 1-200 per request.", + demandOption: true, + }) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("force", { + type: "boolean", + alias: "f", + description: "Skip confirmation (useful in scripts and CI)", + default: false, + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "bulk-delete", + describe: "Delete indicators in bulk", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "cloudforce-one threat-intel indicators bulk-delete", + classification: { + safeFlags: ["dry-run", "force"], + shortFlagAliases: { f: { canonical: "force", type: "boolean" } }, + } satisfies ArgClassification, + }, + argv as Record, + async () => { + const queryParams: Record = { + indicatorIds: argv["indicator-ids"], + }; + if (argv.dryRun) { + const __cfDryRunAccountId = await resolveAccountIdSilent(); + formatDryRun({ + command: "cf cloudforce-one threat-intel indicators bulk-delete", + method: "DELETE", + url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/cloudforce-one/events/dataset/${argv["dataset-id"] == null ? "" : encodeURIComponent(String(argv["dataset-id"]))}/indicators`, + pathParams: { "dataset-id": String(argv["dataset-id"] ?? "") }, + query: queryParams, + bodyKind: "none", + }); + return; + } + const client = await createCommandClient(argv); + const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); + argv.accountId = accountId; + + if (!(await confirmDelete({ force: Boolean(argv.force) }))) { + return; + } + + const result = await withProgress(`Deleting`, async () => + client.send(operation, { + account_id: accountId, + dataset_id: argv["dataset-id"], + ...queryParams, + }) + ); + formatOutput(result, { successLabel: `Deleted` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/index.ts b/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/index.ts index 8be3ac3d7f..9b8d75b0df 100644 --- a/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/index.ts +++ b/packages/cli/src/commands/_generated/cloudforce-one/threat-intel/indicators/index.ts @@ -1,4 +1,5 @@ import $bulkcreate from "./bulk-create.js"; +import $bulkdelete from "./bulk-delete.js"; import $create from "./create.js"; import $delete from "./delete.js"; import $get from "./get.js"; @@ -21,6 +22,7 @@ const command: CommandModule = { builder: (yargs) => { return yargs .command($bulkcreate) + .command($bulkdelete) .command($create) .command($delete) .command($get) diff --git a/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-relevance.ts b/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-relevance.ts index 0394cf6c2f..8ba9ebea72 100644 --- a/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-relevance.ts +++ b/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-relevance.ts @@ -20,7 +20,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js"; function builder(yargs: Argv) { return yargs .usage( - "$0 cloudforce-one threat-signals articles aggregate-relevance\n\nBeta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. All counts are read together and are exact." + "$0 cloudforce-one threat-signals articles aggregate-relevance\n\nBeta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. read counts only read or only unread articles. All counts are read together and are exact." ) .option("published-after", { type: "string", @@ -32,6 +32,11 @@ function builder(yargs: Argv) { description: "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC.", }) + .option("read", { + type: "boolean", + description: + "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles.", + }) .option("dry-run", { type: "boolean", description: "Validate and show what would happen without executing", @@ -50,7 +55,7 @@ const command: CommandModule = { { command: "cloudforce-one threat-signals articles aggregate-relevance", classification: { - safeFlags: ["dry-run"], + safeFlags: ["read", "dry-run"], } satisfies ArgClassification, }, argv as Record, @@ -58,6 +63,7 @@ const command: CommandModule = { const queryParams: Record = { published_after: argv["published-after"], published_before: argv["published-before"], + read: argv["read"], }; if (argv.dryRun) { const __cfDryRunAccountId = await resolveAccountIdSilent(); diff --git a/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-severity.ts b/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-severity.ts index 6a6add4fd0..b28323ecda 100644 --- a/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-severity.ts +++ b/packages/cli/src/commands/_generated/cloudforce-one/threat-signals/articles/aggregate-severity.ts @@ -20,7 +20,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js"; function builder(yargs: Argv) { return yargs .usage( - "$0 cloudforce-one threat-signals articles aggregate-severity\n\nBeta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the severity level nearest its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact." + "$0 cloudforce-one threat-signals articles aggregate-severity\n\nBeta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the one reported as its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. read counts only read or only unread articles, in both articles and priorities. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact." ) .option("published-after", { type: "string", @@ -32,6 +32,11 @@ function builder(yargs: Argv) { description: "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC.", }) + .option("read", { + type: "boolean", + description: + "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles.", + }) .option("pir-id", { type: "string", description: @@ -61,7 +66,7 @@ const command: CommandModule = { { command: "cloudforce-one threat-signals articles aggregate-severity", classification: { - safeFlags: ["min-relevance", "dry-run"], + safeFlags: ["read", "min-relevance", "dry-run"], } satisfies ArgClassification, }, argv as Record, @@ -69,6 +74,7 @@ const command: CommandModule = { const queryParams: Record = { published_after: argv["published-after"], published_before: argv["published-before"], + read: argv["read"], pir_id: argv["pir-id"], min_relevance: argv["min-relevance"], }; diff --git a/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/create.ts b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/create.ts index 83f2373bc9..d28f7f25d6 100644 --- a/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/create.ts +++ b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/create.ts @@ -13,15 +13,17 @@ import { } from "#lib/auth.js"; import { compactBody, parseBody, parseObjectArray } from "#lib/body-parser.js"; import { formatDryRun } from "#lib/dry-run.js"; +import { resolveFileToken } from "#lib/input-validation.js"; import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; import { formatOutput } from "#lib/output.js"; import { withProgress } from "#lib/progress.js"; +import { promptForRequiredField } from "#lib/prompt.js"; import { runWithTelemetry } from "#lib/telemetry/index.js"; function builder(yargs: Argv) { return yargs .usage( - "$0 dns settings account nameserver-sets create\n\nCreates an immutable Custom Nameserver Set. To change a set, create a new one, move any zone assignments, and delete the old set." + "$0 dns settings account nameserver-sets create\n\nCreates a named Custom Nameserver Set. Only the customer-defined name can be changed later. To change nameservers or addresses, create a new set, move any zone assignments, and delete the old set." ) .option("advanced", { type: "boolean", @@ -35,6 +37,11 @@ function builder(yargs: Argv) { "Selects the account-specific IP set that supplies the nameserver addresses. Nameserver sets with the same `ip_set` and `advanced` value may reuse addresses; otherwise, they use disjoint address groups.", default: 1, }) + .option("name", { + type: "string", + description: + "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses.", + }) .option("nameservers", { type: "string", description: @@ -81,6 +88,11 @@ const command: CommandModule = { : compactBody({ advanced: argv["advanced"], ip_set: argv["ip-set"], + name: resolveFileToken( + argv["name"] as string | undefined, + "name", + "text" + ), nameservers: parseObjectArray( argv["nameservers"], "nameservers" @@ -101,6 +113,12 @@ const command: CommandModule = { formatOutput(result, { successLabel: `Created` }); return; } + if (argv["name"] === undefined) { + argv["name"] = await promptForRequiredField( + "name", + "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses." + ); + } if (argv["nameservers"] === undefined) { throw new Error( "--nameservers is required (or pass --body with this field set)." @@ -111,6 +129,11 @@ const command: CommandModule = { const bodyData = compactBody({ advanced: argv["advanced"], ip_set: argv["ip-set"], + name: resolveFileToken( + argv["name"] as string | undefined, + "name", + "text" + ), nameservers: parseObjectArray(argv["nameservers"], "nameservers"), }); const result = await withProgress(`Creating`, async () => diff --git a/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/edit.ts b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/edit.ts new file mode 100644 index 0000000000..48ecca6a00 --- /dev/null +++ b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/edit.ts @@ -0,0 +1,125 @@ +import operation from "../../../../_operations/dns/settings/account/nameserver-sets/edit.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * edit command + * @generated from apis/overlays/dns.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { compactBody, parseBody } from "#lib/body-parser.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { resolveFileToken } from "#lib/input-validation.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 dns settings account nameserver-sets edit \n\nRenames a Custom Nameserver Set owned by the account. Only name may be supplied; immutable and unknown fields are rejected even if unchanged. An empty object or the existing name is a successful no-op. Requires the account-scoped creation entitlements for the existing set." + ) + .positional("nameserver-set-id", { + type: "string", + description: "Identifier for a nameserver set.", + demandOption: true, + }) + .option("name", { + type: "string", + description: + "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses.", + }) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("body", { + type: "string", + description: + "Updates only the customer-defined name. All other fields are rejected, even if unchanged. An empty object or the current name succeeds without changing the set. A null name is invalid. Requires the account-scoped creation entitlements, including eligibility for the set's current IP set and the Advanced entitlement for an Advanced set.", + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "edit ", + describe: "Update Custom Nameserver Set", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "dns settings account nameserver-sets edit", + classification: { + safeFlags: ["dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = await resolveAccountIdSilent(); + formatDryRun({ + command: "cf dns settings account nameserver-sets edit", + method: "PATCH", + url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/dns_settings/nameserver_sets/${argv["nameserver-set-id"] == null ? "" : encodeURIComponent(String(argv["nameserver-set-id"]))}`, + pathParams: { + "nameserver-set-id": String(argv["nameserver-set-id"] ?? ""), + }, + bodyKind: "json", + body: + argv.body !== undefined + ? parseBody(argv.body) + : compactBody({ + name: resolveFileToken( + argv["name"] as string | undefined, + "name", + "text" + ), + }), + }); + return; + } + const client = await createCommandClient(argv); + const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); + argv.accountId = accountId; + + if (argv.body) { + const bodyData = parseBody(argv.body); + const result = await withProgress(`Updating`, async () => + client.send(operation, { + body: bodyData, + account_id: accountId, + nameserver_set_id: argv["nameserver-set-id"], + }) + ); + formatOutput(result, { successLabel: `Updated` }); + return; + } + + // Assemble request body from individual flags + const bodyData = compactBody({ + name: resolveFileToken( + argv["name"] as string | undefined, + "name", + "text" + ), + }); + const result = await withProgress(`Updating`, async () => + client.send(operation, { + body: bodyData, + account_id: accountId, + nameserver_set_id: argv["nameserver-set-id"], + }) + ); + formatOutput(result, { successLabel: `Updated` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/index.ts b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/index.ts index a0a720e749..80797fe923 100644 --- a/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/index.ts +++ b/packages/cli/src/commands/_generated/dns/settings/account/nameserver-sets/index.ts @@ -1,5 +1,6 @@ import $create from "./create.js"; import $delete from "./delete.js"; +import $edit from "./edit.js"; import $get from "./get.js"; import $list from "./list.js"; import type { CommonYargsOptions } from "#lib/cli-types.js"; @@ -17,6 +18,7 @@ const command: CommandModule = { return yargs .command($create) .command($delete) + .command($edit) .command($get) .command($list) .demandCommand(1, "Please specify a subcommand"); diff --git a/packages/cli/src/commands/_generated/firewall/index.ts b/packages/cli/src/commands/_generated/firewall/index.ts index c473d45856..8b1dc5bf62 100644 --- a/packages/cli/src/commands/_generated/firewall/index.ts +++ b/packages/cli/src/commands/_generated/firewall/index.ts @@ -1,5 +1,6 @@ import $accessrules from "./access-rules/index.js"; import $lockdowns from "./lockdowns/index.js"; +import $payloadlogging from "./payload-logging/index.js"; import $uarules from "./ua-rules/index.js"; import type { CommonYargsOptions } from "#lib/cli-types.js"; /** @@ -17,6 +18,7 @@ const command: CommandModule = { return yargs .command($accessrules) .command($lockdowns) + .command($payloadlogging) .command($uarules) .demandCommand(1, "Please specify a subcommand"); }, diff --git a/packages/cli/src/commands/_generated/firewall/payload-logging/delete.ts b/packages/cli/src/commands/_generated/firewall/payload-logging/delete.ts new file mode 100644 index 0000000000..e1f963b640 --- /dev/null +++ b/packages/cli/src/commands/_generated/firewall/payload-logging/delete.ts @@ -0,0 +1,108 @@ +import operation from "../../_operations/firewall/payload-logging/delete.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * delete command + * @generated from apis/overlays/firewall.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + getZoneId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { confirmDelete } from "#lib/prompt.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 firewall payload-logging delete\n\nDeletes the payload logging public key of the account or zone." + ) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("force", { + type: "boolean", + alias: "f", + description: "Skip confirmation (useful in scripts and CI)", + default: false, + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "delete", + describe: "Delete the payload logging key", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "firewall payload-logging delete", + classification: { + safeFlags: ["dry-run", "force"], + shortFlagAliases: { f: { canonical: "force", type: "boolean" } }, + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = + argv.zone === undefined + ? await resolveAccountIdSilent() + : undefined; + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + argv.zone ?? __cfDryRunAccountId ?? ""; + formatDryRun({ + command: "cf firewall payload-logging delete", + method: "DELETE", + url: `https://api.cloudflare.com/client/v4/${accountOrZone}/${accountOrZoneId}/firewall/payload_logging/key`, + pathParams: { + "account-or-zone": String(accountOrZone), + "account-or-zone-id": String(accountOrZoneId), + }, + bodyKind: "none", + }); + return; + } + const client = await createCommandClient(argv); + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + accountOrZone === "zones" + ? await getZoneId({ zone: argv.zone }, client, { + quiet: argv.quiet, + }) + : argv.local + ? LOCAL_ACCOUNT_ID + : await getAccountId(); + if (accountOrZone === "zones") { + argv.zoneId = accountOrZoneId; + } else { + argv.accountId = accountOrZoneId; + } + + if (!(await confirmDelete({ force: Boolean(argv.force) }))) { + return; + } + + const result = await withProgress(`Deleting`, async () => + client.send(operation, { + account_or_zone: accountOrZone, + account_or_zone_id: accountOrZoneId, + }) + ); + formatOutput(result, { successLabel: `Deleted` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/firewall/payload-logging/get.ts b/packages/cli/src/commands/_generated/firewall/payload-logging/get.ts new file mode 100644 index 0000000000..8f714d47dc --- /dev/null +++ b/packages/cli/src/commands/_generated/firewall/payload-logging/get.ts @@ -0,0 +1,96 @@ +import operation from "../../_operations/firewall/payload-logging/get.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * get command + * @generated from apis/overlays/firewall.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + getZoneId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 firewall payload-logging get\n\nFetches the public key that payload logging uses to encrypt matched payloads for the account or zone." + ) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "get", + describe: "Get the payload logging key", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "firewall payload-logging get", + classification: { + safeFlags: ["dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = + argv.zone === undefined + ? await resolveAccountIdSilent() + : undefined; + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + argv.zone ?? __cfDryRunAccountId ?? ""; + formatDryRun({ + command: "cf firewall payload-logging get", + method: "GET", + url: `https://api.cloudflare.com/client/v4/${accountOrZone}/${accountOrZoneId}/firewall/payload_logging/key`, + pathParams: { + "account-or-zone": String(accountOrZone), + "account-or-zone-id": String(accountOrZoneId), + }, + bodyKind: "none", + }); + return; + } + const client = await createCommandClient(argv); + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + accountOrZone === "zones" + ? await getZoneId({ zone: argv.zone }, client, { + quiet: argv.quiet, + }) + : argv.local + ? LOCAL_ACCOUNT_ID + : await getAccountId(); + if (accountOrZone === "zones") { + argv.zoneId = accountOrZoneId; + } else { + argv.accountId = accountOrZoneId; + } + + const result = await withProgress(`Loading`, async () => + client.send(operation, { + account_or_zone: accountOrZone, + account_or_zone_id: accountOrZoneId, + }) + ); + formatOutput(result, { successLabel: `Loaded` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/firewall/payload-logging/index.ts b/packages/cli/src/commands/_generated/firewall/payload-logging/index.ts new file mode 100644 index 0000000000..cecbd55248 --- /dev/null +++ b/packages/cli/src/commands/_generated/firewall/payload-logging/index.ts @@ -0,0 +1,27 @@ +import $delete from "./delete.js"; +import $get from "./get.js"; +import $update from "./update.js"; +import type { CommonYargsOptions } from "#lib/cli-types.js"; +/** + * payload-logging command group + * @generated from apis/overlays/firewall.ts + */ +import type { CommandModule } from "yargs"; + +const command: CommandModule = { + command: "payload-logging", + describe: + "Account-level public key that WAF payload logging uses to encrypt matched payloads", + + builder: (yargs) => { + return yargs + .command($delete) + .command($get) + .command($update) + .demandCommand(1, "Please specify a subcommand"); + }, + + handler: () => {}, +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/firewall/payload-logging/update.ts b/packages/cli/src/commands/_generated/firewall/payload-logging/update.ts new file mode 100644 index 0000000000..aae09059b8 --- /dev/null +++ b/packages/cli/src/commands/_generated/firewall/payload-logging/update.ts @@ -0,0 +1,146 @@ +import operation from "../../_operations/firewall/payload-logging/update.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * update command + * @generated from apis/overlays/firewall.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + getZoneId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { compactBody, parseBody } from "#lib/body-parser.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { resolveFileToken } from "#lib/input-validation.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { promptForRequiredField } from "#lib/prompt.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 firewall payload-logging update\n\nCreates or replaces the public key that payload logging uses to encrypt matched payloads for the account or zone. It applies to every zone in the account or zone that has no zone key. Requires a plan that includes payload logging (Enterprise); otherwise it returns 403." + ) + .option("public-key", { + type: "string", + description: + "Defines the X25519 public key, as standard base64 of exactly 32 bytes, that encrypts matched payloads. Cloudflare stores only the public key; keep the private key to decrypt logged payloads.", + }) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("body", { + type: "string", + description: "Raw JSON request body (bypasses individual flags)", + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "update", + describe: "Set the payload logging key", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "firewall payload-logging update", + classification: { + safeFlags: ["dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = + argv.zone === undefined + ? await resolveAccountIdSilent() + : undefined; + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + argv.zone ?? __cfDryRunAccountId ?? ""; + formatDryRun({ + command: "cf firewall payload-logging update", + method: "PUT", + url: `https://api.cloudflare.com/client/v4/${accountOrZone}/${accountOrZoneId}/firewall/payload_logging/key`, + pathParams: { + "account-or-zone": String(accountOrZone), + "account-or-zone-id": String(accountOrZoneId), + }, + bodyKind: "json", + body: + argv.body !== undefined + ? parseBody(argv.body) + : compactBody({ + public_key: resolveFileToken( + argv["public-key"] as string | undefined, + "public-key", + "text" + ), + }), + }); + return; + } + const client = await createCommandClient(argv); + const accountOrZone = argv.zone === undefined ? "accounts" : "zones"; + const accountOrZoneId = + accountOrZone === "zones" + ? await getZoneId({ zone: argv.zone }, client, { + quiet: argv.quiet, + }) + : argv.local + ? LOCAL_ACCOUNT_ID + : await getAccountId(); + if (accountOrZone === "zones") { + argv.zoneId = accountOrZoneId; + } else { + argv.accountId = accountOrZoneId; + } + + if (argv.body) { + const bodyData = parseBody(argv.body); + const result = await withProgress(`Updating`, async () => + client.send(operation, { + body: bodyData, + account_or_zone: accountOrZone, + account_or_zone_id: accountOrZoneId, + }) + ); + formatOutput(result, { successLabel: `Updated` }); + return; + } + if (argv["public-key"] === undefined) { + argv["public-key"] = await promptForRequiredField( + "public-key", + "Defines the X25519 public key, as standard base64 of exactly 32 bytes, that encrypts matched payloads. Cloudflare stores only the public key; keep the private key to decrypt logged payloads." + ); + } + + // Assemble request body from individual flags + const bodyData = compactBody({ + public_key: resolveFileToken( + argv["public-key"] as string | undefined, + "public-key", + "text" + ), + }); + const result = await withProgress(`Updating`, async () => + client.send(operation, { + body: bodyData, + account_or_zone: accountOrZone, + account_or_zone_id: accountOrZoneId, + }) + ); + formatOutput(result, { successLabel: `Updated` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/index.ts b/packages/cli/src/commands/_generated/index.ts index f60fd8ac7c..d4602e5776 100644 --- a/packages/cli/src/commands/_generated/index.ts +++ b/packages/cli/src/commands/_generated/index.ts @@ -487,7 +487,7 @@ export const generatedCommands: GeneratedCommand[] = [ () => import("./field-extractors/index.js"), null ), - hideCommand: true, + hideCommand: false, }, { command: lazyCommand( @@ -1144,7 +1144,7 @@ export const generatedCommands: GeneratedCommand[] = [ () => import("./url-scanner/index.js"), null ), - hideCommand: true, + hideCommand: false, }, { command: lazyCommand( diff --git a/packages/cli/src/commands/_generated/logpush/account-jobs/create.ts b/packages/cli/src/commands/_generated/logpush/account-jobs/create.ts index 9a77b7fa39..85dde0a8a0 100644 --- a/packages/cli/src/commands/_generated/logpush/account-jobs/create.ts +++ b/packages/cli/src/commands/_generated/logpush/account-jobs/create.ts @@ -33,6 +33,7 @@ function builder(yargs: Argv) { choices: [ "access_requests", "account_abuse_protection_events", + "ai_gateway_events", "audit_logs", "audit_logs_v2", "biso_user_actions", diff --git a/packages/cli/src/commands/_generated/url-scanner/scans/create.ts b/packages/cli/src/commands/_generated/url-scanner/scans/create.ts index aeb756f156..4192a617b7 100644 --- a/packages/cli/src/commands/_generated/url-scanner/scans/create.ts +++ b/packages/cli/src/commands/_generated/url-scanner/scans/create.ts @@ -33,199 +33,144 @@ function builder(yargs: Argv) { type: "string", description: "Country to geo egress from", choices: [ - "AF", + "AE", "AL", - "DZ", - "AD", + "AM", "AO", - "AG", "AR", - "AM", - "AU", "AT", + "AU", "AZ", - "BH", - "BD", "BB", - "BY", + "BD", "BE", - "BZ", - "BJ", - "BM", - "BT", + "BF", + "BG", + "BH", + "BN", "BO", - "BA", - "BW", "BR", - "BN", - "BG", - "BF", - "BI", - "KH", - "CM", + "BT", + "BW", + "BY", "CA", - "CV", - "KY", - "CF", - "TD", + "CD", + "CH", + "CI", "CL", - "CN", + "CM", "CO", - "KM", - "CG", "CR", - "CI", - "HR", - "CU", + "CW", "CY", "CZ", - "CD", - "DK", + "DE", "DJ", - "DM", + "DK", "DO", + "DZ", "EC", - "EG", - "SV", - "GQ", - "ER", "EE", - "SZ", + "EG", + "ES", "ET", - "FJ", "FI", + "FJ", "FR", - "GA", + "GB", + "GD", "GE", - "DE", "GH", "GR", - "GL", - "GD", "GT", - "GN", - "GW", + "GU", "GY", - "HT", + "HK", "HN", + "HR", + "HT", "HU", - "IS", - "IN", "ID", - "IR", - "IQ", "IE", "IL", + "IN", + "IQ", + "IS", "IT", "JM", - "JP", "JO", - "KZ", + "JP", "KE", - "KI", - "KW", "KG", + "KH", + "KR", + "KW", + "KZ", "LA", - "LV", "LB", - "LS", + "LK", "LR", - "LY", - "LI", "LT", "LU", - "MO", + "LV", + "MA", + "MD", "MG", - "MW", - "MY", - "MV", - "ML", - "MR", + "MK", + "MM", + "MN", + "MO", + "MT", "MU", + "MV", + "MW", "MX", - "FM", - "MD", - "MC", - "MN", - "MS", - "MA", + "MY", "MZ", - "MM", "NA", - "NR", - "NP", - "NL", - "NZ", - "NI", - "NE", + "NC", "NG", - "KP", - "MK", + "NL", "NO", + "NP", + "NZ", "OM", - "PK", - "PS", "PA", - "PG", - "PY", "PE", + "PF", "PH", + "PK", "PL", + "PR", + "PS", "PT", + "PY", "QA", + "RE", "RO", + "RS", "RU", "RW", - "SH", - "KN", - "LC", - "VC", - "WS", - "SM", - "ST", "SA", - "SN", - "RS", - "SC", - "SL", - "SK", + "SE", + "SG", "SI", - "SB", - "SO", - "ZA", - "KR", - "SS", - "ES", - "LK", - "SD", + "SK", + "SN", "SR", - "SE", - "CH", - "SY", - "TW", - "TJ", - "TZ", "TH", - "BS", - "GM", - "TL", - "TG", - "TO", - "TT", + "TJ", "TN", "TR", - "TM", - "UG", + "TT", + "TW", + "TZ", "UA", - "AE", - "GB", + "UG", "US", - "UY", "UZ", - "VU", - "VE", "VN", - "YE", + "ZA", "ZM", "ZW", ], diff --git a/packages/cli/src/commands/_generated/zero-trust/access/policies/create.ts b/packages/cli/src/commands/_generated/zero-trust/access/policies/create.ts index 63e556adf3..ccc7656ff6 100644 --- a/packages/cli/src/commands/_generated/zero-trust/access/policies/create.ts +++ b/packages/cli/src/commands/_generated/zero-trust/access/policies/create.ts @@ -106,6 +106,11 @@ function builder(yargs: Argv) { type: "string", description: "The name of the Access policy.", }) + .option("policy-resolution-account-id", { + type: "string", + description: + "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy.", + }) .option("require", { type: "string", description: @@ -209,6 +214,13 @@ const command: CommandModule = { "name", "text" ), + policy_resolution_account_id: resolveFileToken( + argv["policy-resolution-account-id"] as + | string + | undefined, + "policy-resolution-account-id", + "text" + ), require: parseObjectArray(argv["require"], "require"), }), }); @@ -294,6 +306,11 @@ const command: CommandModule = { "name", "text" ), + policy_resolution_account_id: resolveFileToken( + argv["policy-resolution-account-id"] as string | undefined, + "policy-resolution-account-id", + "text" + ), require: parseObjectArray(argv["require"], "require"), }); const result = await withProgress(`Creating`, async () => diff --git a/packages/cli/src/commands/_generated/zero-trust/access/policies/update.ts b/packages/cli/src/commands/_generated/zero-trust/access/policies/update.ts index d494251cf6..e9dd696620 100644 --- a/packages/cli/src/commands/_generated/zero-trust/access/policies/update.ts +++ b/packages/cli/src/commands/_generated/zero-trust/access/policies/update.ts @@ -111,6 +111,11 @@ function builder(yargs: Argv) { type: "string", description: "The name of the Access policy.", }) + .option("policy-resolution-account-id", { + type: "string", + description: + "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy.", + }) .option("require", { type: "string", description: @@ -214,6 +219,13 @@ const command: CommandModule = { "name", "text" ), + policy_resolution_account_id: resolveFileToken( + argv["policy-resolution-account-id"] as + | string + | undefined, + "policy-resolution-account-id", + "text" + ), require: parseObjectArray(argv["require"], "require"), }), }); @@ -303,6 +315,11 @@ const command: CommandModule = { "name", "text" ), + policy_resolution_account_id: resolveFileToken( + argv["policy-resolution-account-id"] as string | undefined, + "policy-resolution-account-id", + "text" + ), require: parseObjectArray(argv["require"], "require"), }); const result = await withProgress(`Updating`, async () => diff --git a/packages/cli/src/commands/_generated/zero-trust/organization/index.ts b/packages/cli/src/commands/_generated/zero-trust/organization/index.ts index 1a8d5a10cc..cf7a1178b3 100644 --- a/packages/cli/src/commands/_generated/zero-trust/organization/index.ts +++ b/packages/cli/src/commands/_generated/zero-trust/organization/index.ts @@ -1,6 +1,7 @@ import $create from "./create.js"; import $doh from "./doh/index.js"; import $get from "./get.js"; +import $trustsettings from "./trust-settings/index.js"; import $update from "./update.js"; import type { CommonYargsOptions } from "#lib/cli-types.js"; /** @@ -19,6 +20,7 @@ const command: CommandModule = { .command($get) .command($update) .command($doh) + .command($trustsettings) .demandCommand(1, "Please specify a subcommand"); }, diff --git a/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/get.ts b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/get.ts new file mode 100644 index 0000000000..d50834c4e2 --- /dev/null +++ b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/get.ts @@ -0,0 +1,71 @@ +import operation from "../../../_operations/zero-trust/organization/trust-settings/get.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * get command + * @generated from apis/overlays/zero-trust.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 zero-trust organization trust-settings get\n\nReturns the trust settings for your Zero Trust organization." + ) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "get", + describe: "Get Zero Trust organization trust settings", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "zero-trust organization trust-settings get", + classification: { + safeFlags: ["dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = await resolveAccountIdSilent(); + formatDryRun({ + command: "cf zero-trust organization trust-settings get", + method: "GET", + url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/access/organizations/trust_settings`, + pathParams: {}, + bodyKind: "none", + }); + return; + } + const client = await createCommandClient(argv); + const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); + argv.accountId = accountId; + + const result = await withProgress(`Loading`, async () => + client.send(operation, { account_id: accountId }) + ); + formatOutput(result, { successLabel: `Loaded` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/index.ts b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/index.ts new file mode 100644 index 0000000000..a0c25be264 --- /dev/null +++ b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/index.ts @@ -0,0 +1,26 @@ +import $get from "./get.js"; +import $replace from "./replace.js"; +import $update from "./update.js"; +import type { CommonYargsOptions } from "#lib/cli-types.js"; +/** + * trust-settings command group + * @generated from apis/overlays/zero-trust.ts + */ +import type { CommandModule } from "yargs"; + +const command: CommandModule = { + command: "trust-settings", + describe: "Operations for organization.trust-settings", + + builder: (yargs) => { + return yargs + .command($get) + .command($replace) + .command($update) + .demandCommand(1, "Please specify a subcommand"); + }, + + handler: () => {}, +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/replace.ts b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/replace.ts new file mode 100644 index 0000000000..24f1cb069c --- /dev/null +++ b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/replace.ts @@ -0,0 +1,115 @@ +import operation from "../../../_operations/zero-trust/organization/trust-settings/replace.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * replace command + * @generated from apis/overlays/zero-trust.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { compactBody, parseBody } from "#lib/body-parser.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 zero-trust organization trust-settings replace\n\nReplaces the trust settings for your Zero Trust organization." + ) + .option("grant-trust-to-all-accounts-in-org", { + type: "boolean", + description: + "Whether all accounts in the organization are trusted to use this account's cross-account Access resources.", + }) + .option("trusting-accounts", { + type: "string", + array: true, + description: + "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty.", + }) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("body", { + type: "string", + description: "Raw JSON request body (bypasses individual flags)", + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "replace", + describe: "Replace Zero Trust organization trust settings", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "zero-trust organization trust-settings replace", + classification: { + safeFlags: ["grant-trust-to-all-accounts-in-org", "dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = await resolveAccountIdSilent(); + formatDryRun({ + command: "cf zero-trust organization trust-settings replace", + method: "PUT", + url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/access/organizations/trust_settings`, + pathParams: {}, + bodyKind: "json", + body: + argv.body !== undefined + ? parseBody(argv.body) + : compactBody({ + grant_trust_to_all_accounts_in_org: + argv["grant-trust-to-all-accounts-in-org"], + trusting_accounts: argv["trusting-accounts"], + }), + }); + return; + } + const client = await createCommandClient(argv); + const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); + argv.accountId = accountId; + + if (argv.body) { + const bodyData = parseBody(argv.body); + const result = await withProgress(`Updating`, async () => + client.send(operation, { body: bodyData, account_id: accountId }) + ); + formatOutput(result, { successLabel: `Updated` }); + return; + } + if (argv["grant-trust-to-all-accounts-in-org"] === undefined) { + throw new Error( + "--grant-trust-to-all-accounts-in-org is required (or pass --body with this field set)." + ); + } + + // Assemble request body from individual flags + const bodyData = compactBody({ + grant_trust_to_all_accounts_in_org: + argv["grant-trust-to-all-accounts-in-org"], + trusting_accounts: argv["trusting-accounts"], + }); + const result = await withProgress(`Updating`, async () => + client.send(operation, { body: bodyData, account_id: accountId }) + ); + formatOutput(result, { successLabel: `Updated` }); + } + ), +}; + +export default command; diff --git a/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/update.ts b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/update.ts new file mode 100644 index 0000000000..648c6cf262 --- /dev/null +++ b/packages/cli/src/commands/_generated/zero-trust/organization/trust-settings/update.ts @@ -0,0 +1,110 @@ +import operation from "../../../_operations/zero-trust/organization/trust-settings/update.js"; +import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js"; +import type { ArgClassification } from "#lib/telemetry/index.js"; +/** + * update command + * @generated from apis/overlays/zero-trust.ts + */ +import type { Argv, CommandModule } from "yargs"; +import { + createCommandClient, + getAccountId, + resolveAccountIdSilent, +} from "#lib/auth.js"; +import { compactBody, parseBody } from "#lib/body-parser.js"; +import { formatDryRun } from "#lib/dry-run.js"; +import { LOCAL_ACCOUNT_ID } from "#lib/local.js"; +import { formatOutput } from "#lib/output.js"; +import { withProgress } from "#lib/progress.js"; +import { runWithTelemetry } from "#lib/telemetry/index.js"; + +function builder(yargs: Argv) { + return yargs + .usage( + "$0 zero-trust organization trust-settings update\n\nUpdates the trust settings for your Zero Trust organization." + ) + .option("grant-trust-to-all-accounts-in-org", { + type: "boolean", + description: + "Whether all accounts in the organization are trusted to use this account's cross-account Access resources.", + }) + .option("trusting-accounts", { + type: "string", + array: true, + description: + "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty.", + }) + .option("dry-run", { + type: "boolean", + description: "Validate and show what would happen without executing", + default: false, + }) + .option("body", { + type: "string", + description: "Raw JSON request body (bypasses individual flags)", + }); +} + +type Args = InferArgs; + +const command: CommandModule = { + command: "update", + describe: "Update Zero Trust organization trust settings", + builder, + handler: async (argv): Promise => + runWithTelemetry( + { + command: "zero-trust organization trust-settings update", + classification: { + safeFlags: ["grant-trust-to-all-accounts-in-org", "dry-run"], + } satisfies ArgClassification, + }, + argv as Record, + async () => { + if (argv.dryRun) { + const __cfDryRunAccountId = await resolveAccountIdSilent(); + formatDryRun({ + command: "cf zero-trust organization trust-settings update", + method: "PATCH", + url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? ""}/access/organizations/trust_settings`, + pathParams: {}, + bodyKind: "json", + body: + argv.body !== undefined + ? parseBody(argv.body) + : compactBody({ + grant_trust_to_all_accounts_in_org: + argv["grant-trust-to-all-accounts-in-org"], + trusting_accounts: argv["trusting-accounts"], + }), + }); + return; + } + const client = await createCommandClient(argv); + const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId(); + argv.accountId = accountId; + + if (argv.body) { + const bodyData = parseBody(argv.body); + const result = await withProgress(`Updating`, async () => + client.send(operation, { body: bodyData, account_id: accountId }) + ); + formatOutput(result, { successLabel: `Updated` }); + return; + } + + // Assemble request body from individual flags + const bodyData = compactBody({ + grant_trust_to_all_accounts_in_org: + argv["grant-trust-to-all-accounts-in-org"], + trusting_accounts: argv["trusting-accounts"], + }); + const result = await withProgress(`Updating`, async () => + client.send(operation, { body: bodyData, account_id: accountId }) + ); + formatOutput(result, { successLabel: `Updated` }); + } + ), +}; + +export default command;