cf

type API struct {
	Log              logr.Logger
	TunnelName       string
	TunnelId         string
	AccountName      string
	AccountId        string
	Domain           string
	ValidAccountId   string
	ValidTunnelId    string
	ValidTunnelName  string
	ValidZoneId      string
	ValidDomainName  string // Domain name corresponding to ValidZoneId
	CloudflareClient *cloudflare.API
}

type APIError struct {
	Operation string
	Resource  string
	Err       error
}

type AccessAppLauncherCustomizationParams struct {
	LandingPageDesign        *AccessLandingPageDesignParams
	AppLauncherLogoURL       string
	HeaderBackgroundColor    string
	BackgroundColor          string
	FooterLinks              []AccessFooterLinkParams
	SkipAppLauncherLoginPage *bool
}

type AccessApplicationCorsHeadersParams struct {
	AllowedMethods   []string
	AllowedOrigins   []string
	AllowedHeaders   []string
	AllowAllMethods  bool
	AllowAllHeaders  bool
	AllowAllOrigins  bool
	AllowCredentials bool
	MaxAge           int
}

type AccessApplicationParams struct {
	Name                     string
	Domain                   string
	SelfHostedDomains        []string
	Destinations             []AccessDestinationParams
	DomainType               string
	PrivateAddress           string
	Type                     string // self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure
	SessionDuration          string
	AllowedIdps              []string
	AutoRedirectToIdentity   *bool
	EnableBindingCookie      *bool
	HTTPOnlyCookieAttribute  *bool
	PathCookieAttribute      *bool
	SameSiteCookieAttribute  string
	LogoURL                  string
	SkipInterstitial         *bool
	OptionsPreflightBypass   *bool
	AppLauncherVisible       *bool
	ServiceAuth401Redirect   *bool
	CustomDenyMessage        string
	CustomDenyURL            string
	CustomNonIdentityDenyURL string
	AllowAuthenticateViaWarp *bool
	Tags                     []string
	CustomPages              []string
	GatewayRules             []string
	CorsHeaders              *AccessApplicationCorsHeadersParams
	SaasApp                  *SaasApplicationParams
	SCIMConfig               *AccessApplicationSCIMConfigParams
	AppLauncherCustomization *AccessAppLauncherCustomizationParams
	TargetContexts           []AccessInfrastructureTargetContextParams
}

type AccessApplicationResult struct {
	ID                     string
	AUD                    string
	Name                   string
	Domain                 string
	SelfHostedDomains      []string
	Type                   string
	SessionDuration        string
	AllowedIdps            []string
	AutoRedirectToIdentity bool
	SaasAppClientID        string
}

type AccessApplicationSCIMConfigParams struct {
	Enabled            *bool
	RemoteURI          string
	Authentication     *SCIMAuthenticationParams
	IDPUID             string
	DeactivateOnDelete *bool
	Mappings           []SCIMMappingParams
}

type AccessDestinationParams struct {
	Type       string // public, private
	URI        string
	Hostname   string
	CIDR       string
	PortRange  string
	L4Protocol string
	VnetID     string
}

type AccessFooterLinkParams struct {
	Name string
	URL  string
}

type AccessGroupAuthContextRuleParams struct {
	ID                 string
	AcID               string
	IdentityProviderID string
}

type AccessGroupAuthMethodRuleParams struct{ AuthMethod string }

type AccessGroupAzureRuleParams struct {
	ID                 string
	IdentityProviderID string
}

type AccessGroupCommonNameRuleParams struct{ CommonName string }

type AccessGroupCountryRuleParams struct{ Country []string }

type AccessGroupDevicePostureRuleParams struct{ IntegrationUID string }

type AccessGroupEmailDomainRuleParams struct{ Domain string }

type AccessGroupEmailListRuleParams struct{ ID string }

type AccessGroupEmailRuleParams struct{ Email string }

type AccessGroupExternalEvaluationRuleParams struct {
	EvaluateURL string
	KeysURL     string
}

type AccessGroupGSuiteRuleParams struct {
	Email              string
	IdentityProviderID string
}

type AccessGroupGitHubRuleParams struct {
	Name               string
	Teams              []string
	IdentityProviderID string
}

type AccessGroupGroupRuleParams struct{ ID string }

type AccessGroupIPListRuleParams struct{ ID string }

type AccessGroupIPRangesRuleParams struct{ IP []string }

type AccessGroupLoginMethodRuleParams struct{ ID string }

type AccessGroupOIDCRuleParams struct {
	ClaimName          string
	ClaimValue         string
	IdentityProviderID string
}

type AccessGroupOktaRuleParams struct {
	Name               string
	IdentityProviderID string
}

type AccessGroupParams struct {
	Name      string
	Include   []AccessGroupRuleParams
	Exclude   []AccessGroupRuleParams
	Require   []AccessGroupRuleParams
	IsDefault *bool
}

type AccessGroupResult struct {
	ID   string
	Name string
}

type AccessGroupRuleParams struct {
	Email                *AccessGroupEmailRuleParams
	EmailDomain          *AccessGroupEmailDomainRuleParams
	EmailList            *AccessGroupEmailListRuleParams
	Everyone             bool
	IPRanges             *AccessGroupIPRangesRuleParams
	IPList               *AccessGroupIPListRuleParams
	Country              *AccessGroupCountryRuleParams
	Group                *AccessGroupGroupRuleParams
	ServiceToken         *AccessGroupServiceTokenRuleParams
	AnyValidServiceToken bool
	Certificate          bool
	CommonName           *AccessGroupCommonNameRuleParams
	DevicePosture        *AccessGroupDevicePostureRuleParams
	GSuite               *AccessGroupGSuiteRuleParams
	GitHub               *AccessGroupGitHubRuleParams
	Azure                *AccessGroupAzureRuleParams
	Okta                 *AccessGroupOktaRuleParams
	OIDC                 *AccessGroupOIDCRuleParams
	SAML                 *AccessGroupSAMLRuleParams
	AuthMethod           *AccessGroupAuthMethodRuleParams
	AuthContext          *AccessGroupAuthContextRuleParams
	LoginMethod          *AccessGroupLoginMethodRuleParams
	ExternalEvaluation   *AccessGroupExternalEvaluationRuleParams
}

type AccessGroupSAMLRuleParams struct {
	AttributeName      string
	AttributeValue     string
	IdentityProviderID string
}

type AccessGroupServiceTokenRuleParams struct{ TokenID string }

type AccessIdentityProviderParams struct {
	Name       string
	Type       string
	Config     cloudflare.AccessIdentityProviderConfiguration
	ScimConfig cloudflare.AccessIdentityProviderScimConfiguration
}

type AccessIdentityProviderResult struct {
	ID   string
	Name string
	Type string
}

type AccessInfrastructureTargetContextParams struct {
	TargetAttributes map[string][]string
	Port             int
	Protocol         string
}

type AccessLandingPageDesignParams struct {
	Title           string
	Message         string
	ImageURL        string
	ButtonColor     string
	ButtonTextColor string
}

type AccessPolicyParams struct {
	ApplicationID   string                  // Required: The Application ID this policy belongs to
	Name            string                  // Policy name
	Decision        string                  // allow, deny, bypass, non_identity
	Precedence      int                     // Order of evaluation (lower = higher priority)
	Include         []AccessGroupRuleParams // Include rules (e.g., group references)
	Exclude         []AccessGroupRuleParams // Exclude rules
	Require         []AccessGroupRuleParams // Require rules
	SessionDuration *string                 // Optional session duration override
}

type AccessPolicyResult struct {
	ID         string
	Name       string
	Decision   string
	Precedence int
}

type AccessServiceTokenResult struct {
	ID                  string
	TokenID             string
	Name                string
	ClientID            string
	ClientSecret        string
	AccountID           string
	ExpiresAt           string
	CreatedAt           string
	UpdatedAt           string
	LastSeenAt          string
	ClientSecretVersion int64
}

type ActivityLogSettings struct {
	Enabled bool
}

type AntiVirusSettings struct {
	EnabledDownloadPhase bool
	EnabledUploadPhase   bool
	FailClosed           bool
	NotificationSettings *NotificationSettings
}

type BlockPageSettings struct {
	Enabled         bool
	FooterText      string
	HeaderText      string
	LogoPath        string
	BackgroundColor string
}

type BodyScanningSettings struct {
	InspectionMode string
}

type BrowserIsolationSettings struct {
	URLBrowserIsolationEnabled bool
	NonIdentityEnabled         bool
}

type ClientConfig struct {
	Log         logr.Logger
	APIToken    string
	APIKey      string
	Email       string
	AccountID   string
	AccountName string
	Domain      string
	TunnelID    string
	TunnelName  string
}

type ClientFactory interface {
	// NewClient creates a new CloudflareClient with the given configuration.
	NewClient(config ClientConfig) (CloudflareClient, error)
}

type CloudflareClient interface {
	// Tunnel operations
	CreateTunnel() (string, string, error)
	DeleteTunnel() error
	ValidateAll() error
	GetAccountId() (string, error)
	GetTunnelId() (string, error)
	GetTunnelCreds(tunnelSecret string) (string, error)
	GetZoneId() (string, error)

	// DNS operations (api.go - CNAME/TXT for tunnels)
	InsertOrUpdateCName(fqdn, dnsID string) (string, error)
	DeleteDNSId(fqdn, dnsID string, created bool) error
	GetDNSCNameId(fqdn string) (string, error)
	GetManagedDnsTxt(fqdn string) (string, DnsManagedRecordTxt, bool, error)
	InsertOrUpdateTXT(fqdn, txtID, dnsID string) error

	// DNS operations (dns.go - Generic DNS records)
	CreateDNSRecord(params DNSRecordParams) (*DNSRecordResult, error)
	GetDNSRecord(zoneID, recordID string) (*DNSRecordResult, error)
	UpdateDNSRecord(zoneID, recordID string, params DNSRecordParams) (*DNSRecordResult, error)
	DeleteDNSRecord(zoneID, recordID string) error

	// Virtual Network operations
	CreateVirtualNetwork(params VirtualNetworkParams) (*VirtualNetworkResult, error)
	GetVirtualNetwork(virtualNetworkID string) (*VirtualNetworkResult, error)
	GetVirtualNetworkByName(name string) (*VirtualNetworkResult, error)
	UpdateVirtualNetwork(virtualNetworkID string, params VirtualNetworkParams) (*VirtualNetworkResult, error)
	DeleteVirtualNetwork(virtualNetworkID string) error

	// Tunnel Route operations
	CreateTunnelRoute(params TunnelRouteParams) (*TunnelRouteResult, error)
	GetTunnelRoute(network, virtualNetworkID string) (*TunnelRouteResult, error)
	UpdateTunnelRoute(network string, params TunnelRouteParams) (*TunnelRouteResult, error)
	DeleteTunnelRoute(network, virtualNetworkID string) error

	// Access Application operations
	CreateAccessApplication(params AccessApplicationParams) (*AccessApplicationResult, error)
	GetAccessApplication(applicationID string) (*AccessApplicationResult, error)
	UpdateAccessApplication(applicationID string, params AccessApplicationParams) (*AccessApplicationResult, error)
	DeleteAccessApplication(applicationID string) error
	ListAccessApplicationsByName(name string) (*AccessApplicationResult, error)

	// Access Policy operations
	CreateAccessPolicy(params AccessPolicyParams) (*AccessPolicyResult, error)
	GetAccessPolicy(applicationID, policyID string) (*AccessPolicyResult, error)
	UpdateAccessPolicy(policyID string, params AccessPolicyParams) (*AccessPolicyResult, error)
	DeleteAccessPolicy(applicationID, policyID string) error
	ListAccessPolicies(applicationID string) ([]AccessPolicyResult, error)

	// Access Group operations
	CreateAccessGroup(params AccessGroupParams) (*AccessGroupResult, error)
	GetAccessGroup(groupID string) (*AccessGroupResult, error)
	UpdateAccessGroup(groupID string, params AccessGroupParams) (*AccessGroupResult, error)
	DeleteAccessGroup(groupID string) error
	ListAccessGroupsByName(name string) (*AccessGroupResult, error)

	// Access Identity Provider operations
	CreateAccessIdentityProvider(params AccessIdentityProviderParams) (*AccessIdentityProviderResult, error)
	GetAccessIdentityProvider(idpID string) (*AccessIdentityProviderResult, error)
	UpdateAccessIdentityProvider(idpID string, params AccessIdentityProviderParams) (*AccessIdentityProviderResult, error)
	DeleteAccessIdentityProvider(idpID string) error
	ListAccessIdentityProvidersByName(name string) (*AccessIdentityProviderResult, error)

	// Access Service Token operations
	GetAccessServiceTokenByName(name string) (*AccessServiceTokenResult, error)
	CreateAccessServiceToken(name string, duration string) (*AccessServiceTokenResult, error)
	UpdateAccessServiceToken(tokenID string, name string, duration string) (*AccessServiceTokenResult, error)
	RefreshAccessServiceToken(tokenID string) (*AccessServiceTokenResult, error)
	DeleteAccessServiceToken(tokenID string) error

	// Device Posture Rule operations
	CreateDevicePostureRule(params DevicePostureRuleParams) (*DevicePostureRuleResult, error)
	GetDevicePostureRule(ruleID string) (*DevicePostureRuleResult, error)
	UpdateDevicePostureRule(ruleID string, params DevicePostureRuleParams) (*DevicePostureRuleResult, error)
	DeleteDevicePostureRule(ruleID string) error
	ListDevicePostureRulesByName(name string) (*DevicePostureRuleResult, error)

	// Gateway Rule operations
	CreateGatewayRule(params GatewayRuleParams) (*GatewayRuleResult, error)
	GetGatewayRule(ruleID string) (*GatewayRuleResult, error)
	UpdateGatewayRule(ruleID string, params GatewayRuleParams) (*GatewayRuleResult, error)
	DeleteGatewayRule(ruleID string) error
	ListGatewayRulesByName(name string) (*GatewayRuleResult, error)

	// Gateway List operations
	CreateGatewayList(params GatewayListParams) (*GatewayListResult, error)
	GetGatewayList(listID string) (*GatewayListResult, error)
	UpdateGatewayList(listID string, params GatewayListParams) (*GatewayListResult, error)
	DeleteGatewayList(listID string) error
	ListGatewayListsByName(name string) (*GatewayListResult, error)

	// Split Tunnel operations
	GetSplitTunnelExclude() ([]SplitTunnelEntry, error)
	UpdateSplitTunnelExclude(entries []SplitTunnelEntry) error
	GetSplitTunnelInclude() ([]SplitTunnelEntry, error)
	UpdateSplitTunnelInclude(entries []SplitTunnelEntry) error

	// Fallback Domain operations
	GetFallbackDomains() ([]FallbackDomainEntry, error)
	UpdateFallbackDomains(entries []FallbackDomainEntry) error

	// WARP Connector operations
	CreateWARPConnector(name string) (*WARPConnectorResult, error)
	GetWARPConnectorToken(connectorID string) (*WARPConnectorTokenResult, error)
	DeleteWARPConnector(connectorID string) error

	// Gateway Configuration operations
	UpdateGatewayConfiguration(params GatewayConfigurationParams) (*GatewayConfigurationResult, error)
}

type Configuration struct {
	TunnelID      string                   `yaml:"tunnel" json:"tunnel"`
	Ingress       []UnvalidatedIngressRule `yaml:"ingress,omitempty" json:"ingress,omitempty"`
	WarpRouting   WarpRoutingConfig        `yaml:"warp-routing,omitempty" json:"warp-routing,omitempty"`
	OriginRequest OriginRequestConfig      `yaml:"originRequest,omitempty" json:"originRequest,omitempty"`
	SourceFile    string                   `yaml:"credentials-file" json:"credentials-file"`
	Metrics       string                   `yaml:"metrics,omitempty" json:"metrics,omitempty"`
	NoAutoUpdate  bool                     `yaml:"no-autoupdate,omitempty" json:"no-autoupdate,omitempty"`
}

type CustomCertificateSettings struct {
	Enabled bool
	ID      string
}

type DNSRecordDataParams struct {
	// For SRV records
	Service string
	Proto   string
	Weight  int
	Port    int
	Target  string

	// For CAA records
	Flags int
	Tag   string
	Value string

	// For CERT/SSHFP/TLSA records
	Algorithm    int
	Certificate  string
	KeyTag       int
	Usage        int
	Selector     int
	MatchingType int

	// For LOC records
	LatDegrees    int
	LatMinutes    int
	LatSeconds    string
	LatDirection  string
	LongDegrees   int
	LongMinutes   int
	LongSeconds   string
	LongDirection string
	Altitude      string
	Size          string
	PrecisionHorz string
	PrecisionVert string

	// For URI records
	ContentURI string
}

type DNSRecordParams struct {
	Name     string
	Type     string
	Content  string
	TTL      int
	Proxied  bool
	Priority *int
	Comment  string
	Tags     []string
	Data     *DNSRecordDataParams
}

type DNSRecordResult struct {
	ID      string
	ZoneID  string
	Name    string
	Type    string
	Content string
	TTL     int
	Proxied bool
}

type DefaultClientFactory struct{}

type DevicePostureInputParams struct {
	ID               string
	Path             string
	Exists           *bool
	Sha256           string
	Thumbprint       string
	Running          *bool
	RequireAll       *bool
	Enabled          *bool
	Version          string
	Operator         string
	Domain           string
	ComplianceStatus string
	ConnectionID     string
	LastSeen         string
	EidLastSeen      string
	ActiveThreats    *int
	Infected         *bool
	IsActive         *bool
	NetworkStatus    string
	SensorConfig     string
	VersionOperator  string
	CountOperator    string
	ScoreOperator    string
	IssueCount       *int
	Score            *int
	TotalScore       *int
	RiskLevel        string
	Overall          string
	State            string
	OperationalState string
	OSDistroName     string
	OSDistroRevision string
	OSVersionExtra   string
	OS               string
	OperatingSystem  string
	CertificateID    string
	CommonName       string
	Cn               string
	CheckPrivateKey  *bool
	ExtendedKeyUsage []string
	CheckDisks       []string
}

type DevicePostureMatchParams struct {
	Platform string
}

type DevicePostureRuleParams struct {
	Name        string
	Type        string
	Description string
	Schedule    string
	Expiration  string
	Match       []DevicePostureMatchParams
	Input       *DevicePostureInputParams
}

type DevicePostureRuleResult struct {
	ID          string
	Name        string
	Type        string
	Description string
	AccountID   string
}

type DnsManagedRecordTxt struct {
	DnsId      string // DnsId of the managed record
	TunnelName string // TunnelName of the managed record
	TunnelId   string // TunnelId of the managed record
}

type FIPSSettings struct {
	TLS bool
}

type FallbackDomainEntry struct {
	Suffix      string   `json:"suffix"`
	Description string   `json:"description,omitempty"`
	DNSServer   []string `json:"dns_server,omitempty"`
}

type GatewayAuditSSHParams struct {
	CommandLogging bool
}

type GatewayBISOAdminControlsParams struct {
	DisablePrinting             *bool
	DisableCopyPaste            *bool
	DisableDownload             *bool
	DisableUpload               *bool
	DisableKeyboard             *bool
	DisableClipboardRedirection *bool
}

type GatewayCheckSessionParams struct {
	Enforce  bool
	Duration string
}

type GatewayConfigurationParams struct {
	TLSDecrypt        *TLSDecryptSettings
	ActivityLog       *ActivityLogSettings
	AntiVirus         *AntiVirusSettings
	BlockPage         *BlockPageSettings
	BodyScanning      *BodyScanningSettings
	BrowserIsolation  *BrowserIsolationSettings
	FIPS              *FIPSSettings
	ProtocolDetection *ProtocolDetectionSettings
	CustomCertificate *CustomCertificateSettings
}

type GatewayConfigurationResult struct {
	AccountID string
}

type GatewayDNSResolverEntryParams struct {
	IP                         string
	Port                       int
	VNetID                     string
	RouteThroughPrivateNetwork *bool
}

type GatewayDNSResolversParams struct {
	IPv4 []GatewayDNSResolverEntryParams
	IPv6 []GatewayDNSResolverEntryParams
}

type GatewayEgressParams struct {
	IPv4         string
	IPv6         string
	IPv4Fallback string
}

type GatewayL4OverrideParams struct {
	IP   string
	Port int
}

type GatewayListItem struct {
	Value       string
	Description string
}

type GatewayListParams struct {
	Name        string
	Description string
	Type        string // SERIAL, URL, DOMAIN, EMAIL, IP
	Items       []string
}

type GatewayListResult struct {
	ID          string
	Name        string
	Description string
	Type        string
	Count       int
	AccountID   string
}

type GatewayNotificationSettingsParams struct {
	Enabled    bool
	Message    string
	SupportURL string
}

type GatewayPayloadLogParams struct {
	Enabled bool
}

type GatewayQuarantineParams struct {
	FileTypes []string
}

type GatewayResolveDNSInternallyParams struct {
	ViewID   string
	Fallback string // "none", "public_dns", etc.
}

type GatewayRuleExpirationParams struct {
	ExpiresAt string
	Duration  string
}

type GatewayRuleParams struct {
	Name          string
	Description   string
	Precedence    int
	Enabled       bool
	Action        string
	Filters       []cloudflare.TeamsFilterType
	Traffic       string
	Identity      string
	DevicePosture string
	RuleSettings  *GatewayRuleSettingsParams
	Schedule      *GatewayRuleScheduleParams
	Expiration    *GatewayRuleExpirationParams
}

type GatewayRuleResult struct {
	ID          string
	Name        string
	Description string
	Precedence  int
	Enabled     bool
	Action      string
}

type GatewayRuleScheduleParams struct {
	TimeZone string
	Mon      string
	Tue      string
	Wed      string
	Thu      string
	Fri      string
	Sat      string
	Sun      string
}

type GatewayRuleSettingsParams struct {
	BlockPageEnabled                *bool
	BlockReason                     string
	OverrideIPs                     []string
	OverrideHost                    string
	L4Override                      *GatewayL4OverrideParams
	BISOAdminControls               *GatewayBISOAdminControlsParams
	CheckSession                    *GatewayCheckSessionParams
	AddHeaders                      map[string]string
	InsecureDisableDNSSECValidation *bool
	Egress                          *GatewayEgressParams
	PayloadLog                      *GatewayPayloadLogParams
	UntrustedCertAction             string
	AuditSSH                        *GatewayAuditSSHParams
	ResolveDNSInternally            *GatewayResolveDNSInternallyParams
	ResolveDNSThroughCloudflare     *bool
	DNSResolvers                    *GatewayDNSResolversParams
	NotificationSettings            *GatewayNotificationSettingsParams
	AllowChildBypass                *bool
	BypassParentRule                *bool
	IgnoreCNAMECategoryMatches      *bool
	IPCategories                    *bool
	IPIndicatorFeeds                *bool
	Quarantine                      *GatewayQuarantineParams
}

type HybridAndImplicitOptionsParams struct {
	ReturnIDTokenFromAuthorizationEndpoint     *bool
	ReturnAccessTokenFromAuthorizationEndpoint *bool
}

type IngressIPRule struct {
	Prefix *string `yaml:"prefix,omitempty" json:"prefix,omitempty"`
	Ports  []int   `yaml:"ports,omitempty" json:"ports,omitempty"`
	Allow  bool    `yaml:"allow,omitempty" json:"allow,omitempty"`
}

type MergeOptions struct {
	// Source identifies the controller/source of this configuration fragment.
	// Used for logging and debugging. Examples: "TunnelBinding/default/my-binding",
	// "Ingress/default/my-ingress", "Gateway/default/my-gateway", "Tunnel/my-tunnel"
	Source string

	// PreviousHostnames contains the hostnames that were previously synced by this source.
	// These will be removed from the remote configuration before adding CurrentRules.
	// This allows proper cleanup when a source's rules change.
	PreviousHostnames []string

	// CurrentRules contains the ingress rules to add to the configuration.
	// These rules will be merged with existing rules from other sources.
	// The last rule should be the catch-all rule (empty hostname with service).
	CurrentRules []UnvalidatedIngressRule

	// WarpRouting controls WARP routing state.
	// - nil: preserve existing warp-routing state (default)
	// - &WarpRoutingConfig{Enabled: true}: explicitly enable warp-routing
	// - &WarpRoutingConfig{Enabled: false}: explicitly disable warp-routing
	WarpRouting *WarpRoutingConfig

	// FallbackTarget is the service URL for the catch-all rule (e.g., "http_status:404").
	// - "": preserve existing fallback target
	// - non-empty: set/override the fallback target
	FallbackTarget string

	// GlobalOriginRequest is the global origin request configuration.
	// - nil: preserve existing global origin request config
	// - non-nil: set/override the global origin request config
	GlobalOriginRequest *OriginRequestConfig
}

type MergeSyncResult struct {
	// Version is the new configuration version after update.
	Version int `json:"version"`

	// SyncedHostnames contains all hostnames that were synced by this operation.
	// Controllers should store this in their Status for tracking.
	SyncedHostnames []string `json:"syncedHostnames"`
}

type MinifySettings struct {
	HTML bool `json:"html"`
	CSS  bool `json:"css"`
	JS   bool `json:"js"`
}

type NotificationSettings struct {
	Enabled    bool
	Message    string
	SupportURL string
}

type OIDCClaimConfigParams struct {
	Name     string
	Source   OIDCClaimSourceParams
	Required bool
	Scope    string
}

type OIDCClaimSourceParams struct {
	Name      string
	NameByIDP map[string]string
}

type OriginCACertificateParams struct {
	Hostnames       []string
	RequestType     string // "origin-rsa" or "origin-ecc"
	RequestValidity int    // days: 7, 30, 90, 365, 730, 1095, 5475
	CSR             string
}

type OriginCACertificateResult struct {
	ID          string
	Certificate string
	Hostnames   []string
	ExpiresOn   time.Time
	RequestType string
	CSR         string
}

type OriginRequestConfig struct {
	// HTTP proxy timeout for establishing a new connection
	ConnectTimeout *time.Duration `yaml:"connectTimeout,omitempty" json:"connectTimeout,omitempty"`
	// HTTP proxy timeout for completing a TLS handshake
	TLSTimeout *time.Duration `yaml:"tlsTimeout,omitempty" json:"tlsTimeout,omitempty"`
	// HTTP proxy TCP keepalive duration
	TCPKeepAlive *time.Duration `yaml:"tcpKeepAlive,omitempty" json:"tcpKeepAlive,omitempty"`
	// HTTP proxy should disable "happy eyeballs" for IPv4/v6 fallback
	NoHappyEyeballs *bool `yaml:"noHappyEyeballs,omitempty" json:"noHappyEyeballs,omitempty"`
	// HTTP proxy maximum keepalive connection pool size
	KeepAliveConnections *int `yaml:"keepAliveConnections,omitempty" json:"keepAliveConnections,omitempty"`
	// HTTP proxy timeout for closing an idle connection
	KeepAliveTimeout *time.Duration `yaml:"keepAliveTimeout,omitempty" json:"keepAliveTimeout,omitempty"`
	// Sets the HTTP Host header for the local webserver.
	HTTPHostHeader *string `yaml:"httpHostHeader,omitempty" json:"httpHostHeader,omitempty"`
	// Hostname on the origin server certificate.
	OriginServerName *string `yaml:"originServerName,omitempty" json:"originServerName,omitempty"`
	// Path to the CA for the certificate of your origin.
	// This option should be used only if your certificate is not signed by Cloudflare.
	CAPool *string `yaml:"caPool,omitempty" json:"caPool,omitempty"`
	// Disables TLS verification of the certificate presented by your origin.
	// Will allow any certificate from the origin to be accepted.
	// Note: The connection from your machine to Cloudflare's Edge is still encrypted.
	NoTLSVerify *bool `yaml:"noTLSVerify,omitempty" json:"noTLSVerify,omitempty"`
	// Attempt to connect to origin using HTTP2. Origin must be configured as https.
	HTTP2Origin *bool `yaml:"http2Origin,omitempty" json:"http2Origin,omitempty"`
	// Disables chunked transfer encoding.
	// Useful if you are running a WSGI server.
	DisableChunkedEncoding *bool `yaml:"disableChunkedEncoding,omitempty" json:"disableChunkedEncoding,omitempty"`
	// Runs as jump host
	BastionMode *bool `yaml:"bastionMode,omitempty" json:"bastionMode,omitempty"`
	// Listen address for the proxy.
	ProxyAddress *string `yaml:"proxyAddress,omitempty" json:"proxyAddress,omitempty"`
	// Listen port for the proxy.
	ProxyPort *uint `yaml:"proxyPort,omitempty" json:"proxyPort,omitempty"`
	// Valid options are 'socks' or empty.
	ProxyType *string `yaml:"proxyType,omitempty" json:"proxyType,omitempty"`
	// IP rules for the proxy service
	IPRules []IngressIPRule `yaml:"ipRules,omitempty" json:"ipRules,omitempty"`
}

type ProtocolDetectionSettings struct {
	Enabled bool
}

type Queue struct {
	ID         string `json:"queue_id"`
	Name       string `json:"queue_name"`
	CreatedOn  string `json:"created_on,omitempty"`
	ModifiedOn string `json:"modified_on,omitempty"`
}

type R2BucketParams struct {
	Name         string
	LocationHint string
}

type R2BucketResult struct {
	Name         string
	Location     string
	CreationDate time.Time
}

type R2CORSRule struct {
	ID             string   `json:"id,omitempty"`
	AllowedOrigins []string `json:"allowedOrigins"`
	AllowedMethods []string `json:"allowedMethods"`
	AllowedHeaders []string `json:"allowedHeaders,omitempty"`
	ExposeHeaders  []string `json:"exposeHeaders,omitempty"`
	MaxAgeSeconds  *int     `json:"maxAgeSeconds,omitempty"`
}

type R2CustomDomain struct {
	Domain   string         `json:"domain"`
	Enabled  bool           `json:"enabled"`
	Status   R2DomainStatus `json:"status"`
	MinTLS   string         `json:"minTLS,omitempty"`
	ZoneID   string         `json:"zoneId,omitempty"`
	ZoneName string         `json:"zoneName,omitempty"`
}

type R2CustomDomainParams struct {
	Domain  string `json:"domain"`
	ZoneID  string `json:"zoneId,omitempty"`
	MinTLS  string `json:"minTLS,omitempty"`
	Enabled bool   `json:"enabled"`
}

type R2DomainStatus struct {
	Ownership string `json:"ownership,omitempty"`
	SSL       string `json:"ssl,omitempty"`
}

type R2LifecycleAbortUpload struct {
	DaysAfterInitiation int `json:"daysAfterInitiation"`
}

type R2LifecycleExpiration struct {
	Days *int   `json:"days,omitempty"`
	Date string `json:"date,omitempty"`
}

type R2LifecycleRule struct {
	ID                             string                  `json:"id"`
	Enabled                        bool                    `json:"enabled"`
	Prefix                         string                  `json:"prefix,omitempty"`
	Expiration                     *R2LifecycleExpiration  `json:"expiration,omitempty"`
	AbortIncompleteMultipartUpload *R2LifecycleAbortUpload `json:"abortIncompleteMultipartUpload,omitempty"`
}

type R2NotificationRule struct {
	RuleID      string   `json:"ruleId,omitempty"`
	Prefix      string   `json:"prefix,omitempty"`
	Suffix      string   `json:"suffix,omitempty"`
	EventTypes  []string `json:"eventType"`
	Description string   `json:"description,omitempty"`
}

type RefreshTokenOptionsParams struct {
	Lifetime string
}

type RegistrantContactInfo struct {
	ID           string
	FirstName    string
	LastName     string
	Organization string
	Address      string
	Address2     string
	City         string
	State        string
	Zip          string
	Country      string
	Phone        string
	Email        string
	Fax          string
}

type RegistrarDomainConfig struct {
	NameServers []string
	Privacy     bool
	Locked      bool
	AutoRenew   bool
}

type RegistrarDomainInfo struct {
	ID                string
	Available         bool
	SupportedTLD      bool
	CanRegister       bool
	CurrentRegistrar  string
	ExpiresAt         time.Time
	CreatedAt         time.Time
	UpdatedAt         time.Time
	RegistryStatuses  string
	Locked            bool
	TransferInStatus  string // Combined transfer status
	CanCancelTransfer bool
	RegistrantContact *RegistrantContactInfo
}

type RetryConfig struct {
	// BaseDelay is the initial delay before retry
	BaseDelay time.Duration
	// MaxDelay is the maximum delay between retries
	MaxDelay time.Duration
	// MaxRetries is the maximum number of retries (0 = no limit)
	MaxRetries int
	// RetryCount tracks the current retry count (for exponential backoff)
	RetryCount int
}

type RulesetResult struct {
	ID          string
	Name        string
	Description string
	Kind        string
	Phase       string
	Version     string
	LastUpdated time.Time
	Rules       []cloudflare.RulesetRule
}

type SAMLAttributeConfigParams struct {
	Name         string
	NameFormat   string
	Source       SAMLAttributeSourceParams
	FriendlyName string
	Required     bool
}

type SAMLAttributeSourceParams struct {
	Name      string
	NameByIDP map[string]string
}

type SCIMAuthenticationParams struct {
	Scheme           string // httpbasic, oauthbearertoken, oauth2
	User             string
	Password         string
	Token            string
	ClientID         string
	ClientSecret     string
	AuthorizationURL string
	TokenURL         string
	Scopes           []string
}

type SCIMMappingOperationsParams struct {
	Create *bool
	Update *bool
	Delete *bool
}

type SCIMMappingParams struct {
	Schema           string
	Enabled          *bool
	Filter           string
	TransformJsonata string
	Operations       *SCIMMappingOperationsParams
	Strictness       string
}

type SaasApplicationParams struct {
	AuthType                      string // saml, oidc
	ConsumerServiceURL            string
	SPEntityID                    string
	NameIDFormat                  string
	DefaultRelayState             string
	CustomAttributes              []SAMLAttributeConfigParams
	NameIDTransformJsonata        string
	SamlAttributeTransformJsonata string
	RedirectURIs                  []string
	GrantTypes                    []string
	Scopes                        []string
	AppLauncherURL                string
	GroupFilterRegex              string
	CustomClaims                  []OIDCClaimConfigParams
	AllowPKCEWithoutClientSecret  *bool
	AccessTokenLifetime           string
	RefreshTokenOptions           *RefreshTokenOptionsParams
	HybridAndImplicitOptions      *HybridAndImplicitOptionsParams
}

type SplitTunnelEntry struct {
	Address     string `json:"address,omitempty"`
	Host        string `json:"host,omitempty"`
	Description string `json:"description,omitempty"`
}

type TLSDecryptSettings struct {
	Enabled bool
}

type TunnelConfigurationResult = cloudflare.TunnelConfigurationResult

type TunnelCredentialsFile struct {
	AccountTag   string `json:"AccountTag"`
	TunnelID     string `json:"TunnelID"`
	TunnelName   string `json:"TunnelName"`
	TunnelSecret string `json:"TunnelSecret"`
}

type TunnelRouteParams struct {
	Network          string // CIDR notation
	TunnelID         string
	VirtualNetworkID string
	Comment          string
}

type TunnelRouteResult struct {
	Network          string
	TunnelID         string
	TunnelName       string
	VirtualNetworkID string
	Comment          string
}

type UnvalidatedIngressRule struct {
	Hostname      string              `yaml:"hostname,omitempty" json:"hostname,omitempty"`
	Path          string              `yaml:"path,omitempty" json:"path,omitempty"`
	Service       string              `yaml:"service" json:"service"`
	OriginRequest OriginRequestConfig `yaml:"originRequest,omitempty" json:"originRequest,omitempty"`
}

type VirtualNetworkParams struct {
	Name             string
	Comment          string
	IsDefaultNetwork bool
}

type VirtualNetworkResult struct {
	ID               string
	Name             string
	Comment          string
	IsDefaultNetwork bool
	DeletedAt        *string
}

type WARPConnectorResult struct {
	ID          string
	TunnelID    string
	TunnelToken string
	Name        string
}

type WARPConnectorTokenResult struct {
	Token string
}

type WarpRoutingConfig struct {
	Enabled bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
}

type ZoneSettings struct {
	// SSL/TLS settings
	SSLMode                 string `json:"ssl,omitempty"`
	MinTLSVersion           string `json:"min_tls_version,omitempty"`
	TLS13                   string `json:"tls_1_3,omitempty"`
	AlwaysUseHTTPS          string `json:"always_use_https,omitempty"`
	AutomaticHTTPSRewrites  string `json:"automatic_https_rewrites,omitempty"`
	OpportunisticEncryption string `json:"opportunistic_encryption,omitempty"`
	TLSClientAuth           string `json:"tls_client_auth,omitempty"`

	// Cache settings
	BrowserCacheTTL int    `json:"browser_cache_ttl,omitempty"`
	DevelopmentMode string `json:"development_mode,omitempty"`
	CacheLevel      string `json:"cache_level,omitempty"`
	AlwaysOnline    string `json:"always_online,omitempty"`
	SortQueryString string `json:"sort_query_string_for_cache,omitempty"`

	// Security settings
	SecurityLevel     string `json:"security_level,omitempty"`
	BrowserCheck      string `json:"browser_check,omitempty"`
	EmailObfuscation  string `json:"email_obfuscation,omitempty"`
	ServerSideExclude string `json:"server_side_exclude,omitempty"`
	HotlinkProtection string `json:"hotlink_protection,omitempty"`
	ChallengePassage  int    `json:"challenge_ttl,omitempty"`
	WAF               string `json:"waf,omitempty"`

	// Performance settings
	Brotli          string          `json:"brotli,omitempty"`
	HTTP2           string          `json:"http2,omitempty"`
	HTTP3           string          `json:"http3,omitempty"`
	ZeroRTT         string          `json:"0rtt,omitempty"`
	Minify          *MinifySettings `json:"minify,omitempty"`
	Polish          string          `json:"polish,omitempty"`
	WebP            string          `json:"webp,omitempty"`
	Mirage          string          `json:"mirage,omitempty"`
	EarlyHints      string          `json:"early_hints,omitempty"`
	RocketLoader    string          `json:"rocket_loader,omitempty"`
	PrefetchPreload string          `json:"prefetch_preload,omitempty"`
	IPGeolocation   string          `json:"ip_geolocation,omitempty"`
	Websockets      string          `json:"websockets,omitempty"`
}