cf

type API struct {
	Log              logr.Logger
	TunnelName       string
	TunnelId         string
	AccountName      string
	AccountId        string
	Domain           string
	ValidAccountId   string
	ValidTunnelId    string
	ValidTunnelName  string
	ValidZoneId      string
	ValidDomainName  string // Domain name corresponding to ValidZoneId
	CloudflareClient *cloudflare.API
}

type APIError struct {
	Operation string
	Resource  string
	Err       error
}

type AccessAppLauncherCustomizationParams struct {
	LandingPageDesign        *AccessLandingPageDesignParams
	AppLauncherLogoURL       string
	HeaderBackgroundColor    string
	BackgroundColor          string
	FooterLinks              []AccessFooterLinkParams
	SkipAppLauncherLoginPage *bool
}

type AccessApplicationCorsHeadersParams struct {
	AllowedMethods   []string
	AllowedOrigins   []string
	AllowedHeaders   []string
	AllowAllMethods  bool
	AllowAllHeaders  bool
	AllowAllOrigins  bool
	AllowCredentials bool
	MaxAge           int
}

type AccessApplicationParams struct {
	Name                     string
	Domain                   string
	SelfHostedDomains        []string
	Destinations             []AccessDestinationParams
	DomainType               string
	PrivateAddress           string
	Type                     string // self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure
	SessionDuration          string
	AllowedIdps              []string
	AutoRedirectToIdentity   *bool
	EnableBindingCookie      *bool
	HTTPOnlyCookieAttribute  *bool
	PathCookieAttribute      *bool
	SameSiteCookieAttribute  string
	LogoURL                  string
	SkipInterstitial         *bool
	OptionsPreflightBypass   *bool
	AppLauncherVisible       *bool
	ServiceAuth401Redirect   *bool
	CustomDenyMessage        string
	CustomDenyURL            string
	CustomNonIdentityDenyURL string
	AllowAuthenticateViaWarp *bool
	Tags                     []string
	CustomPages              []string
	GatewayRules             []string
	CorsHeaders              *AccessApplicationCorsHeadersParams
	SaasApp                  *SaasApplicationParams
	SCIMConfig               *AccessApplicationSCIMConfigParams
	AppLauncherCustomization *AccessAppLauncherCustomizationParams
	TargetContexts           []AccessInfrastructureTargetContextParams
}

type AccessApplicationResult struct {
	ID                     string
	AUD                    string
	Name                   string
	Domain                 string
	SelfHostedDomains      []string
	Type                   string
	SessionDuration        string
	AllowedIdps            []string
	AutoRedirectToIdentity bool
	SaasAppClientID        string
}

type AccessApplicationSCIMConfigParams struct {
	Enabled            *bool
	RemoteURI          string
	Authentication     *SCIMAuthenticationParams
	IDPUID             string
	DeactivateOnDelete *bool
	Mappings           []SCIMMappingParams
}

type AccessApprovalGroupParams struct {
	EmailAddresses  []string
	EmailListUUID   string
	ApprovalsNeeded int
}

type AccessDestinationParams struct {
	Type       string // public, private
	URI        string
	Hostname   string
	CIDR       string
	PortRange  string
	L4Protocol string
	VnetID     string
}

type AccessFooterLinkParams struct {
	Name string
	URL  string
}

type AccessGroupAuthContextRuleParams struct {
	ID                 string
	AcID               string
	IdentityProviderID string
}

type AccessGroupAuthMethodRuleParams struct{ AuthMethod string }

type AccessGroupAzureRuleParams struct {
	ID                 string
	IdentityProviderID string
}

type AccessGroupCommonNameRuleParams struct{ CommonName string }

type AccessGroupCountryRuleParams struct{ Country []string }

type AccessGroupDevicePostureRuleParams struct{ IntegrationUID string }

type AccessGroupEmailDomainRuleParams struct{ Domain string }

type AccessGroupEmailListRuleParams struct{ ID string }

type AccessGroupEmailRuleParams struct{ Email string }

type AccessGroupExternalEvaluationRuleParams struct {
	EvaluateURL string
	KeysURL     string
}

type AccessGroupGSuiteRuleParams struct {
	Email              string
	IdentityProviderID string
}

type AccessGroupGitHubRuleParams struct {
	Name               string
	Teams              []string
	IdentityProviderID string
}

type AccessGroupGroupRuleParams struct{ ID string }

type AccessGroupIPListRuleParams struct{ ID string }

type AccessGroupIPRangesRuleParams struct{ IP []string }

type AccessGroupLoginMethodRuleParams struct{ ID string }

type AccessGroupOIDCRuleParams struct {
	ClaimName          string
	ClaimValue         string
	IdentityProviderID string
}

type AccessGroupOktaRuleParams struct {
	Name               string
	IdentityProviderID string
}

type AccessGroupParams struct {
	Name      string
	Include   []AccessGroupRuleParams
	Exclude   []AccessGroupRuleParams
	Require   []AccessGroupRuleParams
	IsDefault *bool
}

type AccessGroupResult struct {
	ID   string
	Name string
}

type AccessGroupRuleParams struct {
	Email                *AccessGroupEmailRuleParams
	EmailDomain          *AccessGroupEmailDomainRuleParams
	EmailList            *AccessGroupEmailListRuleParams
	Everyone             bool
	IPRanges             *AccessGroupIPRangesRuleParams
	IPList               *AccessGroupIPListRuleParams
	Country              *AccessGroupCountryRuleParams
	Group                *AccessGroupGroupRuleParams
	ServiceToken         *AccessGroupServiceTokenRuleParams
	AnyValidServiceToken bool
	Certificate          bool
	CommonName           *AccessGroupCommonNameRuleParams
	DevicePosture        *AccessGroupDevicePostureRuleParams
	GSuite               *AccessGroupGSuiteRuleParams
	GitHub               *AccessGroupGitHubRuleParams
	Azure                *AccessGroupAzureRuleParams
	Okta                 *AccessGroupOktaRuleParams
	OIDC                 *AccessGroupOIDCRuleParams
	SAML                 *AccessGroupSAMLRuleParams
	AuthMethod           *AccessGroupAuthMethodRuleParams
	AuthContext          *AccessGroupAuthContextRuleParams
	LoginMethod          *AccessGroupLoginMethodRuleParams
	ExternalEvaluation   *AccessGroupExternalEvaluationRuleParams
}

type AccessGroupSAMLRuleParams struct {
	AttributeName      string
	AttributeValue     string
	IdentityProviderID string
}

type AccessGroupServiceTokenRuleParams struct{ TokenID string }

type AccessIdentityProviderParams struct {
	Name       string
	Type       string
	Config     cloudflare.AccessIdentityProviderConfiguration
	ScimConfig cloudflare.AccessIdentityProviderScimConfiguration
}

type AccessIdentityProviderResult struct {
	ID   string
	Name string
	Type string
}

type AccessInfrastructureTargetContextParams struct {
	TargetAttributes map[string][]string
	Port             int
	Protocol         string
}

type AccessLandingPageDesignParams struct {
	Title           string
	Message         string
	ImageURL        string
	ButtonColor     string
	ButtonTextColor string
}

type AccessPolicyParams struct {
	ApplicationID    string                  // Required: The Application ID this policy belongs to
	Name             string                  // Policy name
	Decision         string                  // allow, deny, bypass, non_identity
	Precedence       int                     // Order of evaluation (lower = higher priority)
	Include          []AccessGroupRuleParams // Include rules (e.g., group references)
	Exclude          []AccessGroupRuleParams // Exclude rules
	Require          []AccessGroupRuleParams // Require rules
	SessionDuration  *string                 // Optional session duration override
	ReusablePolicyID string                  // Optional: Reference to a reusable policy (instead of inline rules)
}

type AccessPolicyResult struct {
	ID               string
	Name             string
	Decision         string
	Precedence       int
	ReusablePolicyID *string // Set if this policy references a reusable policy
}

type AccessServiceTokenResult struct {
	ID                  string
	TokenID             string
	Name                string
	ClientID            string
	ClientSecret        string
	AccountID           string
	ExpiresAt           string
	CreatedAt           string
	UpdatedAt           string
	LastSeenAt          string
	ClientSecretVersion int64
}

type ActivityLogSettings struct {
	Enabled bool
}

type AntiVirusSettings struct {
	EnabledDownloadPhase bool
	EnabledUploadPhase   bool
	FailClosed           bool
	NotificationSettings *NotificationSettings
}

type BlockPageSettings struct {
	Enabled         bool
	Name            string
	FooterText      string
	HeaderText      string
	LogoPath        string
	BackgroundColor string
	MailtoAddress   string
	MailtoSubject   string
	SuppressFooter  *bool
}

type BodyScanningSettings struct {
	InspectionMode string
}

type BrowserIsolationSettings struct {
	URLBrowserIsolationEnabled bool
	NonIdentityEnabled         bool
}

type ClientConfig struct {
	Log         logr.Logger
	APIToken    string
	APIKey      string
	Email       string
	AccountID   string
	AccountName string
	Domain      string
	TunnelID    string
	TunnelName  string
}

type ClientFactory interface {
	// NewClient creates a new CloudflareClient with the given configuration.
	NewClient(config ClientConfig) (CloudflareClient, error)
}

type CloudflareClient interface {
	// Tunnel operations
	CreateTunnel(ctx context.Context) (string, string, error)
	DeleteTunnel(ctx context.Context) error
	ValidateAll(ctx context.Context) error
	GetAccountId(ctx context.Context) (string, error)
	GetTunnelId(ctx context.Context) (string, error)
	GetTunnelCreds(ctx context.Context, tunnelSecret string) (string, error)
	GetZoneId(ctx context.Context) (string, error)

	// DNS operations (api.go - CNAME/TXT for tunnels)
	InsertOrUpdateCName(ctx context.Context, fqdn, dnsID string) (string, error)
	DeleteDNSId(ctx context.Context, fqdn, dnsID string, created bool) error
	GetDNSCNameId(ctx context.Context, fqdn string) (string, error)
	GetManagedDnsTxt(ctx context.Context, fqdn string) (string, DnsManagedRecordTxt, bool, error)
	InsertOrUpdateTXT(ctx context.Context, fqdn, txtID, dnsID string) error

	// DNS operations (dns.go - Generic DNS records)
	CreateDNSRecord(ctx context.Context, params DNSRecordParams) (*DNSRecordResult, error)
	GetDNSRecord(ctx context.Context, zoneID, recordID string) (*DNSRecordResult, error)
	UpdateDNSRecord(ctx context.Context, zoneID, recordID string, params DNSRecordParams) (*DNSRecordResult, error)
	DeleteDNSRecord(ctx context.Context, zoneID, recordID string) error

	// Virtual Network operations
	CreateVirtualNetwork(ctx context.Context, params VirtualNetworkParams) (*VirtualNetworkResult, error)
	GetVirtualNetwork(ctx context.Context, virtualNetworkID string) (*VirtualNetworkResult, error)
	GetVirtualNetworkByName(ctx context.Context, name string) (*VirtualNetworkResult, error)
	UpdateVirtualNetwork(ctx context.Context, virtualNetworkID string, params VirtualNetworkParams) (*VirtualNetworkResult, error)
	DeleteVirtualNetwork(ctx context.Context, virtualNetworkID string) error

	// Tunnel Route operations
	CreateTunnelRoute(ctx context.Context, params TunnelRouteParams) (*TunnelRouteResult, error)
	GetTunnelRoute(ctx context.Context, network, virtualNetworkID string) (*TunnelRouteResult, error)
	UpdateTunnelRoute(ctx context.Context, network string, params TunnelRouteParams) (*TunnelRouteResult, error)
	DeleteTunnelRoute(ctx context.Context, network, virtualNetworkID string) error

	// Access Application operations
	CreateAccessApplication(ctx context.Context, params AccessApplicationParams) (*AccessApplicationResult, error)
	GetAccessApplication(ctx context.Context, applicationID string) (*AccessApplicationResult, error)
	UpdateAccessApplication(ctx context.Context, applicationID string, params AccessApplicationParams) (*AccessApplicationResult, error)
	DeleteAccessApplication(ctx context.Context, applicationID string) error
	ListAccessApplicationsByName(ctx context.Context, name string) (*AccessApplicationResult, error)

	// Access Policy operations
	CreateAccessPolicy(ctx context.Context, params AccessPolicyParams) (*AccessPolicyResult, error)
	GetAccessPolicy(ctx context.Context, applicationID, policyID string) (*AccessPolicyResult, error)
	UpdateAccessPolicy(ctx context.Context, policyID string, params AccessPolicyParams) (*AccessPolicyResult, error)
	DeleteAccessPolicy(ctx context.Context, applicationID, policyID string) error
	ListAccessPolicies(ctx context.Context, applicationID string) ([]AccessPolicyResult, error)

	// Access Group operations
	CreateAccessGroup(ctx context.Context, params AccessGroupParams) (*AccessGroupResult, error)
	GetAccessGroup(ctx context.Context, groupID string) (*AccessGroupResult, error)
	UpdateAccessGroup(ctx context.Context, groupID string, params AccessGroupParams) (*AccessGroupResult, error)
	DeleteAccessGroup(ctx context.Context, groupID string) error
	ListAccessGroupsByName(ctx context.Context, name string) (*AccessGroupResult, error)

	// Access Identity Provider operations
	CreateAccessIdentityProvider(ctx context.Context, params AccessIdentityProviderParams) (*AccessIdentityProviderResult, error)
	GetAccessIdentityProvider(ctx context.Context, idpID string) (*AccessIdentityProviderResult, error)
	UpdateAccessIdentityProvider(ctx context.Context, idpID string, params AccessIdentityProviderParams) (*AccessIdentityProviderResult, error)
	DeleteAccessIdentityProvider(ctx context.Context, idpID string) error
	ListAccessIdentityProvidersByName(ctx context.Context, name string) (*AccessIdentityProviderResult, error)

	// Access Service Token operations
	GetAccessServiceTokenByName(ctx context.Context, name string) (*AccessServiceTokenResult, error)
	CreateAccessServiceToken(ctx context.Context, name string, duration string) (*AccessServiceTokenResult, error)
	UpdateAccessServiceToken(ctx context.Context, tokenID string, name string, duration string) (*AccessServiceTokenResult, error)
	RefreshAccessServiceToken(ctx context.Context, tokenID string) (*AccessServiceTokenResult, error)
	DeleteAccessServiceToken(ctx context.Context, tokenID string) error

	// Device Posture Rule operations
	CreateDevicePostureRule(ctx context.Context, params DevicePostureRuleParams) (*DevicePostureRuleResult, error)
	GetDevicePostureRule(ctx context.Context, ruleID string) (*DevicePostureRuleResult, error)
	UpdateDevicePostureRule(ctx context.Context, ruleID string, params DevicePostureRuleParams) (*DevicePostureRuleResult, error)
	DeleteDevicePostureRule(ctx context.Context, ruleID string) error
	ListDevicePostureRulesByName(ctx context.Context, name string) (*DevicePostureRuleResult, error)

	// Gateway Rule operations
	CreateGatewayRule(ctx context.Context, params GatewayRuleParams) (*GatewayRuleResult, error)
	GetGatewayRule(ctx context.Context, ruleID string) (*GatewayRuleResult, error)
	UpdateGatewayRule(ctx context.Context, ruleID string, params GatewayRuleParams) (*GatewayRuleResult, error)
	DeleteGatewayRule(ctx context.Context, ruleID string) error
	ListGatewayRulesByName(ctx context.Context, name string) (*GatewayRuleResult, error)

	// Gateway List operations
	CreateGatewayList(ctx context.Context, params GatewayListParams) (*GatewayListResult, error)
	GetGatewayList(ctx context.Context, listID string) (*GatewayListResult, error)
	UpdateGatewayList(ctx context.Context, listID string, params GatewayListParams) (*GatewayListResult, error)
	DeleteGatewayList(ctx context.Context, listID string) error
	ListGatewayListsByName(ctx context.Context, name string) (*GatewayListResult, error)

	// Split Tunnel operations
	GetSplitTunnelExclude(ctx context.Context) ([]SplitTunnelEntry, error)
	UpdateSplitTunnelExclude(ctx context.Context, entries []SplitTunnelEntry) error
	GetSplitTunnelInclude(ctx context.Context) ([]SplitTunnelEntry, error)
	UpdateSplitTunnelInclude(ctx context.Context, entries []SplitTunnelEntry) error

	// Fallback Domain operations
	GetFallbackDomains(ctx context.Context) ([]FallbackDomainEntry, error)
	UpdateFallbackDomains(ctx context.Context, entries []FallbackDomainEntry) error

	// WARP Connector operations
	CreateWARPConnector(ctx context.Context, name string) (*WARPConnectorResult, error)
	GetWARPConnectorToken(ctx context.Context, connectorID string) (*WARPConnectorTokenResult, error)
	DeleteWARPConnector(ctx context.Context, connectorID string) error

	// Gateway Configuration operations
	UpdateGatewayConfiguration(ctx context.Context, params GatewayConfigurationParams) (*GatewayConfigurationResult, error)

	// Pages Project operations
	CreatePagesProject(ctx context.Context, params PagesProjectParams) (*PagesProjectResult, error)
	GetPagesProject(ctx context.Context, projectName string) (*PagesProjectResult, error)
	UpdatePagesProject(ctx context.Context, projectName string, params PagesProjectParams) (*PagesProjectResult, error)
	DeletePagesProject(ctx context.Context, projectName string) error
	ListPagesProjects(ctx context.Context) ([]PagesProjectResult, error)
	PurgePagesProjectBuildCache(ctx context.Context, projectName string) error

	// Pages Domain operations
	AddPagesDomain(ctx context.Context, projectName, domain string) (*PagesDomainResult, error)
	GetPagesDomain(ctx context.Context, projectName, domain string) (*PagesDomainResult, error)
	DeletePagesDomain(ctx context.Context, projectName, domain string) error
	PatchPagesDomain(ctx context.Context, projectName, domain string) (*PagesDomainResult, error)
	ListPagesDomains(ctx context.Context, projectName string) ([]PagesDomainResult, error)

	// Pages Deployment operations
	CreatePagesDeployment(ctx context.Context, projectName, branch string) (*PagesDeploymentResult, error)
	GetPagesDeployment(ctx context.Context, projectName, deploymentID string) (*PagesDeploymentResult, error)
	DeletePagesDeployment(ctx context.Context, projectName, deploymentID string) error
	ListPagesDeployments(ctx context.Context, projectName string) ([]PagesDeploymentResult, error)
	RetryPagesDeployment(ctx context.Context, projectName, deploymentID string) (*PagesDeploymentResult, error)
	RollbackPagesDeployment(ctx context.Context, projectName, deploymentID string) (*PagesDeploymentResult, error)
	GetPagesDeploymentLogs(ctx context.Context, projectName, deploymentID string) (*PagesDeploymentLogsResult, error)
}

type Configuration struct {
	TunnelID      string                   `yaml:"tunnel" json:"tunnel"`
	Ingress       []UnvalidatedIngressRule `yaml:"ingress,omitempty" json:"ingress,omitempty"`
	WarpRouting   WarpRoutingConfig        `yaml:"warp-routing,omitempty" json:"warp-routing,omitempty"`
	OriginRequest OriginRequestConfig      `yaml:"originRequest,omitempty" json:"originRequest,omitempty"`
	SourceFile    string                   `yaml:"credentials-file" json:"credentials-file"`
	Metrics       string                   `yaml:"metrics,omitempty" json:"metrics,omitempty"`
	NoAutoUpdate  bool                     `yaml:"no-autoupdate,omitempty" json:"no-autoupdate,omitempty"`
}

type CustomCertificateSettings struct {
	Enabled bool
	ID      string
}

type DNSRecordDataParams struct {
	// For SRV records
	Service string
	Proto   string
	Weight  int
	Port    int
	Target  string

	// For CAA records
	Flags int
	Tag   string
	Value string

	// For CERT/SSHFP/TLSA records
	Algorithm    int
	Certificate  string
	KeyTag       int
	Usage        int
	Selector     int
	MatchingType int

	// For LOC records
	LatDegrees    int
	LatMinutes    int
	LatSeconds    string
	LatDirection  string
	LongDegrees   int
	LongMinutes   int
	LongSeconds   string
	LongDirection string
	Altitude      string
	Size          string
	PrecisionHorz string
	PrecisionVert string

	// For URI records
	ContentURI string
}

type DNSRecordParams struct {
	Name     string
	Type     string
	Content  string
	TTL      int
	Proxied  bool
	Priority *int
	Comment  string
	Tags     []string
	Data     *DNSRecordDataParams
}

type DNSRecordResult struct {
	ID      string
	ZoneID  string
	Name    string
	Type    string
	Content string
	TTL     int
	Proxied bool
}

type DefaultClientFactory struct{}

type DevicePostureInputParams struct {
	ID               string
	Path             string
	Exists           *bool
	Sha256           string
	Thumbprint       string
	Running          *bool
	RequireAll       *bool
	Enabled          *bool
	Version          string
	Operator         string
	Domain           string
	ComplianceStatus string
	ConnectionID     string
	LastSeen         string
	EidLastSeen      string
	ActiveThreats    *int
	Infected         *bool
	IsActive         *bool
	NetworkStatus    string
	SensorConfig     string
	VersionOperator  string
	CountOperator    string
	ScoreOperator    string
	IssueCount       *int
	Score            *int
	TotalScore       *int
	RiskLevel        string
	Overall          string
	State            string
	OperationalState string
	OSDistroName     string
	OSDistroRevision string
	OSVersionExtra   string
	OS               string
	OperatingSystem  string
	CertificateID    string
	CommonName       string
	Cn               string
	CheckPrivateKey  *bool
	ExtendedKeyUsage []string
	Locations        []DevicePostureLocationParams
	CheckDisks       []string
}

type DevicePostureLocationParams struct {
	Paths       []string
	TrustStores []string
}

type DevicePostureMatchParams struct {
	Platform string
}

type DevicePostureRuleParams struct {
	Name        string
	Type        string
	Description string
	Schedule    string
	Expiration  string
	Match       []DevicePostureMatchParams
	Input       *DevicePostureInputParams
}

type DevicePostureRuleResult struct {
	ID          string
	Name        string
	Type        string
	Description string
	AccountID   string
}

type DnsManagedRecordTxt struct {
	DnsId      string // DnsId of the managed record
	TunnelName string // TunnelName of the managed record
	TunnelId   string // TunnelId of the managed record
}

type FIPSSettings struct {
	TLS bool
}

type FallbackDomainEntry struct {
	Suffix      string   `json:"suffix"`
	Description string   `json:"description,omitempty"`
	DNSServer   []string `json:"dns_server,omitempty"`
}

type GatewayAuditSSHParams struct {
	CommandLogging bool
}

type GatewayBISOAdminControlsParams struct {
	DisablePrinting             *bool
	DisableCopyPaste            *bool
	DisableDownload             *bool
	DisableUpload               *bool
	DisableKeyboard             *bool
	DisableClipboardRedirection *bool
}

type GatewayCheckSessionParams struct {
	Enforce  bool
	Duration string
}

type GatewayConfigurationParams struct {
	TLSDecrypt        *TLSDecryptSettings
	ActivityLog       *ActivityLogSettings
	AntiVirus         *AntiVirusSettings
	BlockPage         *BlockPageSettings
	BodyScanning      *BodyScanningSettings
	BrowserIsolation  *BrowserIsolationSettings
	FIPS              *FIPSSettings
	ProtocolDetection *ProtocolDetectionSettings
	CustomCertificate *CustomCertificateSettings
}

type GatewayConfigurationResult struct {
	AccountID string
}

type GatewayDNSResolverEntryParams struct {
	IP                         string
	Port                       int
	VNetID                     string
	RouteThroughPrivateNetwork *bool
}

type GatewayDNSResolversParams struct {
	IPv4 []GatewayDNSResolverEntryParams
	IPv6 []GatewayDNSResolverEntryParams
}

type GatewayEgressParams struct {
	IPv4         string
	IPv6         string
	IPv4Fallback string
}

type GatewayL4OverrideParams struct {
	IP   string
	Port int
}

type GatewayListItem struct {
	Value       string
	Description string
}

type GatewayListParams struct {
	Name        string
	Description string
	Type        string // SERIAL, URL, DOMAIN, EMAIL, IP
	Items       []GatewayListItem
}

type GatewayListResult struct {
	ID          string
	Name        string
	Description string
	Type        string
	Count       int
	AccountID   string
}

type GatewayNotificationSettingsParams struct {
	Enabled    bool
	Message    string
	SupportURL string
}

type GatewayPayloadLogParams struct {
	Enabled bool
}

type GatewayQuarantineParams struct {
	FileTypes []string
}

type GatewayResolveDNSInternallyParams struct {
	ViewID   string
	Fallback string // "none", "public_dns", etc.
}

type GatewayRuleExpirationParams struct {
	ExpiresAt string
	Duration  string
}

type GatewayRuleParams struct {
	Name          string
	Description   string
	Precedence    int
	Enabled       bool
	Action        string
	Filters       []cloudflare.TeamsFilterType
	Traffic       string
	Identity      string
	DevicePosture string
	RuleSettings  *GatewayRuleSettingsParams
	Schedule      *GatewayRuleScheduleParams
	Expiration    *GatewayRuleExpirationParams
}

type GatewayRuleResult struct {
	ID          string
	Name        string
	Description string
	Precedence  int
	Enabled     bool
	Action      string
}

type GatewayRuleScheduleParams struct {
	TimeZone string
	Mon      string
	Tue      string
	Wed      string
	Thu      string
	Fri      string
	Sat      string
	Sun      string
}

type GatewayRuleSettingsParams struct {
	BlockPageEnabled                *bool
	BlockReason                     string
	OverrideIPs                     []string
	OverrideHost                    string
	L4Override                      *GatewayL4OverrideParams
	BISOAdminControls               *GatewayBISOAdminControlsParams
	CheckSession                    *GatewayCheckSessionParams
	AddHeaders                      map[string]string
	InsecureDisableDNSSECValidation *bool
	Egress                          *GatewayEgressParams
	PayloadLog                      *GatewayPayloadLogParams
	UntrustedCertAction             string
	AuditSSH                        *GatewayAuditSSHParams
	ResolveDNSInternally            *GatewayResolveDNSInternallyParams
	ResolveDNSThroughCloudflare     *bool
	DNSResolvers                    *GatewayDNSResolversParams
	NotificationSettings            *GatewayNotificationSettingsParams
	AllowChildBypass                *bool
	BypassParentRule                *bool
	IgnoreCNAMECategoryMatches      *bool
	IPCategories                    *bool
	IPIndicatorFeeds                *bool
	Quarantine                      *GatewayQuarantineParams
}

type HybridAndImplicitOptionsParams struct {
	ReturnIDTokenFromAuthorizationEndpoint     *bool
	ReturnAccessTokenFromAuthorizationEndpoint *bool
}

type IngressIPRule struct {
	Prefix *string `yaml:"prefix,omitempty" json:"prefix,omitempty"`
	Ports  []int   `yaml:"ports,omitempty" json:"ports,omitempty"`
	Allow  bool    `yaml:"allow,omitempty" json:"allow,omitempty"`
}

type MergeOptions struct {
	// Source identifies the controller/source of this configuration fragment.
	// Used for logging and debugging. Examples: "TunnelBinding/default/my-binding",
	// "Ingress/default/my-ingress", "Gateway/default/my-gateway", "Tunnel/my-tunnel"
	Source string

	// PreviousHostnames contains the hostnames that were previously synced by this source.
	// These will be removed from the remote configuration before adding CurrentRules.
	// This allows proper cleanup when a source's rules change.
	PreviousHostnames []string

	// CurrentRules contains the ingress rules to add to the configuration.
	// These rules will be merged with existing rules from other sources.
	// The last rule should be the catch-all rule (empty hostname with service).
	CurrentRules []UnvalidatedIngressRule

	// WarpRouting controls WARP routing state.
	// - nil: preserve existing warp-routing state (default)
	// - &WarpRoutingConfig{Enabled: true}: explicitly enable warp-routing
	// - &WarpRoutingConfig{Enabled: false}: explicitly disable warp-routing
	WarpRouting *WarpRoutingConfig

	// FallbackTarget is the service URL for the catch-all rule (e.g., "http_status:404").
	// - "": preserve existing fallback target
	// - non-empty: set/override the fallback target
	FallbackTarget string

	// GlobalOriginRequest is the global origin request configuration.
	// - nil: preserve existing global origin request config
	// - non-nil: set/override the global origin request config
	GlobalOriginRequest *OriginRequestConfig
}

type MergeSyncResult struct {
	// Version is the new configuration version after update.
	Version int `json:"version"`

	// SyncedHostnames contains all hostnames that were synced by this operation.
	// Controllers should store this in their Status for tracking.
	SyncedHostnames []string `json:"syncedHostnames"`
}

type MinifySettings struct {
	HTML bool `json:"html"`
	CSS  bool `json:"css"`
	JS   bool `json:"js"`
}

type NotificationSettings struct {
	Enabled    bool
	Message    string
	SupportURL string
}

type OIDCClaimConfigParams struct {
	Name     string
	Source   OIDCClaimSourceParams
	Required bool
	Scope    string
}

type OIDCClaimSourceParams struct {
	Name      string
	NameByIDP map[string]string
}

type OriginCACertificateParams struct {
	Hostnames       []string
	RequestType     string // "origin-rsa" or "origin-ecc"
	RequestValidity int    // days: 7, 30, 90, 365, 730, 1095, 5475
	CSR             string
}

type OriginCACertificateResult struct {
	ID          string
	Certificate string
	Hostnames   []string
	ExpiresOn   time.Time
	RequestType string
	CSR         string
}

type OriginRequestConfig struct {
	// HTTP proxy timeout for establishing a new connection
	ConnectTimeout *time.Duration `yaml:"connectTimeout,omitempty" json:"connectTimeout,omitempty"`
	// HTTP proxy timeout for completing a TLS handshake
	TLSTimeout *time.Duration `yaml:"tlsTimeout,omitempty" json:"tlsTimeout,omitempty"`
	// HTTP proxy TCP keepalive duration
	TCPKeepAlive *time.Duration `yaml:"tcpKeepAlive,omitempty" json:"tcpKeepAlive,omitempty"`
	// HTTP proxy should disable "happy eyeballs" for IPv4/v6 fallback
	NoHappyEyeballs *bool `yaml:"noHappyEyeballs,omitempty" json:"noHappyEyeballs,omitempty"`
	// HTTP proxy maximum keepalive connection pool size
	KeepAliveConnections *int `yaml:"keepAliveConnections,omitempty" json:"keepAliveConnections,omitempty"`
	// HTTP proxy timeout for closing an idle connection
	KeepAliveTimeout *time.Duration `yaml:"keepAliveTimeout,omitempty" json:"keepAliveTimeout,omitempty"`
	// Sets the HTTP Host header for the local webserver.
	HTTPHostHeader *string `yaml:"httpHostHeader,omitempty" json:"httpHostHeader,omitempty"`
	// Hostname on the origin server certificate.
	OriginServerName *string `yaml:"originServerName,omitempty" json:"originServerName,omitempty"`
	// Path to the CA for the certificate of your origin.
	// This option should be used only if your certificate is not signed by Cloudflare.
	CAPool *string `yaml:"caPool,omitempty" json:"caPool,omitempty"`
	// Disables TLS verification of the certificate presented by your origin.
	// Will allow any certificate from the origin to be accepted.
	// Note: The connection from your machine to Cloudflare's Edge is still encrypted.
	NoTLSVerify *bool `yaml:"noTLSVerify,omitempty" json:"noTLSVerify,omitempty"`
	// Attempt to connect to origin using HTTP2. Origin must be configured as https.
	HTTP2Origin *bool `yaml:"http2Origin,omitempty" json:"http2Origin,omitempty"`
	// Disables chunked transfer encoding.
	// Useful if you are running a WSGI server.
	DisableChunkedEncoding *bool `yaml:"disableChunkedEncoding,omitempty" json:"disableChunkedEncoding,omitempty"`
	// Runs as jump host
	BastionMode *bool `yaml:"bastionMode,omitempty" json:"bastionMode,omitempty"`
	// Listen address for the proxy.
	ProxyAddress *string `yaml:"proxyAddress,omitempty" json:"proxyAddress,omitempty"`
	// Listen port for the proxy.
	ProxyPort *uint `yaml:"proxyPort,omitempty" json:"proxyPort,omitempty"`
	// Valid options are 'socks' or empty.
	ProxyType *string `yaml:"proxyType,omitempty" json:"proxyType,omitempty"`
	// IP rules for the proxy service
	IPRules []IngressIPRule `yaml:"ipRules,omitempty" json:"ipRules,omitempty"`
}

type PagesBuildConfig struct {
	BuildCommand      string
	DestinationDir    string
	RootDir           string
	BuildCaching      *bool
	WebAnalyticsTag   string
	WebAnalyticsToken string
}

type PagesDeploymentConfigs struct {
	Preview    *PagesDeploymentEnvConfig
	Production *PagesDeploymentEnvConfig
}

type PagesDeploymentEnvConfig struct {
	EnvironmentVariables    map[string]PagesEnvVar
	CompatibilityDate       string
	CompatibilityFlags      []string
	D1Bindings              map[string]string // name -> databaseID
	KVBindings              map[string]string // name -> namespaceID
	R2Bindings              map[string]string // name -> bucketName
	ServiceBindings         map[string]PagesServiceBindingConfig
	DurableObjectBindings   map[string]PagesDurableObjectBindingConfig
	QueueBindings           map[string]string // name -> queueName
	AIBindings              []string          // binding names
	VectorizeBindings       map[string]string // name -> indexName
	HyperdriveBindings      map[string]string // name -> configID
	MTLSCertificates        map[string]string // name -> certificateID
	BrowserBinding          string            // binding name
	PlacementMode           string
	UsageModel              string
	FailOpen                *bool
	AlwaysUseLatestCompDate *bool
}

type PagesDeploymentLogEntry struct {
	Timestamp time.Time
	Message   string
}

type PagesDeploymentLogsResult struct {
	Total            int
	IncludesContents bool
	Data             []PagesDeploymentLogEntry
}

type PagesDeploymentResult struct {
	ID               string
	ShortID          string
	ProjectID        string
	ProjectName      string
	Environment      string
	URL              string
	ProductionBranch string
	CreatedOn        time.Time
	ModifiedOn       time.Time
	Stage            string
	StageStatus      string
	Stages           []PagesDeploymentStage
}

type PagesDeploymentStage struct {
	Name      string
	StartedOn string
	EndedOn   string
	Status    string
}

type PagesDomainResult struct {
	ID               string
	Name             string
	Status           string
	ZoneTag          string
	ValidationMethod string
	ValidationStatus string
	CreatedOn        time.Time
}

type PagesDurableObjectBindingConfig struct {
	ClassName       string
	ScriptName      string
	EnvironmentName string
}

type PagesEnvVar struct {
	Value string
	Type  string // "plain_text" or "secret_text"
}

type PagesGitHubConfig struct {
	Owner                        string
	Repo                         string
	ProductionDeploymentsEnabled *bool
	PreviewDeploymentsEnabled    *bool
	PRCommentsEnabled            *bool
	DeploymentsEnabled           *bool
}

type PagesGitLabConfig struct {
	Owner                        string
	Repo                         string
	ProductionDeploymentsEnabled *bool
	PreviewDeploymentsEnabled    *bool
	DeploymentsEnabled           *bool
}

type PagesProjectParams struct {
	Name             string
	ProductionBranch string
	Source           *PagesSourceConfig
	BuildConfig      *PagesBuildConfig
	DeploymentConfig *PagesDeploymentConfigs
}

type PagesProjectResult struct {
	ID               string
	Name             string
	Subdomain        string
	Domains          []string
	ProductionBranch string
	CreatedOn        time.Time
	Source           *PagesSourceConfig
	BuildConfig      *PagesBuildConfig
	LatestDeployment *PagesDeploymentResult
}

type PagesServiceBindingConfig struct {
	Service     string
	Environment string
}

type PagesSourceConfig struct {
	Type   string
	GitHub *PagesGitHubConfig
	GitLab *PagesGitLabConfig
}

type ProtocolDetectionSettings struct {
	Enabled bool
}

type Queue struct {
	ID         string `json:"queue_id"`
	Name       string `json:"queue_name"`
	CreatedOn  string `json:"created_on,omitempty"`
	ModifiedOn string `json:"modified_on,omitempty"`
}

type R2BucketParams struct {
	Name         string
	LocationHint string
}

type R2BucketResult struct {
	Name         string
	Location     string
	CreationDate time.Time
}

type R2CORSRule struct {
	ID             string   `json:"id,omitempty"`
	AllowedOrigins []string `json:"allowedOrigins"`
	AllowedMethods []string `json:"allowedMethods"`
	AllowedHeaders []string `json:"allowedHeaders,omitempty"`
	ExposeHeaders  []string `json:"exposeHeaders,omitempty"`
	MaxAgeSeconds  *int     `json:"maxAgeSeconds,omitempty"`
}

type R2CustomDomain struct {
	Domain   string         `json:"domain"`
	Enabled  bool           `json:"enabled"`
	Status   R2DomainStatus `json:"status"`
	MinTLS   string         `json:"minTLS,omitempty"`
	ZoneID   string         `json:"zoneId,omitempty"`
	ZoneName string         `json:"zoneName,omitempty"`
}

type R2CustomDomainParams struct {
	Domain  string `json:"domain"`
	ZoneID  string `json:"zoneId,omitempty"`
	MinTLS  string `json:"minTLS,omitempty"`
	Enabled bool   `json:"enabled"`
}

type R2DomainStatus struct {
	Ownership string `json:"ownership,omitempty"`
	SSL       string `json:"ssl,omitempty"`
}

type R2LifecycleAbortUpload struct {
	DaysAfterInitiation int `json:"daysAfterInitiation"`
}

type R2LifecycleExpiration struct {
	Days *int   `json:"days,omitempty"`
	Date string `json:"date,omitempty"`
}

type R2LifecycleRule struct {
	ID                             string                  `json:"id"`
	Enabled                        bool                    `json:"enabled"`
	Prefix                         string                  `json:"prefix,omitempty"`
	Expiration                     *R2LifecycleExpiration  `json:"expiration,omitempty"`
	AbortIncompleteMultipartUpload *R2LifecycleAbortUpload `json:"abortIncompleteMultipartUpload,omitempty"`
}

type R2NotificationRule struct {
	RuleID      string   `json:"ruleId,omitempty"`
	Prefix      string   `json:"prefix,omitempty"`
	Suffix      string   `json:"suffix,omitempty"`
	EventTypes  []string `json:"eventType"`
	Description string   `json:"description,omitempty"`
}

type RefreshTokenOptionsParams struct {
	Lifetime string
}

type RegistrantContactInfo struct {
	ID           string
	FirstName    string
	LastName     string
	Organization string
	Address      string
	Address2     string
	City         string
	State        string
	Zip          string
	Country      string
	Phone        string
	Email        string
	Fax          string
}

type RegistrarDomainConfig struct {
	NameServers []string
	Privacy     bool
	Locked      bool
	AutoRenew   bool
}

type RegistrarDomainInfo struct {
	ID                string
	Available         bool
	SupportedTLD      bool
	CanRegister       bool
	CurrentRegistrar  string
	ExpiresAt         time.Time
	CreatedAt         time.Time
	UpdatedAt         time.Time
	RegistryStatuses  string
	Locked            bool
	TransferInStatus  string // Combined transfer status
	CanCancelTransfer bool
	RegistrantContact *RegistrantContactInfo
}

type RetryConfig struct {
	// BaseDelay is the initial delay before retry
	BaseDelay time.Duration
	// MaxDelay is the maximum delay between retries
	MaxDelay time.Duration
	// MaxRetries is the maximum number of retries (0 = no limit)
	MaxRetries int
	// RetryCount tracks the current retry count (for exponential backoff)
	RetryCount int
}

type ReusableAccessPolicyParams struct {
	Name                         string
	Decision                     string // allow, deny, bypass, non_identity
	Precedence                   int
	Include                      []AccessGroupRuleParams
	Exclude                      []AccessGroupRuleParams
	Require                      []AccessGroupRuleParams
	SessionDuration              *string
	IsolationRequired            *bool
	PurposeJustificationRequired *bool
	PurposeJustificationPrompt   string
	ApprovalRequired             *bool
	ApprovalGroups               []AccessApprovalGroupParams
}

type ReusableAccessPolicyResult struct {
	ID         string
	Name       string
	Decision   string
	Precedence int
}

type RulesetResult struct {
	ID          string
	Name        string
	Description string
	Kind        string
	Phase       string
	Version     string
	LastUpdated time.Time
	Rules       []cloudflare.RulesetRule
}

type SAMLAttributeConfigParams struct {
	Name         string
	NameFormat   string
	Source       SAMLAttributeSourceParams
	FriendlyName string
	Required     bool
}

type SAMLAttributeSourceParams struct {
	Name      string
	NameByIDP map[string]string
}

type SCIMAuthenticationParams struct {
	Scheme           string // httpbasic, oauthbearertoken, oauth2
	User             string
	Password         string
	Token            string
	ClientID         string
	ClientSecret     string
	AuthorizationURL string
	TokenURL         string
	Scopes           []string
}

type SCIMMappingOperationsParams struct {
	Create *bool
	Update *bool
	Delete *bool
}

type SCIMMappingParams struct {
	Schema           string
	Enabled          *bool
	Filter           string
	TransformJsonata string
	Operations       *SCIMMappingOperationsParams
	Strictness       string
}

type SaasApplicationParams struct {
	AuthType                      string // saml, oidc
	ConsumerServiceURL            string
	SPEntityID                    string
	NameIDFormat                  string
	DefaultRelayState             string
	CustomAttributes              []SAMLAttributeConfigParams
	NameIDTransformJsonata        string
	SamlAttributeTransformJsonata string
	RedirectURIs                  []string
	GrantTypes                    []string
	Scopes                        []string
	AppLauncherURL                string
	GroupFilterRegex              string
	CustomClaims                  []OIDCClaimConfigParams
	AllowPKCEWithoutClientSecret  *bool
	AccessTokenLifetime           string
	RefreshTokenOptions           *RefreshTokenOptionsParams
	HybridAndImplicitOptions      *HybridAndImplicitOptionsParams
}

type SplitTunnelEntry struct {
	Address     string `json:"address,omitempty"`
	Host        string `json:"host,omitempty"`
	Description string `json:"description,omitempty"`
}

type TLSDecryptSettings struct {
	Enabled bool
}

type TunnelConfigurationResult = cloudflare.TunnelConfigurationResult

type TunnelCreateResult struct {
	ID          string
	Name        string
	Credentials *TunnelCredentialsFile
}

type TunnelCredentialsFile struct {
	AccountTag   string `json:"AccountTag"`
	TunnelID     string `json:"TunnelID"`
	TunnelName   string `json:"TunnelName"`
	TunnelSecret string `json:"TunnelSecret"`
}

type TunnelRouteParams struct {
	Network          string // CIDR notation
	TunnelID         string
	VirtualNetworkID string
	Comment          string
}

type TunnelRouteResult struct {
	Network          string
	TunnelID         string
	TunnelName       string
	VirtualNetworkID string
	Comment          string
}

type UnvalidatedIngressRule struct {
	Hostname      string              `yaml:"hostname,omitempty" json:"hostname,omitempty"`
	Path          string              `yaml:"path,omitempty" json:"path,omitempty"`
	Service       string              `yaml:"service" json:"service"`
	OriginRequest OriginRequestConfig `yaml:"originRequest,omitempty" json:"originRequest,omitempty"`
}

type VirtualNetworkParams struct {
	Name             string
	Comment          string
	IsDefaultNetwork bool
}

type VirtualNetworkResult struct {
	ID               string
	Name             string
	Comment          string
	IsDefaultNetwork bool
	DeletedAt        *string
}

type WARPConnectorResult struct {
	ID          string
	TunnelID    string
	TunnelToken string
	Name        string
}

type WARPConnectorTokenResult struct {
	Token string
}

type WarpRoutingConfig struct {
	Enabled bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
}

type ZoneSettings struct {
	// SSL/TLS settings
	SSLMode                 string `json:"ssl,omitempty"`
	MinTLSVersion           string `json:"min_tls_version,omitempty"`
	TLS13                   string `json:"tls_1_3,omitempty"`
	AlwaysUseHTTPS          string `json:"always_use_https,omitempty"`
	AutomaticHTTPSRewrites  string `json:"automatic_https_rewrites,omitempty"`
	OpportunisticEncryption string `json:"opportunistic_encryption,omitempty"`
	TLSClientAuth           string `json:"tls_client_auth,omitempty"`

	// Cache settings
	BrowserCacheTTL int    `json:"browser_cache_ttl,omitempty"`
	DevelopmentMode string `json:"development_mode,omitempty"`
	CacheLevel      string `json:"cache_level,omitempty"`
	AlwaysOnline    string `json:"always_online,omitempty"`
	SortQueryString string `json:"sort_query_string_for_cache,omitempty"`

	// Security settings
	SecurityLevel     string `json:"security_level,omitempty"`
	BrowserCheck      string `json:"browser_check,omitempty"`
	EmailObfuscation  string `json:"email_obfuscation,omitempty"`
	ServerSideExclude string `json:"server_side_exclude,omitempty"`
	HotlinkProtection string `json:"hotlink_protection,omitempty"`
	ChallengePassage  int    `json:"challenge_ttl,omitempty"`
	WAF               string `json:"waf,omitempty"`

	// Performance settings
	Brotli          string          `json:"brotli,omitempty"`
	HTTP2           string          `json:"http2,omitempty"`
	HTTP3           string          `json:"http3,omitempty"`
	ZeroRTT         string          `json:"0rtt,omitempty"`
	Minify          *MinifySettings `json:"minify,omitempty"`
	Polish          string          `json:"polish,omitempty"`
	WebP            string          `json:"webp,omitempty"`
	Mirage          string          `json:"mirage,omitempty"`
	EarlyHints      string          `json:"early_hints,omitempty"`
	RocketLoader    string          `json:"rocket_loader,omitempty"`
	PrefetchPreload string          `json:"prefetch_preload,omitempty"`
	IPGeolocation   string          `json:"ip_geolocation,omitempty"`
	Websockets      string          `json:"websockets,omitempty"`
}