diff --git a/.changeset/update-openapi-2d3b9ab6825d.md b/.changeset/update-openapi-2d3b9ab6825d.md
new file mode 100644
index 0000000000..1ac65a795f
--- /dev/null
+++ b/.changeset/update-openapi-2d3b9ab6825d.md
@@ -0,0 +1,6 @@
+---
+"cf": minor
+---
+
+Update the generated command surface for Forge OpenAPI release
+`2d3b9ab6825d7087ebe00a4b03c2ff219f08e4b4`.
diff --git a/packages/cli/generate.ts b/packages/cli/generate.ts
index 8d12f6ccf7..d7fb2579ec 100644
--- a/packages/cli/generate.ts
+++ b/packages/cli/generate.ts
@@ -17,7 +17,7 @@ import type { ForgeOpenApiDocument } from "./generator/openapi.js";
 
 const bundle = process.env.FORGE_OPENAPI_BUNDLE;
 // Bump this SHA to generate the commands from a new release.
-const FORGE_OPENAPI_VERSION = "acc1cbed2ca3136244a31aee12f25fc6164566cc";
+const FORGE_OPENAPI_VERSION = "2d3b9ab6825d7087ebe00a4b03c2ff219f08e4b4";
 const FORGE_OPENAPI_RELEASE = `openapi@${FORGE_OPENAPI_VERSION}`;
 const FORGE_OPENAPI_ASSET = "openapi.forge.json";
 const FORGE_OPENAPI_ASSET_URL = `https://github.com/cloudflare/forge/releases/download/${FORGE_OPENAPI_RELEASE}/${FORGE_OPENAPI_ASSET}`;
diff --git a/packages/cli/src/commands/_generated/_meta/commands.json b/packages/cli/src/commands/_generated/_meta/commands.json
index c2d91755e0..45f225083b 100644
--- a/packages/cli/src/commands/_generated/_meta/commands.json
+++ b/packages/cli/src/commands/_generated/_meta/commands.json
@@ -46067,7 +46067,7 @@
 			"httpMethod": "POST",
 			"apiPath": "/accounts/{account_id}/dns_firewall",
 			"operationId": "dns-firewall.create",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall delete",
@@ -46099,7 +46099,7 @@
 			"httpMethod": "DELETE",
 			"apiPath": "/accounts/{account_id}/dns_firewall/{dns_firewall_id}",
 			"operationId": "dns-firewall.delete",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall edit",
@@ -46203,7 +46203,7 @@
 			"httpMethod": "PATCH",
 			"apiPath": "/accounts/{account_id}/dns_firewall/{dns_firewall_id}",
 			"operationId": "dns-firewall.edit",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall get",
@@ -46235,7 +46235,7 @@
 			"httpMethod": "GET",
 			"apiPath": "/accounts/{account_id}/dns_firewall/{dns_firewall_id}",
 			"operationId": "dns-firewall.get",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall list",
@@ -46271,7 +46271,7 @@
 			"httpMethod": "GET",
 			"apiPath": "/accounts/{account_id}/dns_firewall",
 			"operationId": "dns-firewall.list",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall reverse-dns edit",
@@ -46315,7 +46315,7 @@
 			"httpMethod": "PATCH",
 			"apiPath": "/accounts/{account_id}/dns_firewall/{dns_firewall_id}/reverse_dns",
 			"operationId": "dns-firewall.reverse-dns.edit",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf dns-firewall reverse-dns get",
@@ -46347,7 +46347,7 @@
 			"httpMethod": "GET",
 			"apiPath": "/accounts/{account_id}/dns_firewall/{dns_firewall_id}/reverse_dns",
 			"operationId": "dns-firewall.reverse-dns.get",
-			"hideCommand": true
+			"hideCommand": false
 		},
 		{
 			"command": "cf docs search",
@@ -46550,6 +46550,193 @@
 			"operationId": "email-auth.spf.inspect",
 			"hideCommand": false
 		},
+		{
+			"command": "cf email-domains create",
+			"name": "create",
+			"fullPath": ["email-domains", "create"],
+			"description": "Creates a candidate and four DNS instructions. Rejects hostnames whose assigned Return-Path exceeds 201 ASCII characters. Creation follows read-only checks of the saved provider bundle and published exclusion. Hostnames inside an active full Cloudflare DNS zone return the generic hostname conflict error 2083. No per-domain provider DNS writes occur. Customer DNS observations remain pending and mail remains inactive. Unverified candidates may share a hostname. Supply an account-unique client_reference to retry the same enrollment safely; reuse with a different hostname returns error 2083. Final public-DNS, namespace protection and runtime readiness are separate gates. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope.",
+			"summary": "Create an Email Domain",
+			"usage": "cf email-domains create [options]",
+			"arguments": [],
+			"options": [
+				{
+					"name": "client-reference",
+					"type": "string",
+					"required": false,
+					"description": "Opaque reference for one customer enrollment. Reuse it with the same hostname to retry Create safely. Distinct references can enroll the same unverified hostname; a hostname alone never identifies a customer."
+				},
+				{
+					"name": "hostname",
+					"type": "string",
+					"required": true,
+					"description": "Exact external hostname to enroll. After ASCII conversion, the assigned Return-Path hostname must be at most 201 characters (191 for the current cf-bounce. prefix). Wildcards, provider-zone names, and hostnames inside an existing Cloudflare-managed DNS zone are rejected."
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				},
+				{
+					"name": "body",
+					"type": "string",
+					"required": false,
+					"description": "Raw JSON request body (bypasses individual flags)"
+				}
+			],
+			"category": "create",
+			"hasRequestBody": true,
+			"httpMethod": "POST",
+			"apiPath": "/accounts/{account_id}/email/domains",
+			"operationId": "email-domains.create",
+			"hideCommand": true
+		},
+		{
+			"command": "cf email-domains delete",
+			"name": "delete",
+			"fullPath": ["email-domains", "delete"],
+			"description": "Requires an empty body. Unclaimed unpublished candidates are purged immediately. Claimed domains persist deleting state and retain claims until the deletion worker acknowledges safe revocation and token retirement. Repeated requests while deleting are idempotent. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope.",
+			"summary": "Delete an Email Domain",
+			"usage": "cf email-domains delete <email-domain-id>",
+			"arguments": [
+				{
+					"name": "email-domain-id",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Email domain ID"
+				}
+			],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "delete",
+			"hasRequestBody": false,
+			"httpMethod": "DELETE",
+			"apiPath": "/accounts/{account_id}/email/domains/{email_domain_id}",
+			"operationId": "email-domains.delete",
+			"hideCommand": true
+		},
+		{
+			"command": "cf email-domains get",
+			"name": "get",
+			"fullPath": ["email-domains", "get"],
+			"description": "Returns domain status and its four assigned DNS records. Shared provider health is reported by the capability states rather than duplicated on each DNS record. Expired unclaimed candidates and completed deletions return 404. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope.",
+			"summary": "Get an Email Domain",
+			"usage": "cf email-domains get <email-domain-id>",
+			"arguments": [
+				{
+					"name": "email-domain-id",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Email domain ID"
+				}
+			],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/accounts/{account_id}/email/domains/{email_domain_id}",
+			"operationId": "email-domains.get",
+			"hideCommand": true
+		},
+		{
+			"command": "cf email-domains list",
+			"name": "list",
+			"fullPath": ["email-domains", "list"],
+			"description": "Returns account-scoped domain status. DNS records are omitted unless requested; exact hostname filtering may return several candidates; retain the EmailDomain ID for each enrollment. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope.",
+			"summary": "List Email Domains",
+			"usage": "cf email-domains list [options]",
+			"arguments": [],
+			"options": [
+				{
+					"name": "per-page",
+					"type": "number",
+					"required": false,
+					"description": "Per page"
+				},
+				{
+					"name": "cursor",
+					"type": "string",
+					"required": false,
+					"description": "Opaque cursor returned by the previous page. Omit it for the first page."
+				},
+				{
+					"name": "hostname",
+					"type": "string",
+					"required": false,
+					"description": "Exact hostname filter for recovering an ambiguous create response."
+				},
+				{
+					"name": "include",
+					"type": "string",
+					"required": false,
+					"description": "Include DNS instructions on each list result.",
+					"enum": ["dns_records"]
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/accounts/{account_id}/email/domains",
+			"operationId": "email-domains.list",
+			"hideCommand": true
+		},
+		{
+			"command": "cf email-domains verify",
+			"name": "verify",
+			"fullPath": ["email-domains", "verify"],
+			"description": "Requires an empty body. Schedules an expedited check and coalesces queued or leased work. It does not accept verification results, bypass activation gates, or perform customer DNS checks synchronously. Follow the Location header after Retry-After seconds until verification.observed_at appears or advances beyond the value in this 202 response; status may remain unchanged. Candidate expiry returns 404. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope.",
+			"summary": "Verify an Email Domain",
+			"usage": "cf email-domains verify <email-domain-id>",
+			"arguments": [
+				{
+					"name": "email-domain-id",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Email domain ID"
+				}
+			],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "action",
+			"hasRequestBody": false,
+			"httpMethod": "POST",
+			"apiPath": "/accounts/{account_id}/email/domains/{email_domain_id}/verify",
+			"operationId": "email-domains.verify",
+			"hideCommand": true
+		},
 		{
 			"command": "cf email-routing addresses create",
 			"name": "create",
@@ -53550,7 +53737,7 @@
 			"command": "cf flagship apps flags create",
 			"name": "create",
 			"fullPath": ["flagship", "apps", "flags", "create"],
-			"description": "Creates a flag. Returns 409 if the key already exists. `type` is always inferred from variation values; legacy request-side values are ignored.",
+			"description": "Creates a flag. Returns 409 if the key already exists. `type` is always inferred from variation values; legacy request-side values are ignored. Optional `metadata` can be attached at creation.",
 			"summary": "Create flag",
 			"usage": "cf flagship apps flags create <app-id> [options]",
 			"arguments": [
@@ -53587,6 +53774,12 @@
 					"required": true,
 					"description": "Unique identifier for the flag within an app. Used in all evaluation and SDK calls."
 				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				},
 				{
 					"name": "rules",
 					"type": "string",
@@ -53686,7 +53879,7 @@
 					"name": "context",
 					"type": "string",
 					"required": false,
-					"description": "Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries and 32 KB. Provide as a JSON object or @path/to/file.json."
+					"description": "Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries, nesting depth of 10, 10,000 values, and 32 KB. Provide as a JSON object or @path/to/file.json."
 				},
 				{
 					"name": "flag-key",
@@ -53719,7 +53912,7 @@
 			"command": "cf flagship apps flags get",
 			"name": "get",
 			"fullPath": ["flagship", "apps", "flags", "get"],
-			"description": "Returns the full flag definition including rules, variations, and audit fields.",
+			"description": "Returns the full flag definition including rules, variations, metadata, and audit fields.",
 			"summary": "Get flag",
 			"usage": "cf flagship apps flags get <flag-key> [options]",
 			"arguments": [
@@ -53795,11 +53988,79 @@
 			"operationId": "flagship.apps.flags.list",
 			"hideCommand": false
 		},
+		{
+			"command": "cf flagship apps flags patch",
+			"name": "patch",
+			"fullPath": ["flagship", "apps", "flags", "patch"],
+			"description": "Applies a partial update to lightweight flag fields: `enabled`, `description`, `metadata`, and `default_variation`. Only fields present in the request body are modified; omitted fields are preserved. `metadata: null` or an empty object clears metadata. `default_variation` must exist in the current `variations`. Structural changes to `variations` and `rules` use PUT. A changelog entry is appended when the flag content actually changes.",
+			"summary": "Partially update flag",
+			"usage": "cf flagship apps flags patch <flag-key> [options]",
+			"arguments": [
+				{
+					"name": "flag-key",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Case-sensitive key identifying the flag within the app."
+				}
+			],
+			"options": [
+				{
+					"name": "app-id",
+					"type": "string",
+					"required": true,
+					"description": "Flagship app ID returned when the app was created."
+				},
+				{
+					"name": "default-variation",
+					"type": "string",
+					"required": false,
+					"description": "Variation the API serves when the flag is off, or when it's on but no rule matches the context. Must be a key in `variations`."
+				},
+				{
+					"name": "description",
+					"type": "string",
+					"required": false,
+					"description": "Optional operator-facing description. It does not affect flag evaluation."
+				},
+				{
+					"name": "enabled",
+					"type": "boolean",
+					"required": false,
+					"description": "When false, the flag bypasses all rules and always serves `default_variation`."
+				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				},
+				{
+					"name": "body",
+					"type": "string",
+					"required": false,
+					"description": "Raw JSON request body (bypasses individual flags)"
+				}
+			],
+			"category": "update",
+			"hasRequestBody": true,
+			"httpMethod": "PATCH",
+			"apiPath": "/accounts/{account_id}/flagship/apps/{app_id}/flags/{flag_key}",
+			"operationId": "flagship.apps.flags.patch",
+			"hideCommand": false
+		},
 		{
 			"command": "cf flagship apps flags update",
 			"name": "update",
 			"fullPath": ["flagship", "apps", "flags", "update"],
-			"description": "Replaces the entire flag definition. Omitted fields are dropped, not preserved — read before writing. The path key identifies the flag and cannot be renamed by changing the body `key`. Each update appends a changelog entry.",
+			"description": "Replaces the entire flag definition. Omitted fields are cleared, not preserved — read before writing. The path key identifies the flag and cannot be renamed by changing the body `key`. A changelog entry is appended when the flag content actually changes; identical updates are no-ops.",
 			"summary": "Update flag",
 			"usage": "cf flagship apps flags update <flag-key> [options]",
 			"arguments": [
@@ -53842,6 +54103,12 @@
 					"required": true,
 					"description": "Unique identifier for the flag within an app. Used in all evaluation and SDK calls."
 				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				},
 				{
 					"name": "rules",
 					"type": "string",
@@ -58375,7 +58642,7 @@
 			],
 			"options": [
 				{
-					"name": "account-id",
+					"name": "account-id-body",
 					"type": "number",
 					"required": true,
 					"description": "The numeric account ID to create the provider for. Distinct from the\npath `account_id` parameter, which carries the account identifier\nstring used for routing.\n"
@@ -58525,6 +58792,44 @@
 			"operationId": "intel.indicator-feeds.update",
 			"hideCommand": false
 		},
+		{
+			"command": "cf intel indicator-feeds uploads get",
+			"name": "get",
+			"fullPath": ["intel", "indicator-feeds", "uploads", "get"],
+			"description": "Polls an asynchronously accepted upload. Continue polling after the recommended `poll_after_seconds` delay until status is `Unified` or `Error`. `Unified` is returned only after the durable loader finishes.",
+			"summary": "Get indicator feed upload status",
+			"usage": "cf intel indicator-feeds uploads get <upload-id> [options]",
+			"arguments": [
+				{
+					"name": "upload-id",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Upload ID"
+				}
+			],
+			"options": [
+				{
+					"name": "feed-id",
+					"type": "string",
+					"required": true,
+					"description": "Indicator feed ID"
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/accounts/{account_id}/intel/indicator-feeds/{feed_id}/uploads/{upload_id}",
+			"operationId": "intel.indicator-feeds.uploads.get",
+			"hideCommand": false
+		},
 		{
 			"command": "cf intel ip-lists get",
 			"name": "get",
@@ -59122,6 +59427,30 @@
 			"operationId": "intel.whois.get",
 			"hideCommand": false
 		},
+		{
+			"command": "cf internal submit create",
+			"name": "create",
+			"fullPath": ["internal", "submit", "create"],
+			"description": "Internal route for testing URL submissions.",
+			"summary": "Internal route for testing URL submissions",
+			"usage": "cf internal submit create",
+			"arguments": [],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "create",
+			"hasRequestBody": false,
+			"httpMethod": "POST",
+			"apiPath": "/internal/submit",
+			"operationId": "internal.submit.create",
+			"hideCommand": true
+		},
 		{
 			"command": "cf ips list",
 			"name": "list",
@@ -60242,6 +60571,30 @@
 			"operationId": "leaked-credential-checks.update",
 			"hideCommand": false
 		},
+		{
+			"command": "cf live get",
+			"name": "get",
+			"fullPath": ["live", "get"],
+			"description": "Return a success message after running liveness checks.",
+			"summary": "Run liveness checks",
+			"usage": "cf live get",
+			"arguments": [],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/live",
+			"operationId": "live.get",
+			"hideCommand": true
+		},
 		{
 			"command": "cf load-balancers account create",
 			"name": "create",
@@ -62903,176 +63256,6 @@
 			"operationId": "load-balancers.searches.list",
 			"hideCommand": false
 		},
-		{
-			"command": "cf logo-matches download get",
-			"name": "get",
-			"fullPath": ["logo-matches", "download", "get"],
-			"description": "Return matches as CSV for logo queries based on ID",
-			"summary": "Download matches for logo queries by ID",
-			"usage": "cf logo-matches download get [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "logo-id",
-					"type": "string",
-					"required": false,
-					"description": "Logo ID"
-				},
-				{
-					"name": "offset",
-					"type": "string",
-					"required": false,
-					"description": "Offset"
-				},
-				{
-					"name": "limit",
-					"type": "string",
-					"required": false,
-					"description": "Limit"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/brand-protection/logo-matches/download",
-			"operationId": "logo-matches.download.get",
-			"hideCommand": true
-		},
-		{
-			"command": "cf logo-matches get",
-			"name": "get",
-			"fullPath": ["logo-matches", "get"],
-			"description": "Return matches for logo queries based on ID",
-			"summary": "Read matches for logo queries by ID",
-			"usage": "cf logo-matches get [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "logo-id",
-					"type": "string",
-					"required": false,
-					"description": "Logo ID"
-				},
-				{
-					"name": "offset",
-					"type": "string",
-					"required": false,
-					"description": "Offset"
-				},
-				{
-					"name": "limit",
-					"type": "string",
-					"required": false,
-					"description": "Limit"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/brand-protection/logo-matches",
-			"operationId": "logo-matches.get",
-			"hideCommand": true
-		},
-		{
-			"command": "cf logos create",
-			"name": "create",
-			"fullPath": ["logos", "create"],
-			"description": "Return new saved logo queries created from image files",
-			"summary": "Create new saved logo queries from image files",
-			"usage": "cf logos create [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false,
-					"description": "Tag"
-				},
-				{
-					"name": "match-type",
-					"type": "string",
-					"required": false,
-					"description": "Match type"
-				},
-				{
-					"name": "threshold",
-					"type": "number",
-					"required": false,
-					"description": "Threshold"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				},
-				{
-					"name": "body",
-					"type": "string",
-					"required": false,
-					"description": "Raw JSON request body (bypasses individual flags)"
-				},
-				{
-					"name": "file",
-					"type": "string",
-					"required": false,
-					"description": "Path to a file to upload as the request body"
-				}
-			],
-			"category": "create",
-			"hasRequestBody": true,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/brand-protection/logos",
-			"operationId": "logos.create",
-			"hideCommand": true
-		},
-		{
-			"command": "cf logos delete",
-			"name": "delete",
-			"fullPath": ["logos", "delete"],
-			"description": "Return a success message after deleting saved logo queries by ID",
-			"summary": "Delete saved logo queries by ID",
-			"usage": "cf logos delete <logo-id>",
-			"arguments": [
-				{
-					"name": "logo-id",
-					"position": 0,
-					"type": "string",
-					"required": true,
-					"description": "Logo ID"
-				}
-			],
-			"options": [
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "delete",
-			"hasRequestBody": false,
-			"httpMethod": "DELETE",
-			"apiPath": "/accounts/{account_id}/brand-protection/logos/{logo_id}",
-			"operationId": "logos.delete",
-			"hideCommand": true
-		},
 		{
 			"command": "cf logpush account-datasets fields get",
 			"name": "get",
@@ -74905,114 +75088,6 @@
 			"operationId": "managed-transforms.update",
 			"hideCommand": true
 		},
-		{
-			"command": "cf matches download get",
-			"name": "get",
-			"fullPath": ["matches", "download", "get"],
-			"description": "Return matches as CSV for string queries based on ID",
-			"summary": "Download matches for string queries by ID",
-			"usage": "cf matches download get [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false,
-					"description": "ID"
-				},
-				{
-					"name": "offset",
-					"type": "number",
-					"required": false,
-					"description": "Offset"
-				},
-				{
-					"name": "limit",
-					"type": "number",
-					"required": false,
-					"description": "Limit"
-				},
-				{
-					"name": "include-domain-id",
-					"type": "boolean",
-					"required": false,
-					"description": "Include domain ID"
-				},
-				{
-					"name": "include-dismissed",
-					"type": "boolean",
-					"required": false,
-					"description": "Include dismissed"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/brand-protection/matches/download",
-			"operationId": "matches.download.get",
-			"hideCommand": true
-		},
-		{
-			"command": "cf matches get",
-			"name": "get",
-			"fullPath": ["matches", "get"],
-			"description": "Return matches for string queries based on ID",
-			"summary": "Read matches for string queries by ID",
-			"usage": "cf matches get [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false,
-					"description": "ID"
-				},
-				{
-					"name": "offset",
-					"type": "number",
-					"required": false,
-					"description": "Offset"
-				},
-				{
-					"name": "limit",
-					"type": "number",
-					"required": false,
-					"description": "Limit"
-				},
-				{
-					"name": "include-domain-id",
-					"type": "boolean",
-					"required": false,
-					"description": "Include domain ID"
-				},
-				{
-					"name": "include-dismissed",
-					"type": "boolean",
-					"required": false,
-					"description": "Include dismissed"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/brand-protection/matches",
-			"operationId": "matches.get",
-			"hideCommand": true
-		},
 		{
 			"command": "cf mcp portals account-tool-call-analytics",
 			"name": "account-tool-call-analytics",
@@ -87096,144 +87171,6 @@
 				}
 			]
 		},
-		{
-			"command": "cf queries bulk create",
-			"name": "create",
-			"fullPath": ["queries", "bulk", "create"],
-			"description": "Return a success message after creating new saved string queries in bulk",
-			"summary": "Create new saved string queries in bulk",
-			"usage": "cf queries bulk create [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "queries",
-					"type": "string",
-					"required": false,
-					"description": "The queries field. Provide as a JSON array of objects or @path/to/file.json."
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				},
-				{
-					"name": "body",
-					"type": "string",
-					"required": false,
-					"description": "Raw JSON request body (bypasses individual flags)"
-				}
-			],
-			"category": "create",
-			"hasRequestBody": true,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/brand-protection/queries/bulk",
-			"operationId": "queries.bulk.create",
-			"hideCommand": true
-		},
-		{
-			"command": "cf queries create",
-			"name": "create",
-			"fullPath": ["queries", "create"],
-			"description": "Return a success message after creating new saved string queries",
-			"summary": "Create new saved string queries",
-			"usage": "cf queries create [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false,
-					"description": "ID"
-				},
-				{
-					"name": "max-time",
-					"type": "string",
-					"required": false,
-					"description": "The max_time field"
-				},
-				{
-					"name": "min-time",
-					"type": "string",
-					"required": false,
-					"description": "The min_time field"
-				},
-				{
-					"name": "scan",
-					"type": "boolean",
-					"required": false,
-					"description": "The scan field"
-				},
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false,
-					"description": "The tag field"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				},
-				{
-					"name": "body",
-					"type": "string",
-					"required": false,
-					"description": "Raw JSON request body (bypasses individual flags)"
-				}
-			],
-			"category": "create",
-			"hasRequestBody": true,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/brand-protection/queries",
-			"operationId": "queries.create",
-			"hideCommand": true
-		},
-		{
-			"command": "cf queries delete",
-			"name": "delete",
-			"fullPath": ["queries", "delete"],
-			"description": "Return a success message after deleting saved string queries by ID",
-			"summary": "Delete saved string queries by ID",
-			"usage": "cf queries delete [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false,
-					"description": "ID"
-				},
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false,
-					"description": "Tag"
-				},
-				{
-					"name": "scan",
-					"type": "boolean",
-					"required": false,
-					"description": "Scan"
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "delete",
-			"hasRequestBody": false,
-			"httpMethod": "DELETE",
-			"apiPath": "/accounts/{account_id}/brand-protection/queries",
-			"operationId": "queries.delete",
-			"hideCommand": true
-		},
 		{
 			"command": "cf queues consumers create",
 			"name": "create",
@@ -105037,6 +104974,30 @@
 			"operationId": "radar.traffic-anomalies.locations.get",
 			"hideCommand": false
 		},
+		{
+			"command": "cf ready get",
+			"name": "get",
+			"fullPath": ["ready", "get"],
+			"description": "Return a success message after running readiness checks.",
+			"summary": "Run readiness checks",
+			"usage": "cf ready get",
+			"arguments": [],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/ready",
+			"operationId": "ready.get",
+			"hideCommand": true
+		},
 		{
 			"command": "cf realtime kit analytics livestreams daily get",
 			"name": "get",
@@ -117272,6 +117233,30 @@
 			"operationId": "security-txt.update",
 			"hideCommand": false
 		},
+		{
+			"command": "cf signed-url get",
+			"name": "get",
+			"fullPath": ["signed-url", "get"],
+			"description": "Internal route for testing signed URLs.",
+			"summary": "Internal route for testing signed URLs",
+			"usage": "cf signed-url get",
+			"arguments": [],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/signed-url",
+			"operationId": "signed-url.get",
+			"hideCommand": true
+		},
 		{
 			"command": "cf smart-shield cache-reserve-clear clear",
 			"name": "clear",
@@ -124125,30 +124110,6 @@
 			"operationId": "stream.webhooks.update",
 			"hideCommand": false
 		},
-		{
-			"command": "cf submit create",
-			"name": "create",
-			"fullPath": ["submit", "create"],
-			"description": "Return new URL submissions",
-			"summary": "Create new URL submissions",
-			"usage": "cf submit create",
-			"arguments": [],
-			"options": [
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "create",
-			"hasRequestBody": false,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/brand-protection/submit",
-			"operationId": "submit.create",
-			"hideCommand": true
-		},
 		{
 			"command": "cf tags account-resources delete",
 			"name": "delete",
@@ -124184,6 +124145,7 @@
 						"account_ruleset",
 						"ai_gateway",
 						"ai_search_instance",
+						"ai_search_namespace",
 						"alerting_policy",
 						"alerting_webhook",
 						"cloudflared_tunnel",
@@ -124267,6 +124229,7 @@
 						"account_ruleset",
 						"ai_gateway",
 						"ai_search_instance",
+						"ai_search_namespace",
 						"alerting_policy",
 						"alerting_webhook",
 						"cloudflared_tunnel",
@@ -124352,6 +124315,7 @@
 						"account_ruleset",
 						"ai_gateway",
 						"ai_search_instance",
+						"ai_search_namespace",
 						"alerting_policy",
 						"alerting_webhook",
 						"cloudflared_tunnel",
@@ -124562,6 +124526,7 @@
 						"account_ruleset",
 						"ai_gateway",
 						"ai_search_instance",
+						"ai_search_namespace",
 						"alerting_policy",
 						"alerting_webhook",
 						"api_gateway_operation",
@@ -125853,261 +125818,7 @@
 					"type": "string",
 					"required": false,
 					"description": "Region where this widget can be used. This cannot be changed after creation.\n",
-					"default": "world",
-					"enum": ["world", "china"]
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				},
-				{
-					"name": "body",
-					"type": "string",
-					"required": false,
-					"description": "Raw JSON request body (bypasses individual flags)"
-				}
-			],
-			"category": "create",
-			"hasRequestBody": true,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/challenges/widgets",
-			"operationId": "turnstile.widgets.create",
-			"hideCommand": false
-		},
-		{
-			"command": "cf turnstile widgets delete",
-			"name": "delete",
-			"fullPath": ["turnstile", "widgets", "delete"],
-			"description": "Deletes a Turnstile widget from an account.",
-			"summary": "Delete a Turnstile Widget",
-			"usage": "cf turnstile widgets delete <sitekey>",
-			"arguments": [
-				{
-					"name": "sitekey",
-					"position": 0,
-					"type": "string",
-					"required": true,
-					"description": "Unique identifier for a Turnstile widget."
-				}
-			],
-			"options": [
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "delete",
-			"hasRequestBody": false,
-			"httpMethod": "DELETE",
-			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}",
-			"operationId": "turnstile.widgets.delete",
-			"hideCommand": false
-		},
-		{
-			"command": "cf turnstile widgets get",
-			"name": "get",
-			"fullPath": ["turnstile", "widgets", "get"],
-			"description": "Returns the configuration of a Turnstile widget.",
-			"summary": "Turnstile Widget Details",
-			"usage": "cf turnstile widgets get <sitekey>",
-			"arguments": [
-				{
-					"name": "sitekey",
-					"position": 0,
-					"type": "string",
-					"required": true,
-					"description": "Unique identifier for a Turnstile widget."
-				}
-			],
-			"options": [
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}",
-			"operationId": "turnstile.widgets.get",
-			"hideCommand": false
-		},
-		{
-			"command": "cf turnstile widgets list",
-			"name": "list",
-			"fullPath": ["turnstile", "widgets", "list"],
-			"description": "Lists Turnstile widgets for an account.",
-			"summary": "List Turnstile Widgets",
-			"usage": "cf turnstile widgets list [options]",
-			"arguments": [],
-			"options": [
-				{
-					"name": "page",
-					"type": "number",
-					"required": false,
-					"description": "Page number of paginated results."
-				},
-				{
-					"name": "per-page",
-					"type": "number",
-					"required": false,
-					"description": "Number of items per page."
-				},
-				{
-					"name": "order",
-					"type": "string",
-					"required": false,
-					"description": "Field to order widgets by.",
-					"enum": ["id", "sitekey", "name", "created_on", "modified_on"]
-				},
-				{
-					"name": "direction",
-					"type": "string",
-					"required": false,
-					"description": "Direction to order widgets.",
-					"enum": ["asc", "desc"]
-				},
-				{
-					"name": "filter",
-					"type": "string",
-					"required": false,
-					"description": "Filter widgets by field. The `name` field uses case-insensitive\nsubstring matching; `sitekey` uses exact matching.\nFormat: `field:value`\n\nSupported fields:\n- `name` - Filter by widget name (e.g., `filter=name:login-form`)\n- `sitekey` - Filter by sitekey (e.g., `filter=sitekey:0x4AAA`)\n\nReturns 400 Bad Request if the field is unsupported or format is invalid.\nAn empty filter value returns all results."
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				}
-			],
-			"category": "read",
-			"hasRequestBody": false,
-			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/challenges/widgets",
-			"operationId": "turnstile.widgets.list",
-			"hideCommand": false
-		},
-		{
-			"command": "cf turnstile widgets rotate-secret",
-			"name": "rotate-secret",
-			"fullPath": ["turnstile", "widgets", "rotate-secret"],
-			"description": "Generates a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period.",
-			"summary": "Rotate Secret for a Turnstile Widget",
-			"usage": "cf turnstile widgets rotate-secret <sitekey> [options]",
-			"arguments": [
-				{
-					"name": "sitekey",
-					"position": 0,
-					"type": "string",
-					"required": true,
-					"description": "Unique identifier for a Turnstile widget."
-				}
-			],
-			"options": [
-				{
-					"name": "invalidate-immediately",
-					"type": "boolean",
-					"required": false,
-					"description": "If `invalidate_immediately` is set to `false`, the previous secret will\nremain valid for two hours. Otherwise, the secret is immediately\ninvalidated, and requests using it will be rejected.\n",
-					"default": false
-				},
-				{
-					"name": "dry-run",
-					"type": "boolean",
-					"required": false,
-					"description": "Validate and show what would happen without executing",
-					"default": false
-				},
-				{
-					"name": "body",
-					"type": "string",
-					"required": false,
-					"description": "Raw JSON request body (bypasses individual flags)"
-				}
-			],
-			"category": "action",
-			"hasRequestBody": true,
-			"httpMethod": "POST",
-			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}/rotate_secret",
-			"operationId": "turnstile.widgets.rotate-secret",
-			"hideCommand": false
-		},
-		{
-			"command": "cf turnstile widgets update",
-			"name": "update",
-			"fullPath": ["turnstile", "widgets", "update"],
-			"description": "Updates the configuration of a Turnstile widget.",
-			"summary": "Update a Turnstile Widget",
-			"usage": "cf turnstile widgets update <sitekey> [options]",
-			"arguments": [
-				{
-					"name": "sitekey",
-					"position": 0,
-					"type": "string",
-					"required": true,
-					"description": "Unique identifier for a Turnstile widget."
-				}
-			],
-			"options": [
-				{
-					"name": "bot-fight-mode",
-					"type": "boolean",
-					"required": false,
-					"description": "If bot_fight_mode is set to `true`, Cloudflare issues computationally\nexpensive challenges in response to malicious bots (ENT only).\n"
-				},
-				{
-					"name": "clearance-level",
-					"type": "string",
-					"required": false,
-					"description": "If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance,\nthis setting can determine the clearance level to be set\n",
-					"enum": ["no_clearance", "jschallenge", "managed", "interactive"]
-				},
-				{
-					"name": "domains",
-					"type": "string",
-					"required": true,
-					"description": "The domains field"
-				},
-				{
-					"name": "ephemeral-id",
-					"type": "boolean",
-					"required": false,
-					"description": "Return the Ephemeral ID in /siteverify (ENT only).\n"
-				},
-				{
-					"name": "widget-mode",
-					"type": "string",
-					"required": true,
-					"description": "Widget mode",
-					"enum": ["non-interactive", "invisible", "managed"]
-				},
-				{
-					"name": "name",
-					"type": "string",
-					"required": true,
-					"description": "Human readable widget name. Not unique. Cloudflare suggests that you\nset this to a meaningful string to make it easier to identify your\nwidget, and where it is used.\n"
-				},
-				{
-					"name": "offlabel",
-					"type": "boolean",
-					"required": false,
-					"description": "Do not show any Cloudflare branding on the widget (ENT only).\n"
-				},
-				{
-					"name": "region",
-					"type": "string",
-					"required": false,
-					"description": "Region where this widget can be used. This cannot be changed after creation.\n",
+					"default": "world",
 					"enum": ["world", "china"]
 				},
 				{
@@ -126124,22 +125835,118 @@
 					"description": "Raw JSON request body (bypasses individual flags)"
 				}
 			],
-			"category": "update",
+			"category": "create",
 			"hasRequestBody": true,
-			"httpMethod": "PUT",
+			"httpMethod": "POST",
+			"apiPath": "/accounts/{account_id}/challenges/widgets",
+			"operationId": "turnstile.widgets.create",
+			"hideCommand": false
+		},
+		{
+			"command": "cf turnstile widgets delete",
+			"name": "delete",
+			"fullPath": ["turnstile", "widgets", "delete"],
+			"description": "Deletes a Turnstile widget from an account.",
+			"summary": "Delete a Turnstile Widget",
+			"usage": "cf turnstile widgets delete <sitekey>",
+			"arguments": [
+				{
+					"name": "sitekey",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Unique identifier for a Turnstile widget."
+				}
+			],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "delete",
+			"hasRequestBody": false,
+			"httpMethod": "DELETE",
 			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}",
-			"operationId": "turnstile.widgets.update",
+			"operationId": "turnstile.widgets.delete",
 			"hideCommand": false
 		},
 		{
-			"command": "cf url-info get",
+			"command": "cf turnstile widgets get",
 			"name": "get",
-			"fullPath": ["url-info", "get"],
-			"description": "Return submitted URLs based on ID",
-			"summary": "Read submitted URLs by ID",
-			"usage": "cf url-info get",
+			"fullPath": ["turnstile", "widgets", "get"],
+			"description": "Returns the configuration of a Turnstile widget.",
+			"summary": "Turnstile Widget Details",
+			"usage": "cf turnstile widgets get <sitekey>",
+			"arguments": [
+				{
+					"name": "sitekey",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Unique identifier for a Turnstile widget."
+				}
+			],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "read",
+			"hasRequestBody": false,
+			"httpMethod": "GET",
+			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}",
+			"operationId": "turnstile.widgets.get",
+			"hideCommand": false
+		},
+		{
+			"command": "cf turnstile widgets list",
+			"name": "list",
+			"fullPath": ["turnstile", "widgets", "list"],
+			"description": "Lists Turnstile widgets for an account.",
+			"summary": "List Turnstile Widgets",
+			"usage": "cf turnstile widgets list [options]",
 			"arguments": [],
 			"options": [
+				{
+					"name": "page",
+					"type": "number",
+					"required": false,
+					"description": "Page number of paginated results."
+				},
+				{
+					"name": "per-page",
+					"type": "number",
+					"required": false,
+					"description": "Number of items per page."
+				},
+				{
+					"name": "order",
+					"type": "string",
+					"required": false,
+					"description": "Field to order widgets by.",
+					"enum": ["id", "sitekey", "name", "created_on", "modified_on"]
+				},
+				{
+					"name": "direction",
+					"type": "string",
+					"required": false,
+					"description": "Direction to order widgets.",
+					"enum": ["asc", "desc"]
+				},
+				{
+					"name": "filter",
+					"type": "string",
+					"required": false,
+					"description": "Filter widgets by field. The `name` field uses case-insensitive\nsubstring matching; `sitekey` uses exact matching.\nFormat: `field:value`\n\nSupported fields:\n- `name` - Filter by widget name (e.g., `filter=name:login-form`)\n- `sitekey` - Filter by sitekey (e.g., `filter=sitekey:0x4AAA`)\n\nReturns 400 Bad Request if the field is unsupported or format is invalid.\nAn empty filter value returns all results."
+				},
 				{
 					"name": "dry-run",
 					"type": "boolean",
@@ -126151,9 +125958,143 @@
 			"category": "read",
 			"hasRequestBody": false,
 			"httpMethod": "GET",
-			"apiPath": "/accounts/{account_id}/brand-protection/url-info",
-			"operationId": "url-info.get",
-			"hideCommand": true
+			"apiPath": "/accounts/{account_id}/challenges/widgets",
+			"operationId": "turnstile.widgets.list",
+			"hideCommand": false
+		},
+		{
+			"command": "cf turnstile widgets rotate-secret",
+			"name": "rotate-secret",
+			"fullPath": ["turnstile", "widgets", "rotate-secret"],
+			"description": "Generates a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period.",
+			"summary": "Rotate Secret for a Turnstile Widget",
+			"usage": "cf turnstile widgets rotate-secret <sitekey> [options]",
+			"arguments": [
+				{
+					"name": "sitekey",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Unique identifier for a Turnstile widget."
+				}
+			],
+			"options": [
+				{
+					"name": "invalidate-immediately",
+					"type": "boolean",
+					"required": false,
+					"description": "If `invalidate_immediately` is set to `false`, the previous secret will\nremain valid for two hours. Otherwise, the secret is immediately\ninvalidated, and requests using it will be rejected.\n",
+					"default": false
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				},
+				{
+					"name": "body",
+					"type": "string",
+					"required": false,
+					"description": "Raw JSON request body (bypasses individual flags)"
+				}
+			],
+			"category": "action",
+			"hasRequestBody": true,
+			"httpMethod": "POST",
+			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}/rotate_secret",
+			"operationId": "turnstile.widgets.rotate-secret",
+			"hideCommand": false
+		},
+		{
+			"command": "cf turnstile widgets update",
+			"name": "update",
+			"fullPath": ["turnstile", "widgets", "update"],
+			"description": "Updates the configuration of a Turnstile widget.",
+			"summary": "Update a Turnstile Widget",
+			"usage": "cf turnstile widgets update <sitekey> [options]",
+			"arguments": [
+				{
+					"name": "sitekey",
+					"position": 0,
+					"type": "string",
+					"required": true,
+					"description": "Unique identifier for a Turnstile widget."
+				}
+			],
+			"options": [
+				{
+					"name": "bot-fight-mode",
+					"type": "boolean",
+					"required": false,
+					"description": "If bot_fight_mode is set to `true`, Cloudflare issues computationally\nexpensive challenges in response to malicious bots (ENT only).\n"
+				},
+				{
+					"name": "clearance-level",
+					"type": "string",
+					"required": false,
+					"description": "If Turnstile is embedded on a Cloudflare site and the widget should grant challenge clearance,\nthis setting can determine the clearance level to be set\n",
+					"enum": ["no_clearance", "jschallenge", "managed", "interactive"]
+				},
+				{
+					"name": "domains",
+					"type": "string",
+					"required": true,
+					"description": "The domains field"
+				},
+				{
+					"name": "ephemeral-id",
+					"type": "boolean",
+					"required": false,
+					"description": "Return the Ephemeral ID in /siteverify (ENT only).\n"
+				},
+				{
+					"name": "widget-mode",
+					"type": "string",
+					"required": true,
+					"description": "Widget mode",
+					"enum": ["non-interactive", "invisible", "managed"]
+				},
+				{
+					"name": "name",
+					"type": "string",
+					"required": true,
+					"description": "Human readable widget name. Not unique. Cloudflare suggests that you\nset this to a meaningful string to make it easier to identify your\nwidget, and where it is used.\n"
+				},
+				{
+					"name": "offlabel",
+					"type": "boolean",
+					"required": false,
+					"description": "Do not show any Cloudflare branding on the widget (ENT only).\n"
+				},
+				{
+					"name": "region",
+					"type": "string",
+					"required": false,
+					"description": "Region where this widget can be used. This cannot be changed after creation.\n",
+					"enum": ["world", "china"]
+				},
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				},
+				{
+					"name": "body",
+					"type": "string",
+					"required": false,
+					"description": "Raw JSON request body (bypasses individual flags)"
+				}
+			],
+			"category": "update",
+			"hasRequestBody": true,
+			"httpMethod": "PUT",
+			"apiPath": "/accounts/{account_id}/challenges/widgets/{sitekey}",
+			"operationId": "turnstile.widgets.update",
+			"hideCommand": false
 		},
 		{
 			"command": "cf url-normalization delete",
@@ -162359,6 +162300,30 @@
 			"operationId": "zone.activate",
 			"hideCommand": false
 		},
+		{
+			"command": "cf zones aegis delete",
+			"name": "delete",
+			"fullPath": ["zones", "aegis", "delete"],
+			"description": "Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.",
+			"summary": "Delete aegis setting",
+			"usage": "cf zones aegis delete",
+			"arguments": [],
+			"options": [
+				{
+					"name": "dry-run",
+					"type": "boolean",
+					"required": false,
+					"description": "Validate and show what would happen without executing",
+					"default": false
+				}
+			],
+			"category": "delete",
+			"hasRequestBody": false,
+			"httpMethod": "DELETE",
+			"apiPath": "/zones/{zone_id}/settings/aegis",
+			"operationId": "zones.aegis.delete",
+			"hideCommand": false
+		},
 		{
 			"command": "cf zones aegis edit",
 			"name": "edit",
@@ -164650,6 +164615,7 @@
 		"email-auth": "email-auth",
 		"email-auth dmarc-reports": "Operations for dmarc-reports",
 		"email-auth spf": "Operations for spf",
+		"email-domains": "email-domains",
 		"email-routing": "Route incoming email to verified destination addresses or Workers with routing rules, catch-all behavior, and managed DNS records",
 		"email-routing addresses": "Verified destination email addresses that can receive forwarded mail",
 		"email-routing dns": "Inspect or unlock the DNS records required by Email Routing",
@@ -164731,6 +164697,7 @@
 		"intel indicator-feeds permissions": "Operations for indicator-feeds.permissions",
 		"intel indicator-feeds providers": "Operations for indicator-feeds.providers",
 		"intel indicator-feeds snapshots": "Operations for indicator-feeds.snapshots",
+		"intel indicator-feeds uploads": "Operations for indicator-feeds.uploads",
 		"intel ip-lists": "Curated IP lists used for threat detection and policy enforcement",
 		"intel ips": "IP address intelligence — geolocation, risk assessment, and hosting provider details",
 		"intel miscategorizations": "Report and track domain miscategorization corrections",
@@ -164738,6 +164705,8 @@
 		"intel sinkholes ingresses": "Operations for sinkholes.ingresses",
 		"intel urls": "URL intelligence operations",
 		"intel whois": "WHOIS registration data for domains including registrant, registrar, and nameservers",
+		"internal": "internal",
+		"internal submit": "Operations for submit",
 		"ips": "ips",
 		"k2": "Durable, ordered event streams that you produce records to and consume from with subscriptions",
 		"k2 streams": "K2 streams, their retention, and the HTTP and Workers binding inputs used to produce records",
@@ -164749,6 +164718,7 @@
 		"kv namespaces": "Operations for namespaces",
 		"leaked-credential-checks": "Detect compromised credentials in login requests by checking against known breach databases",
 		"leaked-credential-checks detections": "Custom detection locations that tell the WAF where to find usernames and passwords in requests",
+		"live": "live",
 		"load-balancers": "Distribute traffic across origin pools with health monitoring, geo-steering, and failover",
 		"load-balancers account": "Account-scoped load balancers that distribute traffic without requiring a DNS hostname",
 		"load-balancers account usage": "Current load balancer resource usage counts for an account",
@@ -164763,9 +164733,6 @@
 		"load-balancers previews": "Preview the result of a health check monitor configuration before applying it",
 		"load-balancers regions": "Geographic regions used for regional pool steering and traffic policies",
 		"load-balancers searches": "Search across all load balancer resources (pools, monitors, load balancers) by name or reference",
-		"logo-matches": "logo-matches",
-		"logo-matches download": "Operations for download",
-		"logos": "logos",
 		"logpush": "logpush",
 		"logpush account-datasets": "Operations for account-datasets",
 		"logpush account-datasets fields": "Operations for account-datasets.fields",
@@ -164850,8 +164817,6 @@
 		"managed-defense vulnerability-discovery repositories": "Operations for vulnerability-discovery.repositories",
 		"managed-defense vulnerability-discovery scans": "Operations for vulnerability-discovery.scans",
 		"managed-transforms": "managed-transforms",
-		"matches": "matches",
-		"matches download": "Operations for download",
 		"mcp": "Manage MCP portals and upstream MCP servers for Cloudflare Access AI controls",
 		"mcp portals": "Manage MCP portals, attached servers, and Code Mode settings",
 		"mcp servers": "Manage upstream MCP servers, credentials, capabilities, and sync state",
@@ -164937,8 +164902,6 @@
 		"pipelines streams": "Inbound data streams that feed events into a pipeline for processing",
 		"precursor": "Precursor settings for a zone",
 		"previews": "Manage Worker Previews",
-		"queries": "queries",
-		"queries bulk": "Operations for bulk",
 		"queues": "Reliable message queuing between Workers — produce, consume, and batch-process messages at scale",
 		"queues consumers": "Workers that automatically receive and process messages from a queue",
 		"queues messages": "Push messages to a queue and pull or acknowledge them from consumers",
@@ -165060,6 +165023,7 @@
 		"radar tlds performance": "Operations for tlds.performance",
 		"radar traffic-anomalies": "Detected traffic anomalies and unusual patterns in Internet traffic flows",
 		"radar traffic-anomalies locations": "Operations for traffic-anomalies.locations",
+		"ready": "ready",
 		"realtime": "Real-time audio, video, and data services on Cloudflare's global network",
 		"realtime kit": "SDK-backed meetings, participants, recordings, livestreams, and webhooks",
 		"realtime kit analytics": "Usage and livestream analytics for RealtimeKit applications",
@@ -165146,6 +165110,7 @@
 		"security-insights scans": "Operations for scans",
 		"security-insights state": "Operations for state",
 		"security-txt": "Manage the /.well-known/security.txt file that tells security researchers how to report vulnerabilities",
+		"signed-url": "signed-url",
 		"smart-shield": "Smart Shield settings, health checks, and cache reserve management",
 		"smart-shield cache-reserve-clear": "Cache Reserve Clear operations",
 		"smart-shield health-checks": "Health checks operations",
@@ -165210,7 +165175,6 @@
 		"stream videos token": "Operations for videos.token",
 		"stream watermarks": "Watermark profiles that overlay an image on every video in the account",
 		"stream webhooks": "Webhook notifications for video lifecycle events (ready, error, etc.)",
-		"submit": "submit",
 		"tags": "tags",
 		"tags account-resources": "Operations for account-resources",
 		"tags keys": "Operations for keys",
@@ -165230,7 +165194,6 @@
 		"tunnels token": "Operations for token",
 		"turnstile": "CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience",
 		"turnstile widgets": "Turnstile widget configurations — site keys, secret rotation, and challenge mode settings",
-		"url-info": "url-info",
 		"url-normalization": "url-normalization",
 		"url-scanner": "Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results",
 		"url-scanner responses": "Raw HTTP response data captured during URL scans",
diff --git a/packages/cli/src/commands/_generated/_meta/schemas.json b/packages/cli/src/commands/_generated/_meta/schemas.json
index 9de08a9570..eb9298b46e 100644
--- a/packages/cli/src/commands/_generated/_meta/schemas.json
+++ b/packages/cli/src/commands/_generated/_meta/schemas.json
@@ -32710,6 +32710,130 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
+		"email-domains create": {
+			"operationId": "email-domains.create",
+			"httpMethod": "POST",
+			"path": "/accounts/{account_id}/email/domains",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": true,
+			"requestBodyFields": [
+				{
+					"name": "client-reference",
+					"type": "string",
+					"required": false,
+					"description": "Opaque reference for one customer enrollment. Reuse it with the same hostname to retry Create safely. Distinct references can enroll the same unverified hostname; a hostname alone never identifies a customer."
+				},
+				{
+					"name": "hostname",
+					"type": "string",
+					"required": true,
+					"description": "Exact external hostname to enroll. After ASCII conversion, the assigned Return-Path hostname must be at most 201 characters (191 for the current cf-bounce. prefix). Wildcards, provider-zone names, and hostnames inside an existing Cloudflare-managed DNS zone are rejected."
+				}
+			]
+		},
+		"email-domains delete": {
+			"operationId": "email-domains.delete",
+			"httpMethod": "DELETE",
+			"path": "/accounts/{account_id}/email/domains/{email_domain_id}",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "email_domain_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
+		"email-domains get": {
+			"operationId": "email-domains.get",
+			"httpMethod": "GET",
+			"path": "/accounts/{account_id}/email/domains/{email_domain_id}",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "email_domain_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
+		"email-domains list": {
+			"operationId": "email-domains.list",
+			"httpMethod": "GET",
+			"path": "/accounts/{account_id}/email/domains",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [
+				{
+					"name": "per_page",
+					"type": "number",
+					"required": false
+				},
+				{
+					"name": "cursor",
+					"type": "string",
+					"required": false
+				},
+				{
+					"name": "hostname",
+					"type": "string",
+					"required": false
+				},
+				{
+					"name": "include",
+					"type": "string",
+					"required": false
+				}
+			],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
+		"email-domains verify": {
+			"operationId": "email-domains.verify",
+			"httpMethod": "POST",
+			"path": "/accounts/{account_id}/email/domains/{email_domain_id}/verify",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "email_domain_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"email-routing addresses create": {
 			"operationId": "email-routing.addresses.create",
 			"httpMethod": "POST",
@@ -37707,6 +37831,12 @@
 					"required": true,
 					"description": "Unique identifier for the flag within an app. Used in all evaluation and SDK calls."
 				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				},
 				{
 					"name": "rules",
 					"type": "string",
@@ -37775,7 +37905,7 @@
 					"name": "context",
 					"type": "string",
 					"required": false,
-					"description": "Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries and 32 KB. Provide as a JSON object or @path/to/file.json."
+					"description": "Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries, nesting depth of 10, 10,000 values, and 32 KB. Provide as a JSON object or @path/to/file.json."
 				},
 				{
 					"name": "flag-key",
@@ -37841,6 +37971,56 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
+		"flagship apps flags patch": {
+			"operationId": "flagship.apps.flags.patch",
+			"httpMethod": "PATCH",
+			"path": "/accounts/{account_id}/flagship/apps/{app_id}/flags/{flag_key}",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "app_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "flag_key",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": true,
+			"requestBodyFields": [
+				{
+					"name": "default-variation",
+					"type": "string",
+					"required": false,
+					"description": "Variation the API serves when the flag is off, or when it's on but no rule matches the context. Must be a key in `variations`."
+				},
+				{
+					"name": "description",
+					"type": "string",
+					"required": false,
+					"description": "Optional operator-facing description. It does not affect flag evaluation."
+				},
+				{
+					"name": "enabled",
+					"type": "boolean",
+					"required": false,
+					"description": "When false, the flag bypasses all rules and always serves `default_variation`."
+				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				}
+			]
+		},
 		"flagship apps flags update": {
 			"operationId": "flagship.apps.flags.update",
 			"httpMethod": "PUT",
@@ -37889,6 +38069,12 @@
 					"required": true,
 					"description": "Unique identifier for the flag within an app. Used in all evaluation and SDK calls."
 				},
+				{
+					"name": "metadata",
+					"type": "string",
+					"required": false,
+					"description": "Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json."
+				},
 				{
 					"name": "rules",
 					"type": "string",
@@ -41043,7 +41229,7 @@
 			"hasRequestBody": true,
 			"requestBodyFields": [
 				{
-					"name": "account-id",
+					"name": "account-id-body",
 					"type": "number",
 					"required": true,
 					"description": "The numeric account ID to create the provider for. Distinct from the\npath `account_id` parameter, which carries the account identifier\nstring used for routing.\n"
@@ -41127,6 +41313,31 @@
 				}
 			]
 		},
+		"intel indicator-feeds uploads get": {
+			"operationId": "intel.indicator-feeds.uploads.get",
+			"httpMethod": "GET",
+			"path": "/accounts/{account_id}/intel/indicator-feeds/{feed_id}/uploads/{upload_id}",
+			"pathParams": [
+				{
+					"name": "account_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "feed_id",
+					"type": "string",
+					"required": true
+				},
+				{
+					"name": "upload_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"intel ip-lists get": {
 			"operationId": "intel.ip-lists.get",
 			"httpMethod": "GET",
@@ -41542,6 +41753,15 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
+		"internal submit create": {
+			"operationId": "internal.submit.create",
+			"httpMethod": "POST",
+			"path": "/internal/submit",
+			"pathParams": [],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"ips list": {
 			"operationId": "ips.list",
 			"httpMethod": "GET",
@@ -42279,6 +42499,15 @@
 				}
 			]
 		},
+		"live get": {
+			"operationId": "live.get",
+			"httpMethod": "GET",
+			"path": "/live",
+			"pathParams": [],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"load-balancers account create": {
 			"operationId": "load-balancers.account.create",
 			"httpMethod": "POST",
@@ -44383,119 +44612,6 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
-		"logo-matches download get": {
-			"operationId": "logo-matches.download.get",
-			"httpMethod": "GET",
-			"path": "/accounts/{account_id}/brand-protection/logo-matches/download",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "logo_id",
-					"type": "array",
-					"required": false
-				},
-				{
-					"name": "offset",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "limit",
-					"type": "string",
-					"required": false
-				}
-			],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
-		"logo-matches get": {
-			"operationId": "logo-matches.get",
-			"httpMethod": "GET",
-			"path": "/accounts/{account_id}/brand-protection/logo-matches",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "logo_id",
-					"type": "array",
-					"required": false
-				},
-				{
-					"name": "offset",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "limit",
-					"type": "string",
-					"required": false
-				}
-			],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
-		"logos create": {
-			"operationId": "logos.create",
-			"httpMethod": "POST",
-			"path": "/accounts/{account_id}/brand-protection/logos",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "match_type",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "threshold",
-					"type": "number",
-					"required": false
-				}
-			],
-			"hasRequestBody": true,
-			"requestBodyFields": []
-		},
-		"logos delete": {
-			"operationId": "logos.delete",
-			"httpMethod": "DELETE",
-			"path": "/accounts/{account_id}/brand-protection/logos/{logo_id}",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				},
-				{
-					"name": "logo_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
 		"logpush account-datasets fields get": {
 			"operationId": "logpush.account-datasets.fields.get",
 			"httpMethod": "GET",
@@ -52696,88 +52812,6 @@
 				}
 			]
 		},
-		"matches download get": {
-			"operationId": "matches.download.get",
-			"httpMethod": "GET",
-			"path": "/accounts/{account_id}/brand-protection/matches/download",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "offset",
-					"type": "number",
-					"required": false
-				},
-				{
-					"name": "limit",
-					"type": "number",
-					"required": false
-				},
-				{
-					"name": "include_domain_id",
-					"type": "boolean",
-					"required": false
-				},
-				{
-					"name": "include_dismissed",
-					"type": "boolean",
-					"required": false
-				}
-			],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
-		"matches get": {
-			"operationId": "matches.get",
-			"httpMethod": "GET",
-			"path": "/accounts/{account_id}/brand-protection/matches",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "offset",
-					"type": "number",
-					"required": false
-				},
-				{
-					"name": "limit",
-					"type": "number",
-					"required": false
-				},
-				{
-					"name": "include_domain_id",
-					"type": "boolean",
-					"required": false
-				},
-				{
-					"name": "include_dismissed",
-					"type": "boolean",
-					"required": false
-				}
-			],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
 		"mcp portals account-tool-call-analytics": {
 			"operationId": "mcp.portals.account-tool-call-analytics",
 			"httpMethod": "GET",
@@ -61471,105 +61505,6 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
-		"queries bulk create": {
-			"operationId": "queries.bulk.create",
-			"httpMethod": "POST",
-			"path": "/accounts/{account_id}/brand-protection/queries/bulk",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [],
-			"hasRequestBody": true,
-			"requestBodyFields": [
-				{
-					"name": "queries",
-					"type": "string",
-					"required": false,
-					"description": "The queries field. Provide as a JSON array of objects or @path/to/file.json."
-				}
-			]
-		},
-		"queries create": {
-			"operationId": "queries.create",
-			"httpMethod": "POST",
-			"path": "/accounts/{account_id}/brand-protection/queries",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false
-				}
-			],
-			"hasRequestBody": true,
-			"requestBodyFields": [
-				{
-					"name": "max-time",
-					"type": "string",
-					"required": false,
-					"description": "The max_time field"
-				},
-				{
-					"name": "min-time",
-					"type": "string",
-					"required": false,
-					"description": "The min_time field"
-				},
-				{
-					"name": "scan",
-					"type": "boolean",
-					"required": false,
-					"description": "The scan field"
-				},
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false,
-					"description": "The tag field"
-				}
-			]
-		},
-		"queries delete": {
-			"operationId": "queries.delete",
-			"httpMethod": "DELETE",
-			"path": "/accounts/{account_id}/brand-protection/queries",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [
-				{
-					"name": "id",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "tag",
-					"type": "string",
-					"required": false
-				},
-				{
-					"name": "scan",
-					"type": "boolean",
-					"required": false
-				}
-			],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
 		"queues consumers create": {
 			"operationId": "queues.consumers.create",
 			"httpMethod": "POST",
@@ -73709,6 +73644,15 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
+		"ready get": {
+			"operationId": "ready.get",
+			"httpMethod": "GET",
+			"path": "/ready",
+			"pathParams": [],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"realtime kit analytics livestreams daily get": {
 			"operationId": "realtime.kit.analytics.livestreams.daily.get",
 			"httpMethod": "GET",
@@ -82762,6 +82706,15 @@
 				}
 			]
 		},
+		"signed-url get": {
+			"operationId": "signed-url.get",
+			"httpMethod": "GET",
+			"path": "/signed-url",
+			"pathParams": [],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"smart-shield cache-reserve-clear clear": {
 			"operationId": "smart-shield.cache-reserve-clear.clear",
 			"httpMethod": "POST",
@@ -87375,21 +87328,6 @@
 				}
 			]
 		},
-		"submit create": {
-			"operationId": "submit.create",
-			"httpMethod": "POST",
-			"path": "/accounts/{account_id}/brand-protection/submit",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
 		"tags account-resources delete": {
 			"operationId": "tags.account-resources.delete",
 			"httpMethod": "DELETE",
@@ -88468,21 +88406,6 @@
 				}
 			]
 		},
-		"url-info get": {
-			"operationId": "url-info.get",
-			"httpMethod": "GET",
-			"path": "/accounts/{account_id}/brand-protection/url-info",
-			"pathParams": [
-				{
-					"name": "account_id",
-					"type": "string",
-					"required": true
-				}
-			],
-			"queryParams": [],
-			"hasRequestBody": false,
-			"requestBodyFields": []
-		},
 		"url-normalization delete": {
 			"operationId": "url-normalization.delete",
 			"httpMethod": "DELETE",
@@ -113745,6 +113668,21 @@
 			"hasRequestBody": false,
 			"requestBodyFields": []
 		},
+		"zones aegis delete": {
+			"operationId": "zones.aegis.delete",
+			"httpMethod": "DELETE",
+			"path": "/zones/{zone_id}/settings/aegis",
+			"pathParams": [
+				{
+					"name": "zone_id",
+					"type": "string",
+					"required": true
+				}
+			],
+			"queryParams": [],
+			"hasRequestBody": false,
+			"requestBodyFields": []
+		},
 		"zones aegis edit": {
 			"operationId": "zones.aegis.edit",
 			"httpMethod": "PATCH",
diff --git a/packages/cli/src/commands/_generated/_operations/abuse-reports/create.ts b/packages/cli/src/commands/_generated/_operations/abuse-reports/create.ts
index e7b2595d7c..d53151219e 100644
--- a/packages/cli/src/commands/_generated/_operations/abuse-reports/create.ts
+++ b/packages/cli/src/commands/_generated/_operations/abuse-reports/create.ts
@@ -10,6 +10,7 @@ export default {
 		400: "BadRequestError",
 		401: "UnauthorizedError",
 		403: "ForbiddenError",
+		429: "TooManyRequestsError",
 		500: "InternalServerError",
 	},
 } as const;
diff --git a/packages/cli/src/commands/_generated/_operations/email-domains/create.ts b/packages/cli/src/commands/_generated/_operations/email-domains/create.ts
new file mode 100644
index 0000000000..3aa942be6f
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/email-domains/create.ts
@@ -0,0 +1,18 @@
+/** @generated from email-domains.create */
+import { path } from "#api";
+
+export default {
+	method: "POST",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/email/domains`,
+	body: "json",
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		409: "ConflictError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+		503: "ServiceUnavailableError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/email-domains/delete.ts b/packages/cli/src/commands/_generated/_operations/email-domains/delete.ts
new file mode 100644
index 0000000000..0d1d2f7c5a
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/email-domains/delete.ts
@@ -0,0 +1,16 @@
+/** @generated from email-domains.delete */
+import { path } from "#api";
+
+export default {
+	method: "DELETE",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/email/domains/${request.email_domain_id}`,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		409: "ConflictError",
+		500: "InternalServerError",
+		503: "ServiceUnavailableError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/email-domains/get.ts b/packages/cli/src/commands/_generated/_operations/email-domains/get.ts
new file mode 100644
index 0000000000..087cb6ccea
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/email-domains/get.ts
@@ -0,0 +1,15 @@
+/** @generated from email-domains.get */
+import { path } from "#api";
+
+export default {
+	method: "GET",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/email/domains/${request.email_domain_id}`,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		500: "InternalServerError",
+		503: "ServiceUnavailableError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/email-domains/list.ts b/packages/cli/src/commands/_generated/_operations/email-domains/list.ts
new file mode 100644
index 0000000000..e2de4add7e
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/email-domains/list.ts
@@ -0,0 +1,17 @@
+/** @generated from email-domains.list */
+import { path } from "#api";
+
+export default {
+	method: "GET",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/email/domains`,
+	query: ["per_page", "cursor", "hostname", "include"],
+	joined: ["per_page", "cursor", "hostname", "include"],
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		500: "InternalServerError",
+		503: "ServiceUnavailableError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/email-domains/verify.ts b/packages/cli/src/commands/_generated/_operations/email-domains/verify.ts
new file mode 100644
index 0000000000..6d9c1f1491
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/email-domains/verify.ts
@@ -0,0 +1,17 @@
+/** @generated from email-domains.verify */
+import { path } from "#api";
+
+export default {
+	method: "POST",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/email/domains/${request.email_domain_id}/verify`,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		409: "ConflictError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+		503: "ServiceUnavailableError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/flagship/apps/flags/patch.ts b/packages/cli/src/commands/_generated/_operations/flagship/apps/flags/patch.ts
new file mode 100644
index 0000000000..0123700f7f
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/flagship/apps/flags/patch.ts
@@ -0,0 +1,17 @@
+/** @generated from flagship.apps.flags.patch */
+import { path } from "#api";
+
+export default {
+	method: "PATCH",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/flagship/apps/${request.app_id}/flags/${request.flag_key}`,
+	body: "json",
+	errors: {
+		400: "BadRequestError",
+		401: "UnauthorizedError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/intel/indicator-feeds/uploads/get.ts b/packages/cli/src/commands/_generated/_operations/intel/indicator-feeds/uploads/get.ts
new file mode 100644
index 0000000000..7d4a534378
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/intel/indicator-feeds/uploads/get.ts
@@ -0,0 +1,8 @@
+/** @generated from intel.indicator-feeds.uploads.get */
+import { path } from "#api";
+
+export default {
+	method: "GET",
+	path: (request: Record<string, unknown>) =>
+		path`/accounts/${request.account_id}/intel/indicator-feeds/${request.feed_id}/uploads/${request.upload_id}`,
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/internal/submit/create.ts b/packages/cli/src/commands/_generated/_operations/internal/submit/create.ts
new file mode 100644
index 0000000000..9a55abc0d3
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/internal/submit/create.ts
@@ -0,0 +1,13 @@
+/** @generated from internal.submit.create */
+export default {
+	method: "POST",
+	path: () => "/internal/submit",
+	response: false,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/live/get.ts b/packages/cli/src/commands/_generated/_operations/live/get.ts
new file mode 100644
index 0000000000..f10d688310
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/live/get.ts
@@ -0,0 +1,13 @@
+/** @generated from live.get */
+export default {
+	method: "GET",
+	path: () => "/live",
+	response: false,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/logo-matches/download/get.ts b/packages/cli/src/commands/_generated/_operations/logo-matches/download/get.ts
deleted file mode 100644
index dbe2485c96..0000000000
--- a/packages/cli/src/commands/_generated/_operations/logo-matches/download/get.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/** @generated from logo-matches.download.get */
-import { path } from "#api";
-
-export default {
-	method: "GET",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/logo-matches/download`,
-	query: ["logo_id", "offset", "limit"],
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/logo-matches/get.ts b/packages/cli/src/commands/_generated/_operations/logo-matches/get.ts
deleted file mode 100644
index 61c999e58a..0000000000
--- a/packages/cli/src/commands/_generated/_operations/logo-matches/get.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/** @generated from logo-matches.get */
-import { path } from "#api";
-
-export default {
-	method: "GET",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/logo-matches`,
-	query: ["logo_id", "offset", "limit"],
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/logos/create.ts b/packages/cli/src/commands/_generated/_operations/logos/create.ts
deleted file mode 100644
index 3eb8a33370..0000000000
--- a/packages/cli/src/commands/_generated/_operations/logos/create.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/** @generated from logos.create */
-import { path } from "#api";
-
-export default {
-	method: "POST",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/logos`,
-	query: ["tag", "match_type", "threshold"],
-	body: "json",
-	contentType: "application/x-www-form-urlencoded",
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/logos/delete.ts b/packages/cli/src/commands/_generated/_operations/logos/delete.ts
deleted file mode 100644
index f46af97db1..0000000000
--- a/packages/cli/src/commands/_generated/_operations/logos/delete.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/** @generated from logos.delete */
-import { path } from "#api";
-
-export default {
-	method: "DELETE",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/logos/${request.logo_id}`,
-	response: false,
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/matches/download/get.ts b/packages/cli/src/commands/_generated/_operations/matches/download/get.ts
deleted file mode 100644
index 4e95003c12..0000000000
--- a/packages/cli/src/commands/_generated/_operations/matches/download/get.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/** @generated from matches.download.get */
-import { path } from "#api";
-
-export default {
-	method: "GET",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/matches/download`,
-	query: ["id", "offset", "limit", "include_domain_id", "include_dismissed"],
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/matches/get.ts b/packages/cli/src/commands/_generated/_operations/matches/get.ts
deleted file mode 100644
index 28a4ad8a02..0000000000
--- a/packages/cli/src/commands/_generated/_operations/matches/get.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/** @generated from matches.get */
-import { path } from "#api";
-
-export default {
-	method: "GET",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/matches`,
-	query: ["id", "offset", "limit", "include_domain_id", "include_dismissed"],
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/queries/bulk/create.ts b/packages/cli/src/commands/_generated/_operations/queries/bulk/create.ts
deleted file mode 100644
index 1ed827e1d3..0000000000
--- a/packages/cli/src/commands/_generated/_operations/queries/bulk/create.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/** @generated from queries.bulk.create */
-import { path } from "#api";
-
-export default {
-	method: "POST",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/queries/bulk`,
-	body: "json",
-	response: false,
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/queries/create.ts b/packages/cli/src/commands/_generated/_operations/queries/create.ts
deleted file mode 100644
index 4b35358f5b..0000000000
--- a/packages/cli/src/commands/_generated/_operations/queries/create.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/** @generated from queries.create */
-import { path } from "#api";
-
-export default {
-	method: "POST",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/queries`,
-	query: ["id"],
-	body: "json",
-	response: false,
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/queries/delete.ts b/packages/cli/src/commands/_generated/_operations/queries/delete.ts
deleted file mode 100644
index 4a5c86a721..0000000000
--- a/packages/cli/src/commands/_generated/_operations/queries/delete.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/** @generated from queries.delete */
-import { path } from "#api";
-
-export default {
-	method: "DELETE",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/queries`,
-	query: ["id", "tag", "scan"],
-	response: false,
-	errors: {
-		422: "UnprocessableEntityError",
-	},
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/ready/get.ts b/packages/cli/src/commands/_generated/_operations/ready/get.ts
new file mode 100644
index 0000000000..624c06780d
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/ready/get.ts
@@ -0,0 +1,13 @@
+/** @generated from ready.get */
+export default {
+	method: "GET",
+	path: () => "/ready",
+	response: false,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/signed-url/get.ts b/packages/cli/src/commands/_generated/_operations/signed-url/get.ts
new file mode 100644
index 0000000000..df54b26d09
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/signed-url/get.ts
@@ -0,0 +1,13 @@
+/** @generated from signed-url.get */
+export default {
+	method: "GET",
+	path: () => "/signed-url",
+	response: false,
+	errors: {
+		400: "BadRequestError",
+		403: "ForbiddenError",
+		404: "NotFoundError",
+		429: "TooManyRequestsError",
+		500: "InternalServerError",
+	},
+} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/submit/create.ts b/packages/cli/src/commands/_generated/_operations/submit/create.ts
deleted file mode 100644
index 28d3a7a0bd..0000000000
--- a/packages/cli/src/commands/_generated/_operations/submit/create.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/** @generated from submit.create */
-import { path } from "#api";
-
-export default {
-	method: "POST",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/submit`,
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/url-info/get.ts b/packages/cli/src/commands/_generated/_operations/url-info/get.ts
deleted file mode 100644
index 3e95510776..0000000000
--- a/packages/cli/src/commands/_generated/_operations/url-info/get.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/** @generated from url-info.get */
-import { path } from "#api";
-
-export default {
-	method: "GET",
-	path: (request: Record<string, unknown>) =>
-		path`/accounts/${request.account_id}/brand-protection/url-info`,
-} as const;
diff --git a/packages/cli/src/commands/_generated/_operations/zones/aegis/delete.ts b/packages/cli/src/commands/_generated/_operations/zones/aegis/delete.ts
new file mode 100644
index 0000000000..105449481a
--- /dev/null
+++ b/packages/cli/src/commands/_generated/_operations/zones/aegis/delete.ts
@@ -0,0 +1,8 @@
+/** @generated from zones.aegis.delete */
+import { path } from "#api";
+
+export default {
+	method: "DELETE",
+	path: (request: Record<string, unknown>) =>
+		path`/zones/${request.zone_id}/settings/aegis`,
+} as const;
diff --git a/packages/cli/src/commands/_generated/email-domains/create.ts b/packages/cli/src/commands/_generated/email-domains/create.ts
new file mode 100644
index 0000000000..fd6d9d4ebb
--- /dev/null
+++ b/packages/cli/src/commands/_generated/email-domains/create.ts
@@ -0,0 +1,131 @@
+import operation from "../_operations/email-domains/create.js";
+import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
+import type { ArgClassification } from "#lib/telemetry/index.js";
+/**
+ * create command
+ * @generated from apis/overlays/email-domains.ts
+ */
+import type { Argv, CommandModule } from "yargs";
+import {
+	createCommandClient,
+	getAccountId,
+	resolveAccountIdSilent,
+} from "#lib/auth.js";
+import { compactBody, parseBody } from "#lib/body-parser.js";
+import { formatDryRun } from "#lib/dry-run.js";
+import { resolveFileToken } from "#lib/input-validation.js";
+import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
+import { formatOutput } from "#lib/output.js";
+import { withProgress } from "#lib/progress.js";
+import { promptForRequiredField } from "#lib/prompt.js";
+import { runWithTelemetry } from "#lib/telemetry/index.js";
+
+function builder(yargs: Argv<CommonYargsOptions>) {
+	return yargs
+		.usage(
+			"$0 email-domains create\n\nCreates a candidate and four DNS instructions. Rejects hostnames whose assigned Return-Path exceeds 201 ASCII characters. Creation follows read-only checks of the saved provider bundle and published exclusion. Hostnames inside an active full Cloudflare DNS zone return the generic hostname conflict error 2083. No per-domain provider DNS writes occur. Customer DNS observations remain pending and mail remains inactive. Unverified candidates may share a hostname. Supply an account-unique client_reference to retry the same enrollment safely; reuse with a different hostname returns error 2083. Final public-DNS, namespace protection and runtime readiness are separate gates. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope."
+		)
+		.option("client-reference", {
+			type: "string",
+			description:
+				"Opaque reference for one customer enrollment. Reuse it with the same hostname to retry Create safely. Distinct references can enroll the same unverified hostname; a hostname alone never identifies a customer.",
+		})
+		.option("hostname", {
+			type: "string",
+			description:
+				"Exact external hostname to enroll. After ASCII conversion, the assigned Return-Path hostname must be at most 201 characters (191 for the current cf-bounce. prefix). Wildcards, provider-zone names, and hostnames inside an existing Cloudflare-managed DNS zone are rejected.",
+		})
+		.option("dry-run", {
+			type: "boolean",
+			description: "Validate and show what would happen without executing",
+			default: false,
+		})
+		.option("body", {
+			type: "string",
+			description: "Raw JSON request body (bypasses individual flags)",
+		});
+}
+
+type Args = InferArgs<typeof builder>;
+
+const command: CommandModule<CommonYargsOptions, Args> = {
+	command: "create",
+	describe: "Create an Email Domain",
+	builder,
+	handler: async (argv): Promise<void> =>
+		runWithTelemetry(
+			{
+				command: "email-domains create",
+				classification: {
+					safeFlags: ["dry-run"],
+				} satisfies ArgClassification<Args>,
+			},
+			argv as Record<string, unknown>,
+			async () => {
+				if (argv.dryRun) {
+					const __cfDryRunAccountId = await resolveAccountIdSilent();
+					formatDryRun({
+						command: "cf email-domains create",
+						method: "POST",
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/email/domains`,
+						pathParams: {},
+						bodyKind: "json",
+						body:
+							argv.body !== undefined
+								? parseBody(argv.body)
+								: compactBody({
+										client_reference: resolveFileToken(
+											argv["client-reference"] as string | undefined,
+											"client-reference",
+											"text"
+										),
+										hostname: resolveFileToken(
+											argv["hostname"] as string | undefined,
+											"hostname",
+											"text"
+										),
+									}),
+					});
+					return;
+				}
+				const client = await createCommandClient(argv);
+				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
+				argv.accountId = accountId;
+
+				if (argv.body) {
+					const bodyData = parseBody(argv.body);
+					const result = await withProgress(`Creating`, async () =>
+						client.send(operation, { body: bodyData, account_id: accountId })
+					);
+					formatOutput(result, { successLabel: `Created` });
+					return;
+				}
+				if (argv["hostname"] === undefined) {
+					argv["hostname"] = await promptForRequiredField(
+						"hostname",
+						"Exact external hostname to enroll. After ASCII conversion, the assigned Return-Path hostname must be at most 201 characters (191 for the current cf-bounce. prefix). Wildcards, provider-zone names, and hostnames inside an existing Cloudflare-managed DNS zone are rejected."
+					);
+				}
+
+				// Assemble request body from individual flags
+				const bodyData = compactBody({
+					client_reference: resolveFileToken(
+						argv["client-reference"] as string | undefined,
+						"client-reference",
+						"text"
+					),
+					hostname: resolveFileToken(
+						argv["hostname"] as string | undefined,
+						"hostname",
+						"text"
+					),
+				});
+				const result = await withProgress(`Creating`, async () =>
+					client.send(operation, { body: bodyData, account_id: accountId })
+				);
+				formatOutput(result, { successLabel: `Created` });
+			}
+		),
+};
+
+export default command;
diff --git a/packages/cli/src/commands/_generated/logos/delete.ts b/packages/cli/src/commands/_generated/email-domains/delete.ts
similarity index 66%
rename from packages/cli/src/commands/_generated/logos/delete.ts
rename to packages/cli/src/commands/_generated/email-domains/delete.ts
index 40afd8a587..58d520b6e4 100644
--- a/packages/cli/src/commands/_generated/logos/delete.ts
+++ b/packages/cli/src/commands/_generated/email-domains/delete.ts
@@ -1,9 +1,9 @@
-import operation from "../_operations/logos/delete.js";
+import operation from "../_operations/email-domains/delete.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * delete command
- * @generated from apis/overlays/logos.ts
+ * @generated from apis/overlays/email-domains.ts
  */
 import type { Argv, CommandModule } from "yargs";
 import {
@@ -21,11 +21,11 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 logos delete <logo-id>\n\nReturn a success message after deleting saved logo queries by ID"
+			"$0 email-domains delete <email-domain-id>\n\nRequires an empty body. Unclaimed unpublished candidates are purged immediately. Claimed domains persist deleting state and retain claims until the deletion worker acknowledges safe revocation and token retirement. Repeated requests while deleting are idempotent. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope."
 		)
-		.positional("logo-id", {
+		.positional("email-domain-id", {
 			type: "string",
-			description: "Logo ID",
+			description: "Email domain ID",
 			demandOption: true,
 		})
 		.option("dry-run", {
@@ -44,13 +44,13 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "delete <logo-id>",
-	describe: "Delete saved logo queries by ID",
+	command: "delete <email-domain-id>",
+	describe: "Delete an Email Domain",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "logos delete",
+				command: "email-domains delete",
 				classification: {
 					safeFlags: ["dry-run", "force"],
 					shortFlagAliases: { f: { canonical: "force", type: "boolean" } },
@@ -61,10 +61,12 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				if (argv.dryRun) {
 					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf logos delete",
+						command: "cf email-domains delete",
 						method: "DELETE",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/logos/${argv["logo-id"] == null ? "<logo-id>" : encodeURIComponent(String(argv["logo-id"]))}`,
-						pathParams: { "logo-id": String(argv["logo-id"] ?? "") },
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/email/domains/${argv["email-domain-id"] == null ? "<email-domain-id>" : encodeURIComponent(String(argv["email-domain-id"]))}`,
+						pathParams: {
+							"email-domain-id": String(argv["email-domain-id"] ?? ""),
+						},
 						bodyKind: "none",
 					});
 					return;
@@ -80,7 +82,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				const result = await withProgress(`Deleting`, async () =>
 					client.send(operation, {
 						account_id: accountId,
-						logo_id: argv["logo-id"],
+						email_domain_id: argv["email-domain-id"],
 					})
 				);
 				formatOutput(result, { successLabel: `Deleted` });
diff --git a/packages/cli/src/commands/_generated/logo-matches/download/get.ts b/packages/cli/src/commands/_generated/email-domains/get.ts
similarity index 59%
rename from packages/cli/src/commands/_generated/logo-matches/download/get.ts
rename to packages/cli/src/commands/_generated/email-domains/get.ts
index ae00784fcb..a77ec2ff32 100644
--- a/packages/cli/src/commands/_generated/logo-matches/download/get.ts
+++ b/packages/cli/src/commands/_generated/email-domains/get.ts
@@ -1,9 +1,9 @@
-import operation from "../../_operations/logo-matches/download/get.js";
+import operation from "../_operations/email-domains/get.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * get command
- * @generated from apis/overlays/logo-matches.ts
+ * @generated from apis/overlays/email-domains.ts
  */
 import type { Argv, CommandModule } from "yargs";
 import {
@@ -20,11 +20,13 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 logo-matches download get\n\nReturn matches as CSV for logo queries based on ID"
+			"$0 email-domains get <email-domain-id>\n\nReturns domain status and its four assigned DNS records. Shared provider health is reported by the capability states rather than duplicated on each DNS record. Expired unclaimed candidates and completed deletions return 404. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope."
 		)
-		.option("logo-id", { type: "string", description: "Logo ID" })
-		.option("offset", { type: "string", description: "Offset" })
-		.option("limit", { type: "string", description: "Limit" })
+		.positional("email-domain-id", {
+			type: "string",
+			description: "Email domain ID",
+			demandOption: true,
+		})
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
@@ -35,32 +37,28 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "get",
-	describe: "Download matches for logo queries by ID",
+	command: "get <email-domain-id>",
+	describe: "Get an Email Domain",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "logo-matches download get",
+				command: "email-domains get",
 				classification: {
 					safeFlags: ["dry-run"],
 				} satisfies ArgClassification<Args>,
 			},
 			argv as Record<string, unknown>,
 			async () => {
-				const queryParams: Record<string, unknown> = {
-					logo_id: argv["logo-id"],
-					offset: argv["offset"],
-					limit: argv["limit"],
-				};
 				if (argv.dryRun) {
 					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf logo-matches download get",
+						command: "cf email-domains get",
 						method: "GET",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/logo-matches/download`,
-						pathParams: {},
-						query: queryParams,
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/email/domains/${argv["email-domain-id"] == null ? "<email-domain-id>" : encodeURIComponent(String(argv["email-domain-id"]))}`,
+						pathParams: {
+							"email-domain-id": String(argv["email-domain-id"] ?? ""),
+						},
 						bodyKind: "none",
 					});
 					return;
@@ -70,7 +68,10 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				argv.accountId = accountId;
 
 				const result = await withProgress(`Loading`, async () =>
-					client.send(operation, { account_id: accountId, ...queryParams })
+					client.send(operation, {
+						account_id: accountId,
+						email_domain_id: argv["email-domain-id"],
+					})
 				);
 				formatOutput(result, { successLabel: `Loaded` });
 			}
diff --git a/packages/cli/src/commands/_generated/logos/index.ts b/packages/cli/src/commands/_generated/email-domains/index.ts
similarity index 59%
rename from packages/cli/src/commands/_generated/logos/index.ts
rename to packages/cli/src/commands/_generated/email-domains/index.ts
index 1694fdcca7..be973e5b9e 100644
--- a/packages/cli/src/commands/_generated/logos/index.ts
+++ b/packages/cli/src/commands/_generated/email-domains/index.ts
@@ -1,20 +1,26 @@
 import $create from "./create.js";
 import $delete from "./delete.js";
+import $get from "./get.js";
+import $list from "./list.js";
+import $verify from "./verify.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * logos command
- * @generated from apis/overlays/logos.ts
+ * email-domains command
+ * @generated from apis/overlays/email-domains.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "logos",
-	describe: "logos",
+	command: "email-domains",
+	describe: "email-domains",
 
 	builder: (yargs) => {
 		return yargs
 			.command($create)
 			.command($delete)
+			.command($get)
+			.command($list)
+			.command($verify)
 			.demandCommand(1, "Please specify a subcommand");
 	},
 
diff --git a/packages/cli/src/commands/_generated/matches/download/get.ts b/packages/cli/src/commands/_generated/email-domains/list.ts
similarity index 58%
rename from packages/cli/src/commands/_generated/matches/download/get.ts
rename to packages/cli/src/commands/_generated/email-domains/list.ts
index a801d32955..c9db72e163 100644
--- a/packages/cli/src/commands/_generated/matches/download/get.ts
+++ b/packages/cli/src/commands/_generated/email-domains/list.ts
@@ -1,9 +1,9 @@
-import operation from "../../_operations/matches/download/get.js";
+import operation from "../_operations/email-domains/list.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
- * get command
- * @generated from apis/overlays/matches.ts
+ * list command
+ * @generated from apis/overlays/email-domains.ts
  */
 import type { Argv, CommandModule } from "yargs";
 import {
@@ -20,18 +20,23 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 matches download get\n\nReturn matches as CSV for string queries based on ID"
+			"$0 email-domains list\n\nReturns account-scoped domain status. DNS records are omitted unless requested; exact hostname filtering may return several candidates; retain the EmailDomain ID for each enrollment. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope."
 		)
-		.option("id", { type: "string", description: "ID" })
-		.option("offset", { type: "number", description: "Offset" })
-		.option("limit", { type: "number", description: "Limit" })
-		.option("include-domain-id", {
-			type: "boolean",
-			description: "Include domain ID",
+		.option("per-page", { type: "number", description: "Per page" })
+		.option("cursor", {
+			type: "string",
+			description:
+				"Opaque cursor returned by the previous page. Omit it for the first page.",
 		})
-		.option("include-dismissed", {
-			type: "boolean",
-			description: "Include dismissed",
+		.option("hostname", {
+			type: "string",
+			description:
+				"Exact hostname filter for recovering an ambiguous create response.",
+		})
+		.option("include", {
+			type: "string",
+			description: "Include DNS instructions on each list result.",
+			choices: ["dns_records"],
 		})
 		.option("dry-run", {
 			type: "boolean",
@@ -43,32 +48,31 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "get",
-	describe: "Download matches for string queries by ID",
+	command: "list",
+	describe: "List Email Domains",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "matches download get",
+				command: "email-domains list",
 				classification: {
-					safeFlags: ["include-domain-id", "include-dismissed", "dry-run"],
+					safeFlags: ["include", "dry-run"],
 				} satisfies ArgClassification<Args>,
 			},
 			argv as Record<string, unknown>,
 			async () => {
 				const queryParams: Record<string, unknown> = {
-					id: argv["id"],
-					offset: argv["offset"],
-					limit: argv["limit"],
-					include_domain_id: argv["include-domain-id"],
-					include_dismissed: argv["include-dismissed"],
+					per_page: argv["per-page"],
+					cursor: argv["cursor"],
+					hostname: argv["hostname"],
+					include: argv["include"],
 				};
 				if (argv.dryRun) {
 					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf matches download get",
+						command: "cf email-domains list",
 						method: "GET",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/matches/download`,
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/email/domains`,
 						pathParams: {},
 						query: queryParams,
 						bodyKind: "none",
diff --git a/packages/cli/src/commands/_generated/queries/bulk/create.ts b/packages/cli/src/commands/_generated/email-domains/verify.ts
similarity index 52%
rename from packages/cli/src/commands/_generated/queries/bulk/create.ts
rename to packages/cli/src/commands/_generated/email-domains/verify.ts
index 7810e68ba5..5677682153 100644
--- a/packages/cli/src/commands/_generated/queries/bulk/create.ts
+++ b/packages/cli/src/commands/_generated/email-domains/verify.ts
@@ -1,9 +1,9 @@
-import operation from "../../_operations/queries/bulk/create.js";
+import operation from "../_operations/email-domains/verify.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
- * create command
- * @generated from apis/overlays/queries.ts
+ * verify command
+ * @generated from apis/overlays/email-domains.ts
  */
 import type { Argv, CommandModule } from "yargs";
 import {
@@ -11,7 +11,6 @@ import {
 	getAccountId,
 	resolveAccountIdSilent,
 } from "#lib/auth.js";
-import { compactBody, parseBody, parseObjectArray } from "#lib/body-parser.js";
 import { formatDryRun } from "#lib/dry-run.js";
 import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
 import { formatOutput } from "#lib/output.js";
@@ -21,34 +20,30 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 queries bulk create\n\nReturn a success message after creating new saved string queries in bulk"
+			"$0 email-domains verify <email-domain-id>\n\nRequires an empty body. Schedules an expedited check and coalesces queued or leased work. It does not accept verification results, bypass activation gates, or perform customer DNS checks synchronously. Follow the Location header after Retry-After seconds until verification.observed_at appears or advances beyond the value in this 202 response; status may remain unchanged. Candidate expiry returns 404. Available only to the configured OpenAI pilot account behind a default-off gate. Authentication failures may use the gateway error envelope."
 		)
-		.option("queries", {
+		.positional("email-domain-id", {
 			type: "string",
-			description:
-				"The queries field. Provide as a JSON array of objects or @path/to/file.json.",
+			description: "Email domain ID",
+			demandOption: true,
 		})
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
 			default: false,
-		})
-		.option("body", {
-			type: "string",
-			description: "Raw JSON request body (bypasses individual flags)",
 		});
 }
 
 type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "create",
-	describe: "Create new saved string queries in bulk",
+	command: "verify <email-domain-id>",
+	describe: "Verify an Email Domain",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "queries bulk create",
+				command: "email-domains verify",
 				classification: {
 					safeFlags: ["dry-run"],
 				} satisfies ArgClassification<Args>,
@@ -58,17 +53,13 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				if (argv.dryRun) {
 					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf queries bulk create",
+						command: "cf email-domains verify",
 						method: "POST",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/queries/bulk`,
-						pathParams: {},
-						bodyKind: "json",
-						body:
-							argv.body !== undefined
-								? parseBody(argv.body)
-								: compactBody({
-										queries: parseObjectArray(argv["queries"], "queries"),
-									}),
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/email/domains/${argv["email-domain-id"] == null ? "<email-domain-id>" : encodeURIComponent(String(argv["email-domain-id"]))}/verify`,
+						pathParams: {
+							"email-domain-id": String(argv["email-domain-id"] ?? ""),
+						},
+						bodyKind: "none",
 					});
 					return;
 				}
@@ -76,21 +67,11 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
 				argv.accountId = accountId;
 
-				if (argv.body) {
-					const bodyData = parseBody(argv.body);
-					const result = await withProgress(`Creating`, async () =>
-						client.send(operation, { body: bodyData, account_id: accountId })
-					);
-					formatOutput(result, { successLabel: `Created` });
-					return;
-				}
-
-				// Assemble request body from individual flags
-				const bodyData = compactBody({
-					queries: parseObjectArray(argv["queries"], "queries"),
-				});
 				const result = await withProgress(`Creating`, async () =>
-					client.send(operation, { body: bodyData, account_id: accountId })
+					client.send(operation, {
+						account_id: accountId,
+						email_domain_id: argv["email-domain-id"],
+					})
 				);
 				formatOutput(result, { successLabel: `Created` });
 			}
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/create.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/create.ts
index b890d689f5..63eb6ba576 100644
--- a/packages/cli/src/commands/_generated/flagship/apps/flags/create.ts
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/create.ts
@@ -28,7 +28,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 flagship apps flags create <app-id>\n\nCreates a flag. Returns 409 if the key already exists. `type` is always inferred from variation values; legacy request-side values are ignored."
+			"$0 flagship apps flags create <app-id>\n\nCreates a flag. Returns 409 if the key already exists. `type` is always inferred from variation values; legacy request-side values are ignored. Optional `metadata` can be attached at creation."
 		)
 		.positional("app-id", {
 			type: "string",
@@ -55,6 +55,11 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 			description:
 				"Unique identifier for the flag within an app. Used in all evaluation and SDK calls.",
 		})
+		.option("metadata", {
+			type: "string",
+			description:
+				"Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json.",
+		})
 		.option("rules", {
 			type: "string",
 			description:
@@ -130,6 +135,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 												"key",
 												"text"
 											),
+											metadata: parseJsonMap(argv["metadata"], "metadata"),
 											rules: parseObjectArray(argv["rules"], "rules"),
 											type: argv["type"],
 											variations: parseJsonMap(
@@ -138,7 +144,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 												true
 											),
 										},
-										[["variations"]]
+										[["metadata"], ["variations"]]
 									),
 					});
 					return;
@@ -208,11 +214,12 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 							"key",
 							"text"
 						),
+						metadata: parseJsonMap(argv["metadata"], "metadata"),
 						rules: parseObjectArray(argv["rules"], "rules"),
 						type: argv["type"],
 						variations: parseJsonMap(argv["variations"], "variations", true),
 					},
-					[["variations"]]
+					[["metadata"], ["variations"]]
 				);
 				const result = await withProgress(`Creating`, async () =>
 					client.send(operation, {
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/evaluate.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/evaluate.ts
index 3a014cbd7f..ef13de7b9a 100644
--- a/packages/cli/src/commands/_generated/flagship/apps/flags/evaluate.ts
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/evaluate.ts
@@ -33,7 +33,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 		.option("context", {
 			type: "string",
 			description:
-				"Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries and 32 KB. Provide as a JSON object or @path/to/file.json.",
+				"Evaluation attributes keyed by name. Values may be any JSON value; the context supports up to 100 entries, nesting depth of 10, 10,000 values, and 32 KB. Provide as a JSON object or @path/to/file.json.",
 		})
 		.option("flag-key", {
 			type: "string",
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/get.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/get.ts
index c9a16de244..6f88452a2b 100644
--- a/packages/cli/src/commands/_generated/flagship/apps/flags/get.ts
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/get.ts
@@ -20,7 +20,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 flagship apps flags get <flag-key>\n\nReturns the full flag definition including rules, variations, and audit fields."
+			"$0 flagship apps flags get <flag-key>\n\nReturns the full flag definition including rules, variations, metadata, and audit fields."
 		)
 		.positional("flag-key", {
 			type: "string",
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/index.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/index.ts
index 36a19cfe13..653dc7db52 100644
--- a/packages/cli/src/commands/_generated/flagship/apps/flags/index.ts
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/index.ts
@@ -4,6 +4,7 @@ import $delete from "./delete.js";
 import $evaluate from "./evaluate.js";
 import $get from "./get.js";
 import $list from "./list.js";
+import $patch from "./patch.js";
 import $update from "./update.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
@@ -23,6 +24,7 @@ const command: CommandModule<CommonYargsOptions> = {
 			.command($evaluate)
 			.command($get)
 			.command($list)
+			.command($patch)
 			.command($update)
 			.command($changelog)
 			.demandCommand(1, "Please specify a subcommand");
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/patch.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/patch.ts
new file mode 100644
index 0000000000..43a7829f44
--- /dev/null
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/patch.ts
@@ -0,0 +1,167 @@
+import operation from "../../../_operations/flagship/apps/flags/patch.js";
+import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
+import type { ArgClassification } from "#lib/telemetry/index.js";
+/**
+ * patch command
+ * @generated from apis/overlays/flagship.ts
+ */
+import type { Argv, CommandModule } from "yargs";
+import {
+	createCommandClient,
+	getAccountId,
+	resolveAccountIdSilent,
+} from "#lib/auth.js";
+import { compactBody, parseBody, parseJsonMap } from "#lib/body-parser.js";
+import { formatDryRun } from "#lib/dry-run.js";
+import { resolveFileToken } from "#lib/input-validation.js";
+import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
+import { formatOutput } from "#lib/output.js";
+import { withProgress } from "#lib/progress.js";
+import { runWithTelemetry } from "#lib/telemetry/index.js";
+
+function builder(yargs: Argv<CommonYargsOptions>) {
+	return yargs
+		.usage(
+			"$0 flagship apps flags patch <flag-key>\n\nApplies a partial update to lightweight flag fields: `enabled`, `description`, `metadata`, and `default_variation`. Only fields present in the request body are modified; omitted fields are preserved. `metadata: null` or an empty object clears metadata. `default_variation` must exist in the current `variations`. Structural changes to `variations` and `rules` use PUT. A changelog entry is appended when the flag content actually changes."
+		)
+		.positional("flag-key", {
+			type: "string",
+			description: "Case-sensitive key identifying the flag within the app.",
+			demandOption: true,
+		})
+		.option("app-id", {
+			type: "string",
+			description: "Flagship app ID returned when the app was created.",
+			demandOption: true,
+		})
+		.option("default-variation", {
+			type: "string",
+			description:
+				"Variation the API serves when the flag is off, or when it's on but no rule matches the context. Must be a key in `variations`.",
+		})
+		.option("description", {
+			type: "string",
+			description:
+				"Optional operator-facing description. It does not affect flag evaluation.",
+		})
+		.option("enabled", {
+			type: "boolean",
+			description:
+				"When false, the flag bypasses all rules and always serves `default_variation`.",
+		})
+		.option("metadata", {
+			type: "string",
+			description:
+				"Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json.",
+		})
+		.option("dry-run", {
+			type: "boolean",
+			description: "Validate and show what would happen without executing",
+			default: false,
+		})
+		.option("body", {
+			type: "string",
+			description: "Raw JSON request body (bypasses individual flags)",
+		});
+}
+
+type Args = InferArgs<typeof builder>;
+
+const command: CommandModule<CommonYargsOptions, Args> = {
+	command: "patch <flag-key>",
+	describe: "Partially update flag",
+	builder,
+	handler: async (argv): Promise<void> =>
+		runWithTelemetry(
+			{
+				command: "flagship apps flags patch",
+				classification: {
+					safeFlags: ["enabled", "dry-run"],
+				} satisfies ArgClassification<Args>,
+			},
+			argv as Record<string, unknown>,
+			async () => {
+				if (argv.dryRun) {
+					const __cfDryRunAccountId = await resolveAccountIdSilent();
+					formatDryRun({
+						command: "cf flagship apps flags patch",
+						method: "PATCH",
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/flagship/apps/${argv["app-id"] == null ? "<app-id>" : encodeURIComponent(String(argv["app-id"]))}/flags/${argv["flag-key"] == null ? "<flag-key>" : encodeURIComponent(String(argv["flag-key"]))}`,
+						pathParams: {
+							"app-id": String(argv["app-id"] ?? ""),
+							"flag-key": String(argv["flag-key"] ?? ""),
+						},
+						bodyKind: "json",
+						body:
+							argv.body !== undefined
+								? parseBody(argv.body)
+								: compactBody(
+										{
+											default_variation: resolveFileToken(
+												argv["default-variation"] as string | undefined,
+												"default-variation",
+												"text"
+											),
+											description: resolveFileToken(
+												argv["description"] as string | undefined,
+												"description",
+												"text"
+											),
+											enabled: argv["enabled"],
+											metadata: parseJsonMap(argv["metadata"], "metadata"),
+										},
+										[["metadata"]]
+									),
+					});
+					return;
+				}
+				const client = await createCommandClient(argv);
+				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
+				argv.accountId = accountId;
+
+				if (argv.body) {
+					const bodyData = parseBody(argv.body);
+					const result = await withProgress(`Updating`, async () =>
+						client.send(operation, {
+							body: bodyData,
+							account_id: accountId,
+							app_id: argv["app-id"],
+							flag_key: argv["flag-key"],
+						})
+					);
+					formatOutput(result, { successLabel: `Updated` });
+					return;
+				}
+
+				// Assemble request body from individual flags
+				const bodyData = compactBody(
+					{
+						default_variation: resolveFileToken(
+							argv["default-variation"] as string | undefined,
+							"default-variation",
+							"text"
+						),
+						description: resolveFileToken(
+							argv["description"] as string | undefined,
+							"description",
+							"text"
+						),
+						enabled: argv["enabled"],
+						metadata: parseJsonMap(argv["metadata"], "metadata"),
+					},
+					[["metadata"]]
+				);
+				const result = await withProgress(`Updating`, async () =>
+					client.send(operation, {
+						body: bodyData,
+						account_id: accountId,
+						app_id: argv["app-id"],
+						flag_key: argv["flag-key"],
+					})
+				);
+				formatOutput(result, { successLabel: `Updated` });
+			}
+		),
+};
+
+export default command;
diff --git a/packages/cli/src/commands/_generated/flagship/apps/flags/update.ts b/packages/cli/src/commands/_generated/flagship/apps/flags/update.ts
index f1a9c2658b..94ccaf5700 100644
--- a/packages/cli/src/commands/_generated/flagship/apps/flags/update.ts
+++ b/packages/cli/src/commands/_generated/flagship/apps/flags/update.ts
@@ -28,7 +28,7 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 flagship apps flags update <flag-key>\n\nReplaces the entire flag definition. Omitted fields are dropped, not preserved — read before writing. The path key identifies the flag and cannot be renamed by changing the body `key`. Each update appends a changelog entry."
+			"$0 flagship apps flags update <flag-key>\n\nReplaces the entire flag definition. Omitted fields are cleared, not preserved — read before writing. The path key identifies the flag and cannot be renamed by changing the body `key`. A changelog entry is appended when the flag content actually changes; identical updates are no-ops."
 		)
 		.positional("flag-key", {
 			type: "string",
@@ -60,6 +60,11 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 			description:
 				"Unique identifier for the flag within an app. Used in all evaluation and SDK calls.",
 		})
+		.option("metadata", {
+			type: "string",
+			description:
+				"Key-value metadata associated with the flag. `null` or an empty object clears existing metadata; omission semantics depend on the endpoint (PUT clears it, PATCH preserves it). Provide as a JSON object or @path/to/file.json.",
+		})
 		.option("rules", {
 			type: "string",
 			description:
@@ -138,6 +143,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 												"key",
 												"text"
 											),
+											metadata: parseJsonMap(argv["metadata"], "metadata"),
 											rules: parseObjectArray(argv["rules"], "rules"),
 											type: argv["type"],
 											variations: parseJsonMap(
@@ -146,7 +152,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 												true
 											),
 										},
-										[["variations"]]
+										[["metadata"], ["variations"]]
 									),
 					});
 					return;
@@ -217,11 +223,12 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 							"key",
 							"text"
 						),
+						metadata: parseJsonMap(argv["metadata"], "metadata"),
 						rules: parseObjectArray(argv["rules"], "rules"),
 						type: argv["type"],
 						variations: parseJsonMap(argv["variations"], "variations", true),
 					},
-					[["variations"]]
+					[["metadata"], ["variations"]]
 				);
 				const result = await withProgress(`Updating`, async () =>
 					client.send(operation, {
diff --git a/packages/cli/src/commands/_generated/index.ts b/packages/cli/src/commands/_generated/index.ts
index 4e854affa2..ee3d2c6061 100644
--- a/packages/cli/src/commands/_generated/index.ts
+++ b/packages/cli/src/commands/_generated/index.ts
@@ -424,7 +424,7 @@ export const generatedCommands: GeneratedCommand[] = [
 			() => import("./dns-firewall/index.js"),
 			null
 		),
-		hideCommand: true,
+		hideCommand: false,
 	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
@@ -444,6 +444,15 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
+	{
+		command: lazyCommand<CommonYargsOptions>(
+			"email-domains",
+			"email-domains",
+			() => import("./email-domains/index.js"),
+			null
+		),
+		hideCommand: true,
+	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"email-routing",
@@ -561,6 +570,15 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
+	{
+		command: lazyCommand<CommonYargsOptions>(
+			"internal",
+			"internal",
+			() => import("./internal/index.js"),
+			null
+		),
+		hideCommand: true,
+	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"ips",
@@ -599,30 +617,21 @@ export const generatedCommands: GeneratedCommand[] = [
 	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
-			"load-balancers",
-			"Distribute traffic across origin pools with health monitoring, geo-steering, and failover",
-			() => import("./load-balancers/index.js"),
-			null
-		),
-		hideCommand: false,
-	},
-	{
-		command: lazyCommand<CommonYargsOptions>(
-			"logo-matches",
-			"logo-matches",
-			() => import("./logo-matches/index.js"),
+			"live",
+			"live",
+			() => import("./live/index.js"),
 			null
 		),
 		hideCommand: true,
 	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
-			"logos",
-			"logos",
-			() => import("./logos/index.js"),
+			"load-balancers",
+			"Distribute traffic across origin pools with health monitoring, geo-steering, and failover",
+			() => import("./load-balancers/index.js"),
 			null
 		),
-		hideCommand: true,
+		hideCommand: false,
 	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
@@ -687,15 +696,6 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: true,
 	},
-	{
-		command: lazyCommand<CommonYargsOptions>(
-			"matches",
-			"matches",
-			() => import("./matches/index.js"),
-			null
-		),
-		hideCommand: true,
-	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"mcp",
@@ -858,15 +858,6 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
-	{
-		command: lazyCommand<CommonYargsOptions>(
-			"queries",
-			"queries",
-			() => import("./queries/index.js"),
-			null
-		),
-		hideCommand: true,
-	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"queues",
@@ -894,6 +885,15 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
+	{
+		command: lazyCommand<CommonYargsOptions>(
+			"ready",
+			"ready",
+			() => import("./ready/index.js"),
+			null
+		),
+		hideCommand: true,
+	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"realtime",
@@ -1011,6 +1011,15 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
+	{
+		command: lazyCommand<CommonYargsOptions>(
+			"signed-url",
+			"signed-url",
+			() => import("./signed-url/index.js"),
+			null
+		),
+		hideCommand: true,
+	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"smart-shield",
@@ -1074,15 +1083,6 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
-	{
-		command: lazyCommand<CommonYargsOptions>(
-			"submit",
-			"submit",
-			() => import("./submit/index.js"),
-			null
-		),
-		hideCommand: true,
-	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"tags",
@@ -1128,15 +1128,6 @@ export const generatedCommands: GeneratedCommand[] = [
 		),
 		hideCommand: false,
 	},
-	{
-		command: lazyCommand<CommonYargsOptions>(
-			"url-info",
-			"url-info",
-			() => import("./url-info/index.js"),
-			null
-		),
-		hideCommand: true,
-	},
 	{
 		command: lazyCommand<CommonYargsOptions>(
 			"url-normalization",
diff --git a/packages/cli/src/commands/_generated/intel/indicator-feeds/index.ts b/packages/cli/src/commands/_generated/intel/indicator-feeds/index.ts
index d6574391d6..323e6562c2 100644
--- a/packages/cli/src/commands/_generated/intel/indicator-feeds/index.ts
+++ b/packages/cli/src/commands/_generated/intel/indicator-feeds/index.ts
@@ -7,6 +7,7 @@ import $permissions from "./permissions/index.js";
 import $providers from "./providers/index.js";
 import $snapshots from "./snapshots/index.js";
 import $update from "./update.js";
+import $uploads from "./uploads/index.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
  * indicator-feeds command group
@@ -30,6 +31,7 @@ const command: CommandModule<CommonYargsOptions> = {
 			.command($permissions)
 			.command($providers)
 			.command($snapshots)
+			.command($uploads)
 			.demandCommand(1, "Please specify a subcommand");
 	},
 
diff --git a/packages/cli/src/commands/_generated/intel/indicator-feeds/providers/create.ts b/packages/cli/src/commands/_generated/intel/indicator-feeds/providers/create.ts
index 840fddc8a4..bc2b0a8b5b 100644
--- a/packages/cli/src/commands/_generated/intel/indicator-feeds/providers/create.ts
+++ b/packages/cli/src/commands/_generated/intel/indicator-feeds/providers/create.ts
@@ -25,7 +25,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 			description: "Identifier",
 			demandOption: true,
 		})
-		.option("account-id", {
+		.option("account-id-body", {
 			type: "number",
 			description:
 				"The numeric account ID to create the provider for. Distinct from the\npath `account_id` parameter, which carries the account identifier\nstring used for routing.\n",
@@ -71,7 +71,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 							argv.body !== undefined
 								? parseBody(argv.body)
 								: compactBody({
-										account_id: argv["account-id"],
+										account_id: argv["account-id-body"],
 										name: resolveFileToken(
 											argv["name"] as string | undefined,
 											"name",
@@ -94,9 +94,9 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 					formatOutput(result, { successLabel: `Updated` });
 					return;
 				}
-				if (argv["account-id"] === undefined) {
+				if (argv["account-id-body"] === undefined) {
 					throw new Error(
-						"--account-id is required (or pass --body with this field set)."
+						"--account-id-body is required (or pass --body with this field set)."
 					);
 				}
 				if (argv["name"] === undefined) {
@@ -108,7 +108,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 
 				// Assemble request body from individual flags
 				const bodyData = compactBody({
-					account_id: argv["account-id"],
+					account_id: argv["account-id-body"],
 					name: resolveFileToken(
 						argv["name"] as string | undefined,
 						"name",
diff --git a/packages/cli/src/commands/_generated/logo-matches/get.ts b/packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/get.ts
similarity index 55%
rename from packages/cli/src/commands/_generated/logo-matches/get.ts
rename to packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/get.ts
index 95bf69cd09..216c0a7153 100644
--- a/packages/cli/src/commands/_generated/logo-matches/get.ts
+++ b/packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/get.ts
@@ -1,9 +1,9 @@
-import operation from "../_operations/logo-matches/get.js";
+import operation from "../../../_operations/intel/indicator-feeds/uploads/get.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * get command
- * @generated from apis/overlays/logo-matches.ts
+ * @generated from apis/overlays/intel.ts
  */
 import type { Argv, CommandModule } from "yargs";
 import {
@@ -19,10 +19,19 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
-		.usage("$0 logo-matches get\n\nReturn matches for logo queries based on ID")
-		.option("logo-id", { type: "string", description: "Logo ID" })
-		.option("offset", { type: "string", description: "Offset" })
-		.option("limit", { type: "string", description: "Limit" })
+		.usage(
+			"$0 intel indicator-feeds uploads get <upload-id>\n\nPolls an asynchronously accepted upload. Continue polling after the recommended `poll_after_seconds` delay until status is `Unified` or `Error`. `Unified` is returned only after the durable loader finishes."
+		)
+		.positional("upload-id", {
+			type: "string",
+			description: "Upload ID",
+			demandOption: true,
+		})
+		.option("feed-id", {
+			type: "string",
+			description: "Indicator feed ID",
+			demandOption: true,
+		})
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
@@ -33,32 +42,29 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "get",
-	describe: "Read matches for logo queries by ID",
+	command: "get <upload-id>",
+	describe: "Get indicator feed upload status",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "logo-matches get",
+				command: "intel indicator-feeds uploads get",
 				classification: {
 					safeFlags: ["dry-run"],
 				} satisfies ArgClassification<Args>,
 			},
 			argv as Record<string, unknown>,
 			async () => {
-				const queryParams: Record<string, unknown> = {
-					logo_id: argv["logo-id"],
-					offset: argv["offset"],
-					limit: argv["limit"],
-				};
 				if (argv.dryRun) {
 					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf logo-matches get",
+						command: "cf intel indicator-feeds uploads get",
 						method: "GET",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/logo-matches`,
-						pathParams: {},
-						query: queryParams,
+						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/intel/indicator-feeds/${argv["feed-id"] == null ? "<feed-id>" : encodeURIComponent(String(argv["feed-id"]))}/uploads/${argv["upload-id"] == null ? "<upload-id>" : encodeURIComponent(String(argv["upload-id"]))}`,
+						pathParams: {
+							"feed-id": String(argv["feed-id"] ?? ""),
+							"upload-id": String(argv["upload-id"] ?? ""),
+						},
 						bodyKind: "none",
 					});
 					return;
@@ -68,7 +74,11 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 				argv.accountId = accountId;
 
 				const result = await withProgress(`Loading`, async () =>
-					client.send(operation, { account_id: accountId, ...queryParams })
+					client.send(operation, {
+						account_id: accountId,
+						feed_id: argv["feed-id"],
+						upload_id: argv["upload-id"],
+					})
 				);
 				formatOutput(result, { successLabel: `Loaded` });
 			}
diff --git a/packages/cli/src/commands/_generated/matches/index.ts b/packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/index.ts
similarity index 51%
rename from packages/cli/src/commands/_generated/matches/index.ts
rename to packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/index.ts
index a7d247ff2f..fe85cdb8e4 100644
--- a/packages/cli/src/commands/_generated/matches/index.ts
+++ b/packages/cli/src/commands/_generated/intel/indicator-feeds/uploads/index.ts
@@ -1,21 +1,17 @@
-import $download from "./download/index.js";
 import $get from "./get.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * matches command
- * @generated from apis/overlays/matches.ts
+ * uploads command group
+ * @generated from apis/overlays/intel.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "matches",
-	describe: "matches",
+	command: "uploads",
+	describe: "Operations for indicator-feeds.uploads",
 
 	builder: (yargs) => {
-		return yargs
-			.command($get)
-			.command($download)
-			.demandCommand(1, "Please specify a subcommand");
+		return yargs.command($get).demandCommand(1, "Please specify a subcommand");
 	},
 
 	handler: () => {},
diff --git a/packages/cli/src/commands/_generated/queries/bulk/index.ts b/packages/cli/src/commands/_generated/internal/index.ts
similarity index 64%
rename from packages/cli/src/commands/_generated/queries/bulk/index.ts
rename to packages/cli/src/commands/_generated/internal/index.ts
index 08bdedf4d7..3500051c0d 100644
--- a/packages/cli/src/commands/_generated/queries/bulk/index.ts
+++ b/packages/cli/src/commands/_generated/internal/index.ts
@@ -1,18 +1,18 @@
-import $create from "./create.js";
+import $submit from "./submit/index.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * bulk command group
- * @generated from apis/overlays/queries.ts
+ * internal command
+ * @generated from apis/overlays/internal.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "bulk",
-	describe: "Operations for bulk",
+	command: "internal",
+	describe: "internal",
 
 	builder: (yargs) => {
 		return yargs
-			.command($create)
+			.command($submit)
 			.demandCommand(1, "Please specify a subcommand");
 	},
 
diff --git a/packages/cli/src/commands/_generated/submit/create.ts b/packages/cli/src/commands/_generated/internal/submit/create.ts
similarity index 63%
rename from packages/cli/src/commands/_generated/submit/create.ts
rename to packages/cli/src/commands/_generated/internal/submit/create.ts
index 02962c0430..5254b312a0 100644
--- a/packages/cli/src/commands/_generated/submit/create.ts
+++ b/packages/cli/src/commands/_generated/internal/submit/create.ts
@@ -1,25 +1,22 @@
-import operation from "../_operations/submit/create.js";
+import operation from "../../_operations/internal/submit/create.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * create command
- * @generated from apis/overlays/submit.ts
+ * @generated from apis/overlays/internal.ts
  */
 import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
+import { createCommandClient } from "#lib/auth.js";
 import { formatDryRun } from "#lib/dry-run.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
 import { formatOutput } from "#lib/output.js";
 import { withProgress } from "#lib/progress.js";
 import { runWithTelemetry } from "#lib/telemetry/index.js";
 
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
-		.usage("$0 submit create\n\nReturn new URL submissions")
+		.usage(
+			"$0 internal submit create\n\nInternal route for testing URL submissions."
+		)
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
@@ -31,12 +28,12 @@ type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
 	command: "create",
-	describe: "Create new URL submissions",
+	describe: "Internal route for testing URL submissions",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "submit create",
+				command: "internal submit create",
 				classification: {
 					safeFlags: ["dry-run"],
 				} satisfies ArgClassification<Args>,
@@ -44,22 +41,19 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 			argv as Record<string, unknown>,
 			async () => {
 				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf submit create",
+						command: "cf internal submit create",
 						method: "POST",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/submit`,
+						url: `https://api.cloudflare.com/client/v4/internal/submit`,
 						pathParams: {},
 						bodyKind: "none",
 					});
 					return;
 				}
 				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
 
 				const result = await withProgress(`Creating`, async () =>
-					client.send(operation, { account_id: accountId })
+					client.send(operation)
 				);
 				formatOutput(result, { successLabel: `Created` });
 			}
diff --git a/packages/cli/src/commands/_generated/submit/index.ts b/packages/cli/src/commands/_generated/internal/submit/index.ts
similarity index 78%
rename from packages/cli/src/commands/_generated/submit/index.ts
rename to packages/cli/src/commands/_generated/internal/submit/index.ts
index 21b95a14ba..1988e247ce 100644
--- a/packages/cli/src/commands/_generated/submit/index.ts
+++ b/packages/cli/src/commands/_generated/internal/submit/index.ts
@@ -1,14 +1,14 @@
 import $create from "./create.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * submit command
- * @generated from apis/overlays/submit.ts
+ * submit command group
+ * @generated from apis/overlays/internal.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
 	command: "submit",
-	describe: "submit",
+	describe: "Operations for submit",
 
 	builder: (yargs) => {
 		return yargs
diff --git a/packages/cli/src/commands/_generated/url-info/get.ts b/packages/cli/src/commands/_generated/live/get.ts
similarity index 63%
rename from packages/cli/src/commands/_generated/url-info/get.ts
rename to packages/cli/src/commands/_generated/live/get.ts
index 4136840e3d..3508df8e82 100644
--- a/packages/cli/src/commands/_generated/url-info/get.ts
+++ b/packages/cli/src/commands/_generated/live/get.ts
@@ -1,25 +1,22 @@
-import operation from "../_operations/url-info/get.js";
+import operation from "../_operations/live/get.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * get command
- * @generated from apis/overlays/url-info.ts
+ * @generated from apis/overlays/live.ts
  */
 import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
+import { createCommandClient } from "#lib/auth.js";
 import { formatDryRun } from "#lib/dry-run.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
 import { formatOutput } from "#lib/output.js";
 import { withProgress } from "#lib/progress.js";
 import { runWithTelemetry } from "#lib/telemetry/index.js";
 
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
-		.usage("$0 url-info get\n\nReturn submitted URLs based on ID")
+		.usage(
+			"$0 live get\n\nReturn a success message after running liveness checks."
+		)
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
@@ -31,12 +28,12 @@ type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
 	command: "get",
-	describe: "Read submitted URLs by ID",
+	describe: "Run liveness checks",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "url-info get",
+				command: "live get",
 				classification: {
 					safeFlags: ["dry-run"],
 				} satisfies ArgClassification<Args>,
@@ -44,22 +41,19 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 			argv as Record<string, unknown>,
 			async () => {
 				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf url-info get",
+						command: "cf live get",
 						method: "GET",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/url-info`,
+						url: `https://api.cloudflare.com/client/v4/live`,
 						pathParams: {},
 						bodyKind: "none",
 					});
 					return;
 				}
 				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
 
 				const result = await withProgress(`Loading`, async () =>
-					client.send(operation, { account_id: accountId })
+					client.send(operation)
 				);
 				formatOutput(result, { successLabel: `Loaded` });
 			}
diff --git a/packages/cli/src/commands/_generated/url-info/index.ts b/packages/cli/src/commands/_generated/live/index.ts
similarity index 76%
rename from packages/cli/src/commands/_generated/url-info/index.ts
rename to packages/cli/src/commands/_generated/live/index.ts
index 9b3d4c8e60..44daca65fb 100644
--- a/packages/cli/src/commands/_generated/url-info/index.ts
+++ b/packages/cli/src/commands/_generated/live/index.ts
@@ -1,14 +1,14 @@
 import $get from "./get.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * url-info command
- * @generated from apis/overlays/url-info.ts
+ * live command
+ * @generated from apis/overlays/live.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "url-info",
-	describe: "url-info",
+	command: "live",
+	describe: "live",
 
 	builder: (yargs) => {
 		return yargs.command($get).demandCommand(1, "Please specify a subcommand");
diff --git a/packages/cli/src/commands/_generated/logo-matches/index.ts b/packages/cli/src/commands/_generated/logo-matches/index.ts
deleted file mode 100644
index 5d4afa2849..0000000000
--- a/packages/cli/src/commands/_generated/logo-matches/index.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-import $download from "./download/index.js";
-import $get from "./get.js";
-import type { CommonYargsOptions } from "#lib/cli-types.js";
-/**
- * logo-matches command
- * @generated from apis/overlays/logo-matches.ts
- */
-import type { CommandModule } from "yargs";
-
-const command: CommandModule<CommonYargsOptions> = {
-	command: "logo-matches",
-	describe: "logo-matches",
-
-	builder: (yargs) => {
-		return yargs
-			.command($get)
-			.command($download)
-			.demandCommand(1, "Please specify a subcommand");
-	},
-
-	handler: () => {},
-};
-
-export default command;
diff --git a/packages/cli/src/commands/_generated/logos/create.ts b/packages/cli/src/commands/_generated/logos/create.ts
deleted file mode 100644
index 535784cb07..0000000000
--- a/packages/cli/src/commands/_generated/logos/create.ts
+++ /dev/null
@@ -1,137 +0,0 @@
-import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
-import type { ArgClassification } from "#lib/telemetry/index.js";
-/**
- * create command
- * @generated from apis/overlays/logos.ts
- */
-import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	requestApi,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
-import { parseBody } from "#lib/body-parser.js";
-import { formatDryRun } from "#lib/dry-run.js";
-import { readFileForFlag, resolveFileToken } from "#lib/input-validation.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
-import { formatOutput } from "#lib/output.js";
-import { withProgress } from "#lib/progress.js";
-import { runWithTelemetry } from "#lib/telemetry/index.js";
-
-function builder(yargs: Argv<CommonYargsOptions>) {
-	return yargs
-		.usage(
-			"$0 logos create\n\nReturn new saved logo queries created from image files"
-		)
-		.option("tag", { type: "string", description: "Tag" })
-		.option("match-type", { type: "string", description: "Match type" })
-		.option("threshold", { type: "number", description: "Threshold" })
-		.option("dry-run", {
-			type: "boolean",
-			description: "Validate and show what would happen without executing",
-			default: false,
-		})
-		.option("body", {
-			type: "string",
-			description: "Raw JSON request body (bypasses individual flags)",
-		})
-		.option("file", {
-			type: "string",
-			description: "Path to a file to upload as the request body",
-		});
-}
-
-type Args = InferArgs<typeof builder>;
-
-const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "create",
-	describe: "Create new saved logo queries from image files",
-	builder,
-	handler: async (argv): Promise<void> =>
-		runWithTelemetry(
-			{
-				command: "logos create",
-				classification: {
-					safeFlags: ["dry-run"],
-				} satisfies ArgClassification<Args>,
-			},
-			argv as Record<string, unknown>,
-			async () => {
-				const queryParams: Record<string, unknown> = {
-					tag: argv["tag"],
-					match_type: argv["match-type"],
-					threshold: argv["threshold"],
-				};
-				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
-					formatDryRun({
-						command: "cf logos create",
-						method: "POST",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/logos`,
-						pathParams: {},
-						query: queryParams,
-						bodyKind: "octet-stream",
-						body: argv.body,
-					});
-					return;
-				}
-				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
-
-				if (argv.file) {
-					const fileContent = readFileForFlag(argv.file);
-					const result = await withProgress(`Creating`, async () =>
-						requestApi<unknown>(
-							client,
-							"POST",
-							`/accounts/${accountId}/brand-protection/logos`,
-							{
-								body: fileContent,
-								headers: {
-									"Content-Type": "application/x-www-form-urlencoded",
-								},
-							}
-						)
-					);
-					formatOutput(result, { successLabel: `Created` });
-					return;
-				}
-
-				if (argv.body) {
-					// Endpoint does not accept application/json — send --body as raw bytes,
-					// resolving @file references as binary file contents.
-					const bodyData = resolveFileToken(argv.body, "body", "binary");
-					const qs = new URLSearchParams(
-						Object.entries(queryParams)
-							.filter(([, v]) => v !== undefined)
-							.map(([k, v]) => [k, String(v)])
-					).toString();
-					const result = await withProgress(`Creating`, async () =>
-						requestApi<unknown>(
-							client,
-							"POST",
-							`/accounts/${accountId}/brand-protection/logos${qs ? "?" + qs : ""}`,
-							{
-								body: bodyData,
-								headers: {
-									"Content-Type": "application/x-www-form-urlencoded",
-								},
-							}
-						)
-					);
-					formatOutput(result, { successLabel: `Created` });
-					return;
-				}
-
-				if (argv.body === undefined) {
-					throw new Error(
-						"--body is required for this command. Pass --body '<json>' or --body @path/to/file.json."
-					);
-				}
-			}
-		),
-};
-
-export default command;
diff --git a/packages/cli/src/commands/_generated/matches/get.ts b/packages/cli/src/commands/_generated/matches/get.ts
deleted file mode 100644
index 7ee47517c5..0000000000
--- a/packages/cli/src/commands/_generated/matches/get.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-import operation from "../_operations/matches/get.js";
-import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
-import type { ArgClassification } from "#lib/telemetry/index.js";
-/**
- * get command
- * @generated from apis/overlays/matches.ts
- */
-import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
-import { formatDryRun } from "#lib/dry-run.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
-import { formatOutput } from "#lib/output.js";
-import { withProgress } from "#lib/progress.js";
-import { runWithTelemetry } from "#lib/telemetry/index.js";
-
-function builder(yargs: Argv<CommonYargsOptions>) {
-	return yargs
-		.usage("$0 matches get\n\nReturn matches for string queries based on ID")
-		.option("id", { type: "string", description: "ID" })
-		.option("offset", { type: "number", description: "Offset" })
-		.option("limit", { type: "number", description: "Limit" })
-		.option("include-domain-id", {
-			type: "boolean",
-			description: "Include domain ID",
-		})
-		.option("include-dismissed", {
-			type: "boolean",
-			description: "Include dismissed",
-		})
-		.option("dry-run", {
-			type: "boolean",
-			description: "Validate and show what would happen without executing",
-			default: false,
-		});
-}
-
-type Args = InferArgs<typeof builder>;
-
-const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "get",
-	describe: "Read matches for string queries by ID",
-	builder,
-	handler: async (argv): Promise<void> =>
-		runWithTelemetry(
-			{
-				command: "matches get",
-				classification: {
-					safeFlags: ["include-domain-id", "include-dismissed", "dry-run"],
-				} satisfies ArgClassification<Args>,
-			},
-			argv as Record<string, unknown>,
-			async () => {
-				const queryParams: Record<string, unknown> = {
-					id: argv["id"],
-					offset: argv["offset"],
-					limit: argv["limit"],
-					include_domain_id: argv["include-domain-id"],
-					include_dismissed: argv["include-dismissed"],
-				};
-				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
-					formatDryRun({
-						command: "cf matches get",
-						method: "GET",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/matches`,
-						pathParams: {},
-						query: queryParams,
-						bodyKind: "none",
-					});
-					return;
-				}
-				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
-
-				const result = await withProgress(`Loading`, async () =>
-					client.send(operation, { account_id: accountId, ...queryParams })
-				);
-				formatOutput(result, { successLabel: `Loaded` });
-			}
-		),
-};
-
-export default command;
diff --git a/packages/cli/src/commands/_generated/queries/create.ts b/packages/cli/src/commands/_generated/queries/create.ts
deleted file mode 100644
index b982976ba6..0000000000
--- a/packages/cli/src/commands/_generated/queries/create.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import operation from "../_operations/queries/create.js";
-import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
-import type { ArgClassification } from "#lib/telemetry/index.js";
-/**
- * create command
- * @generated from apis/overlays/queries.ts
- */
-import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
-import { compactBody, parseBody } from "#lib/body-parser.js";
-import { formatDryRun } from "#lib/dry-run.js";
-import { resolveFileToken } from "#lib/input-validation.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
-import { formatOutput } from "#lib/output.js";
-import { withProgress } from "#lib/progress.js";
-import { runWithTelemetry } from "#lib/telemetry/index.js";
-
-function builder(yargs: Argv<CommonYargsOptions>) {
-	return yargs
-		.usage(
-			"$0 queries create\n\nReturn a success message after creating new saved string queries"
-		)
-		.option("id", { type: "string", description: "ID" })
-		.option("max-time", { type: "string", description: "The max_time field" })
-		.option("min-time", { type: "string", description: "The min_time field" })
-		.option("scan", { type: "boolean", description: "The scan field" })
-		.option("tag", { type: "string", description: "The tag field" })
-		.option("dry-run", {
-			type: "boolean",
-			description: "Validate and show what would happen without executing",
-			default: false,
-		})
-		.option("body", {
-			type: "string",
-			description: "Raw JSON request body (bypasses individual flags)",
-		});
-}
-
-type Args = InferArgs<typeof builder>;
-
-const command: CommandModule<CommonYargsOptions, Args> = {
-	command: "create",
-	describe: "Create new saved string queries",
-	builder,
-	handler: async (argv): Promise<void> =>
-		runWithTelemetry(
-			{
-				command: "queries create",
-				classification: {
-					safeFlags: ["scan", "dry-run"],
-				} satisfies ArgClassification<Args>,
-			},
-			argv as Record<string, unknown>,
-			async () => {
-				const queryParams: Record<string, unknown> = {
-					id: argv["id"],
-				};
-				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
-					formatDryRun({
-						command: "cf queries create",
-						method: "POST",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/queries`,
-						pathParams: {},
-						query: queryParams,
-						bodyKind: "json",
-						body:
-							argv.body !== undefined
-								? parseBody(argv.body)
-								: compactBody({
-										max_time: resolveFileToken(
-											argv["max-time"] as string | undefined,
-											"max-time",
-											"text"
-										),
-										min_time: resolveFileToken(
-											argv["min-time"] as string | undefined,
-											"min-time",
-											"text"
-										),
-										scan: argv["scan"],
-										tag: resolveFileToken(
-											argv["tag"] as string | undefined,
-											"tag",
-											"text"
-										),
-									}),
-					});
-					return;
-				}
-				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
-
-				if (argv.body) {
-					const bodyData = parseBody(argv.body);
-					const qs = new URLSearchParams(
-						Object.entries(queryParams)
-							.filter(([, v]) => v !== undefined)
-							.map(([k, v]) => [k, String(v)])
-					).toString();
-					const result = await withProgress(`Creating`, async () =>
-						client.send(operation, {
-							body: bodyData,
-							account_id: accountId,
-							...queryParams,
-						})
-					);
-					formatOutput(result, { successLabel: `Created` });
-					return;
-				}
-
-				// Assemble request body from individual flags
-				const bodyData = compactBody({
-					max_time: resolveFileToken(
-						argv["max-time"] as string | undefined,
-						"max-time",
-						"text"
-					),
-					min_time: resolveFileToken(
-						argv["min-time"] as string | undefined,
-						"min-time",
-						"text"
-					),
-					scan: argv["scan"],
-					tag: resolveFileToken(
-						argv["tag"] as string | undefined,
-						"tag",
-						"text"
-					),
-				});
-				const qs = new URLSearchParams(
-					Object.entries(queryParams)
-						.filter(([, v]) => v !== undefined)
-						.map(([k, v]) => [k, String(v)])
-				).toString();
-				const result = await withProgress(`Creating`, async () =>
-					client.send(operation, {
-						body: bodyData,
-						account_id: accountId,
-						...queryParams,
-					})
-				);
-				formatOutput(result, { successLabel: `Created` });
-			}
-		),
-};
-
-export default command;
diff --git a/packages/cli/src/commands/_generated/queries/index.ts b/packages/cli/src/commands/_generated/queries/index.ts
deleted file mode 100644
index 156fcb43b5..0000000000
--- a/packages/cli/src/commands/_generated/queries/index.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import $bulk from "./bulk/index.js";
-import $create from "./create.js";
-import $delete from "./delete.js";
-import type { CommonYargsOptions } from "#lib/cli-types.js";
-/**
- * queries command
- * @generated from apis/overlays/queries.ts
- */
-import type { CommandModule } from "yargs";
-
-const command: CommandModule<CommonYargsOptions> = {
-	command: "queries",
-	describe: "queries",
-
-	builder: (yargs) => {
-		return yargs
-			.command($create)
-			.command($delete)
-			.command($bulk)
-			.demandCommand(1, "Please specify a subcommand");
-	},
-
-	handler: () => {},
-};
-
-export default command;
diff --git a/packages/cli/src/commands/_generated/ready/get.ts b/packages/cli/src/commands/_generated/ready/get.ts
new file mode 100644
index 0000000000..e2b5795b14
--- /dev/null
+++ b/packages/cli/src/commands/_generated/ready/get.ts
@@ -0,0 +1,63 @@
+import operation from "../_operations/ready/get.js";
+import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
+import type { ArgClassification } from "#lib/telemetry/index.js";
+/**
+ * get command
+ * @generated from apis/overlays/ready.ts
+ */
+import type { Argv, CommandModule } from "yargs";
+import { createCommandClient } from "#lib/auth.js";
+import { formatDryRun } from "#lib/dry-run.js";
+import { formatOutput } from "#lib/output.js";
+import { withProgress } from "#lib/progress.js";
+import { runWithTelemetry } from "#lib/telemetry/index.js";
+
+function builder(yargs: Argv<CommonYargsOptions>) {
+	return yargs
+		.usage(
+			"$0 ready get\n\nReturn a success message after running readiness checks."
+		)
+		.option("dry-run", {
+			type: "boolean",
+			description: "Validate and show what would happen without executing",
+			default: false,
+		});
+}
+
+type Args = InferArgs<typeof builder>;
+
+const command: CommandModule<CommonYargsOptions, Args> = {
+	command: "get",
+	describe: "Run readiness checks",
+	builder,
+	handler: async (argv): Promise<void> =>
+		runWithTelemetry(
+			{
+				command: "ready get",
+				classification: {
+					safeFlags: ["dry-run"],
+				} satisfies ArgClassification<Args>,
+			},
+			argv as Record<string, unknown>,
+			async () => {
+				if (argv.dryRun) {
+					formatDryRun({
+						command: "cf ready get",
+						method: "GET",
+						url: `https://api.cloudflare.com/client/v4/ready`,
+						pathParams: {},
+						bodyKind: "none",
+					});
+					return;
+				}
+				const client = await createCommandClient(argv);
+
+				const result = await withProgress(`Loading`, async () =>
+					client.send(operation)
+				);
+				formatOutput(result, { successLabel: `Loaded` });
+			}
+		),
+};
+
+export default command;
diff --git a/packages/cli/src/commands/_generated/matches/download/index.ts b/packages/cli/src/commands/_generated/ready/index.ts
similarity index 72%
rename from packages/cli/src/commands/_generated/matches/download/index.ts
rename to packages/cli/src/commands/_generated/ready/index.ts
index d344cc165e..cb34145b31 100644
--- a/packages/cli/src/commands/_generated/matches/download/index.ts
+++ b/packages/cli/src/commands/_generated/ready/index.ts
@@ -1,14 +1,14 @@
 import $get from "./get.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * download command group
- * @generated from apis/overlays/matches.ts
+ * ready command
+ * @generated from apis/overlays/ready.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "download",
-	describe: "Operations for download",
+	command: "ready",
+	describe: "ready",
 
 	builder: (yargs) => {
 		return yargs.command($get).demandCommand(1, "Please specify a subcommand");
diff --git a/packages/cli/src/commands/_generated/signed-url/get.ts b/packages/cli/src/commands/_generated/signed-url/get.ts
new file mode 100644
index 0000000000..72336a5419
--- /dev/null
+++ b/packages/cli/src/commands/_generated/signed-url/get.ts
@@ -0,0 +1,61 @@
+import operation from "../_operations/signed-url/get.js";
+import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
+import type { ArgClassification } from "#lib/telemetry/index.js";
+/**
+ * get command
+ * @generated from apis/overlays/signed-url.ts
+ */
+import type { Argv, CommandModule } from "yargs";
+import { createCommandClient } from "#lib/auth.js";
+import { formatDryRun } from "#lib/dry-run.js";
+import { formatOutput } from "#lib/output.js";
+import { withProgress } from "#lib/progress.js";
+import { runWithTelemetry } from "#lib/telemetry/index.js";
+
+function builder(yargs: Argv<CommonYargsOptions>) {
+	return yargs
+		.usage("$0 signed-url get\n\nInternal route for testing signed URLs.")
+		.option("dry-run", {
+			type: "boolean",
+			description: "Validate and show what would happen without executing",
+			default: false,
+		});
+}
+
+type Args = InferArgs<typeof builder>;
+
+const command: CommandModule<CommonYargsOptions, Args> = {
+	command: "get",
+	describe: "Internal route for testing signed URLs",
+	builder,
+	handler: async (argv): Promise<void> =>
+		runWithTelemetry(
+			{
+				command: "signed-url get",
+				classification: {
+					safeFlags: ["dry-run"],
+				} satisfies ArgClassification<Args>,
+			},
+			argv as Record<string, unknown>,
+			async () => {
+				if (argv.dryRun) {
+					formatDryRun({
+						command: "cf signed-url get",
+						method: "GET",
+						url: `https://api.cloudflare.com/client/v4/signed-url`,
+						pathParams: {},
+						bodyKind: "none",
+					});
+					return;
+				}
+				const client = await createCommandClient(argv);
+
+				const result = await withProgress(`Loading`, async () =>
+					client.send(operation)
+				);
+				formatOutput(result, { successLabel: `Loaded` });
+			}
+		),
+};
+
+export default command;
diff --git a/packages/cli/src/commands/_generated/logo-matches/download/index.ts b/packages/cli/src/commands/_generated/signed-url/index.ts
similarity index 72%
rename from packages/cli/src/commands/_generated/logo-matches/download/index.ts
rename to packages/cli/src/commands/_generated/signed-url/index.ts
index 3ecc6e1c26..dcee706a21 100644
--- a/packages/cli/src/commands/_generated/logo-matches/download/index.ts
+++ b/packages/cli/src/commands/_generated/signed-url/index.ts
@@ -1,14 +1,14 @@
 import $get from "./get.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
 /**
- * download command group
- * @generated from apis/overlays/logo-matches.ts
+ * signed-url command
+ * @generated from apis/overlays/signed-url.ts
  */
 import type { CommandModule } from "yargs";
 
 const command: CommandModule<CommonYargsOptions> = {
-	command: "download",
-	describe: "Operations for download",
+	command: "signed-url",
+	describe: "signed-url",
 
 	builder: (yargs) => {
 		return yargs.command($get).demandCommand(1, "Please specify a subcommand");
diff --git a/packages/cli/src/commands/_generated/tags/account-resources/delete.ts b/packages/cli/src/commands/_generated/tags/account-resources/delete.ts
index b7f4d3b727..389fae07e4 100644
--- a/packages/cli/src/commands/_generated/tags/account-resources/delete.ts
+++ b/packages/cli/src/commands/_generated/tags/account-resources/delete.ts
@@ -51,6 +51,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 				"account_ruleset",
 				"ai_gateway",
 				"ai_search_instance",
+				"ai_search_namespace",
 				"alerting_policy",
 				"alerting_webhook",
 				"cloudflared_tunnel",
@@ -215,6 +216,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 							"account_ruleset",
 							"ai_gateway",
 							"ai_search_instance",
+							"ai_search_namespace",
 							"alerting_policy",
 							"alerting_webhook",
 							"cloudflared_tunnel",
diff --git a/packages/cli/src/commands/_generated/tags/account-resources/get.ts b/packages/cli/src/commands/_generated/tags/account-resources/get.ts
index 88525bc93b..9e5ba436e9 100644
--- a/packages/cli/src/commands/_generated/tags/account-resources/get.ts
+++ b/packages/cli/src/commands/_generated/tags/account-resources/get.ts
@@ -39,6 +39,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 				"account_ruleset",
 				"ai_gateway",
 				"ai_search_instance",
+				"ai_search_namespace",
 				"alerting_policy",
 				"alerting_webhook",
 				"cloudflared_tunnel",
diff --git a/packages/cli/src/commands/_generated/tags/account-resources/update.ts b/packages/cli/src/commands/_generated/tags/account-resources/update.ts
index 1241162120..18117eec61 100644
--- a/packages/cli/src/commands/_generated/tags/account-resources/update.ts
+++ b/packages/cli/src/commands/_generated/tags/account-resources/update.ts
@@ -50,6 +50,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 				"account_ruleset",
 				"ai_gateway",
 				"ai_search_instance",
+				"ai_search_namespace",
 				"alerting_policy",
 				"alerting_webhook",
 				"cloudflared_tunnel",
@@ -203,6 +204,7 @@ const command: CommandModule<CommonYargsOptions, Args> = {
 							"account_ruleset",
 							"ai_gateway",
 							"ai_search_instance",
+							"ai_search_namespace",
 							"alerting_policy",
 							"alerting_webhook",
 							"cloudflared_tunnel",
diff --git a/packages/cli/src/commands/_generated/tags/values/list.ts b/packages/cli/src/commands/_generated/tags/values/list.ts
index 66f71a751c..914aff8a2e 100644
--- a/packages/cli/src/commands/_generated/tags/values/list.ts
+++ b/packages/cli/src/commands/_generated/tags/values/list.ts
@@ -39,6 +39,7 @@ function builder(yargs: Argv<CommonYargsOptions>) {
 				"account_ruleset",
 				"ai_gateway",
 				"ai_search_instance",
+				"ai_search_namespace",
 				"alerting_policy",
 				"alerting_webhook",
 				"api_gateway_operation",
diff --git a/packages/cli/src/commands/_generated/queries/delete.ts b/packages/cli/src/commands/_generated/zones/aegis/delete.ts
similarity index 57%
rename from packages/cli/src/commands/_generated/queries/delete.ts
rename to packages/cli/src/commands/_generated/zones/aegis/delete.ts
index 720c287bef..25ceda2f52 100644
--- a/packages/cli/src/commands/_generated/queries/delete.ts
+++ b/packages/cli/src/commands/_generated/zones/aegis/delete.ts
@@ -1,18 +1,13 @@
-import operation from "../_operations/queries/delete.js";
+import operation from "../../_operations/zones/aegis/delete.js";
 import type { CommonYargsOptions, InferArgs } from "#lib/cli-types.js";
 import type { ArgClassification } from "#lib/telemetry/index.js";
 /**
  * delete command
- * @generated from apis/overlays/queries.ts
+ * @generated from apis/overlays/zones.ts
  */
 import type { Argv, CommandModule } from "yargs";
-import {
-	createCommandClient,
-	getAccountId,
-	resolveAccountIdSilent,
-} from "#lib/auth.js";
+import { createCommandClient, getZoneId } from "#lib/auth.js";
 import { formatDryRun } from "#lib/dry-run.js";
-import { LOCAL_ACCOUNT_ID } from "#lib/local.js";
 import { formatOutput } from "#lib/output.js";
 import { withProgress } from "#lib/progress.js";
 import { confirmDelete } from "#lib/prompt.js";
@@ -21,11 +16,8 @@ import { runWithTelemetry } from "#lib/telemetry/index.js";
 function builder(yargs: Argv<CommonYargsOptions>) {
 	return yargs
 		.usage(
-			"$0 queries delete\n\nReturn a success message after deleting saved string queries by ID"
+			"$0 zones aegis delete\n\nAegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses."
 		)
-		.option("id", { type: "string", description: "ID" })
-		.option("tag", { type: "string", description: "Tag" })
-		.option("scan", { type: "boolean", description: "Scan" })
 		.option("dry-run", {
 			type: "boolean",
 			description: "Validate and show what would happen without executing",
@@ -43,46 +35,43 @@ type Args = InferArgs<typeof builder>;
 
 const command: CommandModule<CommonYargsOptions, Args> = {
 	command: "delete",
-	describe: "Delete saved string queries by ID",
+	describe: "Delete aegis setting",
 	builder,
 	handler: async (argv): Promise<void> =>
 		runWithTelemetry(
 			{
-				command: "queries delete",
+				command: "zones aegis delete",
 				classification: {
-					safeFlags: ["scan", "dry-run", "force"],
+					safeFlags: ["dry-run", "force"],
 					shortFlagAliases: { f: { canonical: "force", type: "boolean" } },
 				} satisfies ArgClassification<Args>,
 			},
 			argv as Record<string, unknown>,
 			async () => {
-				const queryParams: Record<string, unknown> = {
-					id: argv["id"],
-					tag: argv["tag"],
-					scan: argv["scan"],
-				};
 				if (argv.dryRun) {
-					const __cfDryRunAccountId = await resolveAccountIdSilent();
 					formatDryRun({
-						command: "cf queries delete",
+						command: "cf zones aegis delete",
 						method: "DELETE",
-						url: `https://api.cloudflare.com/client/v4/accounts/${__cfDryRunAccountId ?? "<account-id>"}/brand-protection/queries`,
-						pathParams: {},
-						query: queryParams,
+						url: `https://api.cloudflare.com/client/v4/zones/${argv.zone ?? argv.zoneId ?? "<zone>"}/settings/aegis`,
+						pathParams: {
+							"zone-id": String(argv.zone ?? argv["zone-id"] ?? ""),
+						},
 						bodyKind: "none",
 					});
 					return;
 				}
 				const client = await createCommandClient(argv);
-				const accountId = argv.local ? LOCAL_ACCOUNT_ID : await getAccountId();
-				argv.accountId = accountId;
+				const zoneId = await getZoneId({ zone: argv.zone }, client, {
+					quiet: argv.quiet,
+				});
+				argv.zoneId = zoneId;
 
 				if (!(await confirmDelete({ force: Boolean(argv.force) }))) {
 					return;
 				}
 
 				const result = await withProgress(`Deleting`, async () =>
-					client.send(operation, { account_id: accountId, ...queryParams })
+					client.send(operation, { zone_id: zoneId })
 				);
 				formatOutput(result, { successLabel: `Deleted` });
 			}
diff --git a/packages/cli/src/commands/_generated/zones/aegis/index.ts b/packages/cli/src/commands/_generated/zones/aegis/index.ts
index 5ae7094e11..e3c40cf458 100644
--- a/packages/cli/src/commands/_generated/zones/aegis/index.ts
+++ b/packages/cli/src/commands/_generated/zones/aegis/index.ts
@@ -1,3 +1,4 @@
+import $delete from "./delete.js";
 import $edit from "./edit.js";
 import $get from "./get.js";
 import type { CommonYargsOptions } from "#lib/cli-types.js";
@@ -13,6 +14,7 @@ const command: CommandModule<CommonYargsOptions> = {
 
 	builder: (yargs) => {
 		return yargs
+			.command($delete)
 			.command($edit)
 			.command($get)
 			.demandCommand(1, "Please specify a subcommand");