cf 0.10.0 → 0.12.0

package/dist/_meta/agent-context.json

@@ -9,6 +9,7 @@
 		"accounts": "# accounts — Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account\n\n## Commands\n\n### Read Operations\n\n- `cf accounts billing history list` — Gets the billing history for an account.\n- `cf accounts billing payment-methods get <payment-method-id>` — Gets a specific payment method for an account.\n- `cf accounts billing payment-methods list` — Lists all payment methods for an account.\n- `cf accounts get` — Get information about a specific account that you are a member of.\n- `cf accounts list` — List all accounts you have ownership or verified access to.\n- `cf accounts logs audit list` — Gets a list of audit logs for an account.\n- `cf accounts members get <member-id>` — Get information about a specific member of an account.\n- `cf accounts members list` — List all members of an account.\n- `cf accounts subscriptions get` — Lists all of an account or zone's subscriptions.\n- `cf accounts tokens get <token-id>` — Get information about a specific Account Owned API token.\n- `cf accounts tokens list` — List all Account Owned API tokens created for this account. Results include active, disabled, and recently-expired tokens when include_expired is set to true.\n- `cf accounts tokens permission-groups list` — Find all available permission groups for Account Owned API Tokens\n\n### Create Operations\n\n- `cf accounts applications create` — Create a custom application for an account. (supports --dry-run, --body)\n- `cf accounts billing payment-methods create` — Creates a new payment method for an account. (supports --dry-run, --body)\n- `cf accounts create` — Create an account (only available for tenant admins at this time) (supports --dry-run, --body)\n- `cf accounts members create` — Add a user to the list of members for this account. (supports --dry-run, --body)\n- `cf accounts subscriptions create` — Creates an account or zone subscription. (supports --dry-run, --body)\n- `cf accounts tokens create` — Create a new Account Owned API token. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf accounts applications update <id>` — Replace the network matchers for a custom application and create a new version. (supports --dry-run, --body)\n- `cf accounts billing payment-methods update <payment-method-id>` — Updates a payment method for an account. (supports --dry-run, --body)\n- `cf accounts members update <member-id>` — Modify an account member. (supports --dry-run, --body)\n- `cf accounts subscriptions update <subscription-identifier>` — Updates an account subscription. (supports --dry-run, --body)\n- `cf accounts tokens update <token-id>` — Update an existing token. (supports --dry-run, --body)\n- `cf accounts update` — Update an existing account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf accounts applications delete <id>` — Delete a custom application and all of its versions. Deletion is rejected when other resources reference the application. (supports --dry-run)\n- `cf accounts billing payment-methods delete <payment-method-id>` — Deletes a payment method from an account. (supports --dry-run)\n- `cf accounts delete` — Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account (supports --dry-run)\n- `cf accounts members delete <member-id>` — Remove a member from an account. (supports --dry-run)\n- `cf accounts subscriptions delete <subscription-identifier>` — Deletes an account's subscription. (supports --dry-run)\n- `cf accounts tokens delete <token-id>` — Destroy an Account Owned API token. (supports --dry-run)\n\n### Other Operations\n\n- `cf accounts applications get applications` — List the applications available to an account, both the applications Cloudflare curates and the custom applications the account has defined. Results are paginated. Use `filter` and `search` to narrow the list, `order_by` to sort it, and `fields` to reduce each result to only the properties you need. The authenticated principal must have access to the account identified by `account_id`. (supports --dry-run)\n- `cf accounts applications get by id <id>` — Get application by ID. (supports --dry-run)\n- `cf accounts billing createSetupIntent` — Creates a Stripe setup intent for adding a payment method to an account. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf accounts billing getBadDebt` — Gets bad debt information for an account, including outstanding invoices and total debt amount. (supports --dry-run)\n- `cf accounts billing getCredits` — Gets the credit balance and eligibility for an account. (supports --dry-run)\n- `cf accounts billing getReceiptPdf <receipt-id>` — Downloads a receipt as a PDF document. (supports --dry-run)\n- `cf accounts billing getUnpaidInvoices` — Gets unpaid invoice information for an account. (supports --dry-run)\n- `cf accounts billing payBadDebt` — Pays outstanding bad debt for an account. Discovers all debt automatically and handles invoice deduplication. (supports --dry-run, --body)\n- `cf accounts billing payInvoice` — Pays an outstanding invoice for an account. Returns a Stripe client secret when Strong Customer Authentication (SCA) is required to complete the payment. (supports --dry-run, --body)\n- `cf accounts billing payment-methods setDefault <payment-method-id>` — Sets a payment method as the default for an account. (supports --dry-run)\n- `cf accounts billing togglePdfInvoices` — Toggles PDF invoice generation for an account. (supports --dry-run, --body)\n- `cf accounts categories get by id <id>` — Get application category by ID. (supports --dry-run)\n- `cf accounts categories get categories` — List application categories. (supports --dry-run)\n- `cf accounts logs audit history <id>` — Returns the chronological change history for the resource identified by the given audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned. (supports --dry-run)\n- `cf accounts logs audit product-categories` — Lists the available audit log product categories and the resource products each one expands to. Use these values with the product_category filter on the account audit logs endpoint. (supports --dry-run)\n- `cf accounts subscriptions cancelDelayedDowngrade` — Cancels pending delayed downgrades for the specified subscriptions. (supports --dry-run, --body)\n- `cf accounts subscriptions createCancelReason <subscription-identifier>` — Records a cancellation reason for an account subscription. (supports --dry-run, --body)\n- `cf accounts subscriptions getByIdentifier <subscription-identifier>` — Gets an account subscription by identifier. (supports --dry-run)\n- `cf accounts subscriptions getCancelReason <subscription-identifier>` — Gets the cancellation reason for an account subscription. (supports --dry-run)\n- `cf accounts tokens roll <token-id>` — Roll the Account Owned API token secret. (supports --dry-run)\n- `cf accounts tokens verify` — Test whether a token works. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"acm": "# acm — acm\n\n## Commands\n\n### Read Operations\n\n- `cf acm custom-trust-store get <custom-origin-trust-store-id>` — Retrieves details about a specific root CA certificate in the custom origin trust store, including expiration and subject information.\n- `cf acm custom-trust-store list` — Get Custom Origin Trust Store for a Zone.\n- `cf acm total-tls get` — Get Total TLS Settings for a Zone.\n\n### Create Operations\n\n- `cf acm custom-trust-store create` — Upload a root CA certificate to the Custom Origin Trust Store for a Zone. Only root CA certificates are accepted. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf acm total-tls edit` — Set Total TLS Settings or disable the feature for a Zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf acm custom-trust-store delete <custom-origin-trust-store-id>` — Removes a root CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"addressing": "# addressing — addressing\n\n## Commands\n\n### Read Operations\n\n- `cf addressing address-maps get <address-map-id>` — Show a particular address map owned by the account.\n- `cf addressing address-maps list` — List all address maps owned by the account.\n- `cf addressing leases list` — List all leases owned by the account.\n- `cf addressing loa-documents get <loa-document-id>` — Download specified LOA document under the account.\n- `cf addressing prefixes advertisement-status get <prefix-id>` — View the current advertisement state for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.\n- `cf addressing prefixes bgp-prefixes get <bgp-prefix-id>` — Retrieve a single BGP Prefix according to its identifier\n- `cf addressing prefixes bgp-prefixes list` — List all BGP Prefixes within the specified IP Prefix. BGP Prefixes are used to control which specific subnets are advertised to the Internet. It is possible to advertise subnets more specific than an IP Prefix by creating more specific BGP Prefixes.\n- `cf addressing prefixes delegations list` — List all delegations for a given account IP prefix.\n- `cf addressing prefixes get <prefix-id>` — List a particular prefix owned by the account.\n- `cf addressing prefixes list` — List all prefixes owned by the account.\n- `cf addressing prefixes service-bindings get <binding-id>` — Fetch a single Service Binding\n- `cf addressing prefixes service-bindings list` — List the Cloudflare services this prefix is currently bound to. Traffic sent to an address within an IP prefix will be routed to the Cloudflare service of the most-specific Service Binding matching the address. **Example:** binding `192.0.2.0/24` to Cloudflare Magic Transit and `192.0.2.1/32` to the Cloudflare CDN would route traffic for `192.0.2.1` to the CDN, and traffic for all other IPs in the prefix to Cloudflare Magic Transit.\n- `cf addressing regional_hostnames get <hostname>` — Fetch the configuration for a specific Regional Hostname, within a zone.\n- `cf addressing regional_hostnames list` — List all Regional Hostnames within a zone.\n- `cf addressing regional_hostnames regions list` — List all Regional Services regions available for use by this account.\n- `cf addressing services list` — Bring-Your-Own IP (BYOIP) prefixes onboarded to Cloudflare must be bound to a service running on the Cloudflare network to enable a Cloudflare product on the IP addresses. This endpoint can be used as a reference of available services on the Cloudflare network, and their service IDs.\n\n### Create Operations\n\n- `cf addressing address-maps create` — Create a new address map under the account. (supports --dry-run, --body)\n- `cf addressing loa-documents create` — Submit LOA document (pdf format) under the account. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes create <prefix-id>` — Create a BGP prefix, controlling the BGP advertisement status of a specific subnet. When created, BGP prefixes are initially withdrawn, and can be advertised with the Update BGP Prefix API. (supports --dry-run, --body)\n- `cf addressing prefixes create` — Add a new prefix under the account. (supports --dry-run, --body)\n- `cf addressing prefixes delegations create <prefix-id>` — Create a new account delegation for a given IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes service-bindings create <prefix-id>` — Creates a new Service Binding, routing traffic to IPs within the given CIDR to a service running on Cloudflare's network. **NOTE:** The first Service Binding created for an IP Prefix must exactly match the IP Prefix's CIDR. Subsequent Service Bindings may be created with a more-specific CIDR. Refer to the [Service Bindings Documentation](https://developers.cloudflare.com/byoip/service-bindings/) for compatibility details. (supports --dry-run, --body)\n- `cf addressing prefixes validate create <prefix-id>` — Triggers a new prefix validation. The checks are run asynchronously and include IRR, RPKI, and prefix ownership. (supports --dry-run)\n- `cf addressing regional_hostnames create` — Create a new Regional Hostname entry. Cloudflare will only use data centers that are physically located within the chosen region to decrypt and service HTTPS traffic. Learn more about [Regional Services](https://developers.cloudflare.com/data-localization/regional-services/get-started/). (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf addressing address-maps accounts update <account-id-2>` — Add an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps edit <address-map-id>` — Modify properties of an address map owned by the account. (supports --dry-run, --body)\n- `cf addressing address-maps ips update <ip-address>` — Add an IP from a prefix owned by the account to a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones update` — Add a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes advertisement-status edit <prefix-id>` — Advertise or withdraw the BGP route for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix. (supports --dry-run, --body)\n- `cf addressing prefixes bgp-prefixes edit <bgp-prefix-id>` — Update the properties of a BGP Prefix, such as the on demand advertisement status (advertised or withdrawn). (supports --dry-run, --body)\n- `cf addressing prefixes edit <prefix-id>` — Modify the description for a prefix owned by the account. (supports --dry-run, --body)\n- `cf addressing regional_hostnames edit <hostname>` — Update the configuration for a specific Regional Hostname. Only the region_key of a hostname is mutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf addressing address-maps accounts delete <account-id-2>` — Remove an account as a member of a particular address map. (supports --dry-run)\n- `cf addressing address-maps delete <address-map-id>` — Delete a particular address map owned by the account. An Address Map must be disabled before it can be deleted. (supports --dry-run)\n- `cf addressing address-maps ips delete <ip-address>` — Remove an IP from a particular address map. (supports --dry-run)\n- `cf addressing address-maps zones delete` — Remove a zone as a member of a particular address map. (supports --dry-run)\n- `cf addressing prefixes bgp-prefixes delete <bgp-prefix-id>` — Delete a BGP Prefix associated with the specified IP Prefix. A BGP Prefix must be withdrawn before it can be deleted. (supports --dry-run)\n- `cf addressing prefixes delegations delete <delegation-id>` — Delete an account delegation for a given IP prefix. (supports --dry-run)\n- `cf addressing prefixes delete <prefix-id>` — Delete an unapproved prefix owned by the account. (supports --dry-run)\n- `cf addressing prefixes service-bindings delete <binding-id>` — Delete a Service Binding (supports --dry-run)\n- `cf addressing regional_hostnames delete <hostname>` — Delete the region configuration for a specific Regional Hostname. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"agent-context": "# agent-context — Output agent context and tool definitions\n\n## Commands\n\n### Read Operations\n\n- `cf agent-context [product]` — Output agent context and skill files\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"agent-memory": "# agent-memory — agent-memory\n\n## Commands\n\n### Other Operations\n\n- `cf agent-memory create-namespace` — Creates a new memory namespace owned by the account. (supports --dry-run, --body)\n- `cf agent-memory delete-memory <memory-id>` — Deletes a memory by ID. Removes the memory and any source messages linked to it. Returns the deleted memory. (supports --dry-run)\n- `cf agent-memory delete-namespace <namespace-name>` — Deletes a namespace. (supports --dry-run)\n- `cf agent-memory delete-profile <profile-name>` — Marks a profile for deletion. (supports --dry-run)\n- `cf agent-memory delete-session <session-id>` — Marks all memories and messages in a profile that are tagged with the given session ID for deletion. (supports --dry-run)\n- `cf agent-memory get-memory <memory-id>` — Retrieves a memory by ID. (supports --dry-run)\n- `cf agent-memory get-namespace <namespace-name>` — Gets a namespace by name. (supports --dry-run)\n- `cf agent-memory ingest <profile-name>` — Processes a conversation and extracts structured memories from it. Agent Memory identifies facts, events, instructions, and tasks automatically. (supports --dry-run, --body)\n- `cf agent-memory list-memories <profile-name>` — List memories stored in a profile. (supports --dry-run)\n- `cf agent-memory list-namespaces` — Lists all namespaces for the given account. Results are paginated. (supports --dry-run)\n- `cf agent-memory list-profiles <namespace-name>` — Lists the profiles of a namespace, ordered by name. A profile appears once it has been used. (supports --dry-run)\n- `cf agent-memory recall <profile-name>` — Retrieves memories relevant to the query and returns a synthesized answer. (supports --dry-run, --body)\n- `cf agent-memory remember <profile-name>` — Stores a single memory explicitly. (supports --dry-run, --body)\n- `cf agent-memory summary <profile-name>` — Generates a paste-ready prompt block summarizing everything stored in a memory profile. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ai": "# ai — ai\n\n## Commands\n\n### Read Operations\n\n- `cf ai authors list` — Searches Workers AI models by author or organization name.\n- `cf ai finetunes list` — Lists all fine-tuning jobs created by the account, including status and metrics.\n- `cf ai finetunes public list` — Lists publicly available fine-tuned models that can be used with Workers AI.\n- `cf ai models list` — Searches Workers AI models by name or description.\n- `cf ai tasks list` — Searches Workers AI models by task type (e.g., text-generation, embeddings).\n\n### Create Operations\n\n- `cf ai finetunes assets create <finetune-id>` — Uploads training data assets for a Workers AI fine-tuning job. (supports --dry-run, --body)\n- `cf ai finetunes create` — Creates a new fine-tuning job for a Workers AI model using custom training data. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf ai finetunes delete <finetune-id>` — Delete a finetune. Any in-flight requests referencing the lora will fail after the files are deleted. (supports --dry-run)\n\n### Other Operations\n\n- `cf ai finetunes assets download <file-name>` — Returns a pre-signed R2 URL for downloading a finetune asset file. (supports --dry-run)\n- `cf ai getModelSchema` — Retrieves the input and output JSON schema definition for a Workers AI model. (supports --dry-run)\n- `cf ai listMarkdownSupportedFormats` — Lists all file formats supported for conversion to Markdown. (supports --dry-run)\n- `cf ai run <model-name>` — Run inference on a Workers AI model. The request body is model-specific: fetch the model's input schema with `cf ai getModelSchema --model <id>` (or `cf ai run <model> --help`) to discover its fields, then pass them as flags or as a single JSON payload via --body. `cf ai models list` enumerates the models this account can run. (supports --dry-run, --body)\n- `cf ai runModel <model-name>` — This endpoint provides users with the capability to run specific AI models on-demand. By submitting the required input data, users can receive real-time predictions or results generated by the chosen AI model. The endpoint supports various AI model types, ensuring flexibility and adaptability for diverse use cases. Model specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/). (supports --dry-run, --body)\n- `cf ai toMarkdown` — Converts uploaded files into Markdown format using Workers AI. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ai-audit": "# ai-audit — ai-audit\n\n## Commands\n\n### Read Operations\n\n- `cf ai-audit robots get` — Fetches and parses the robots.txt file for a zone or a specific subdomain within the zone. Returns parsed user-agent rules, content signals, and sitemaps.\n\n### Other Operations\n\n- `cf ai-audit robots bulk-get` — Fetches and parses robots.txt files for multiple domains within a zone in a single request. Each domain must belong to the specified zone. Results are keyed by hostname. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -23,6 +24,7 @@
 		"argo": "# argo — Network optimization features that speed up and improve reliability of traffic to your origins\n\n## Commands\n\n### Read Operations\n\n- `cf argo smart-routing get` — Retrieves the value of Argo Smart Routing enablement setting.\n- `cf argo tiered-caching get` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.\n\n### Update Operations\n\n- `cf argo smart-routing edit` — Configures the value of the Argo Smart Routing enablement setting. (supports --dry-run, --body)\n- `cf argo tiered-caching edit` — Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"artifacts": "# artifacts — artifacts\n\n## Commands\n\n### Read Operations\n\n- `cf artifacts namespaces get <namespace>` — Returns an Artifacts namespace summary.\n- `cf artifacts namespaces repos blobs get <hash>` — Returns raw bytes for an immutable Git blob object. Blob responses are cacheable forever by hash.\n- `cf artifacts namespaces repos commits get <hash>` — Returns decoded metadata for an immutable Git commit object. Commit responses are cacheable forever by hash.\n- `cf artifacts namespaces repos files get <name>` — Returns raw bytes for a file resolved by ref and path.\n- `cf artifacts namespaces repos get <name>` — Returns repository metadata.\n- `cf artifacts namespaces repos list` — Lists repositories in a namespace.\n- `cf artifacts namespaces repos logs get <name>` — Returns commit metadata walking backwards from a ref, branch, tag, or HEAD.\n- `cf artifacts namespaces repos raw get <path>` — Returns file bytes resolved by ref and path, with a sniffed content type and browser-safe response headers.\n- `cf artifacts namespaces repos trees get <hash>` — Returns decoded entries for an immutable Git tree object. Tree responses are cacheable forever by hash.\n- `cf artifacts namespaces tokens list` — Lists tokens for a repository.\n\n### Create Operations\n\n- `cf artifacts namespaces repos create <namespace>` — Creates a Git-compatible Artifacts repository in a namespace. (supports --dry-run, --body)\n- `cf artifacts namespaces tokens create <namespace>` — Creates a scoped Git token for a repository. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf artifacts namespaces repos delete <name>` — Deletes a repository and schedules cleanup of its backing data. (supports --dry-run)\n\n### Other Operations\n\n- `cf artifacts namespaces artifactsNamespacesList` — Lists Artifacts namespaces for an account. (supports --dry-run)\n- `cf artifacts namespaces repos fork <name>` — Forks a source repository into a new repository. (supports --dry-run, --body)\n- `cf artifacts namespaces repos import <name>` — Imports an HTTPS Git repository into an Artifacts repository. (supports --dry-run, --body)\n- `cf artifacts namespaces tokens revoke <id>` — Revokes an Artifacts repository token. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"audit-logs": "# audit-logs — audit-logs\n\n## Commands\n\n### Read Operations\n\n- `cf audit-logs list` — Gets a list of audit logs for an account. Can be filtered by who made the change, on which zone, and the timeframe of the change.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"auth": "# auth — Manage authentication and profiles\n\n## Commands\n\n### Read Operations\n\n- `cf auth list` — List all auth profiles\n- `cf auth whoami` — Show current user and authentication status\n\n### Create Operations\n\n- `cf auth create <name>` — Create or re-authenticate a named auth profile\n\n### Delete Operations\n\n- `cf auth delete <name>` — Delete a named auth profile\n\n### Other Operations\n\n- `cf auth activate <name> [dir]` — Bind a named auth profile to a directory\n- `cf auth deactivate [dir]` — Remove the auth profile binding from a directory\n- `cf auth login` — Authenticate with Cloudflare\n- `cf auth logout` — Log out and remove stored credentials\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"autorag": "# autorag — autorag\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"billing": "# billing — Account billing profiles and usage data for Cloudflare subscriptions and add-on services\n\n## Commands\n\n### Read Operations\n\n- `cf billing profiles get` — Gets the current billing profile for the account.\n- `cf billing rate-plans get <public-key>` — Gets a rate plan's details by its public key (e.g., 'teams_free', 'cf_pro_20_20'). This is a public catalog endpoint, so authentication is not enforced and credentials are accepted but not required.\n\n### Create Operations\n\n- `cf billing profiles create` — Creates a billing profile for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf billing profiles update` — Updates the billing profile for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf billing profiles delete` — Deletes the billing profile for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf billing addresses validate` — Validates a billing address and returns validated address suggestions. Authentication is not enforced to support pre-signup address validation flows, so credentials are accepted but not required. (supports --dry-run, --body)\n- `cf billing profiles createPaymentIntent` — Creates a Stripe payment intent for adding or updating a payment method on the account's billing profile. Returns a client secret for frontend payment method collection. (supports --dry-run)\n- `cf billing profiles updateEmail` — Updates the billing email addresses and preferred locale for an account. (supports --dry-run, --body)\n- `cf billing usage get-account-usage-v2` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days. (supports --dry-run)\n- `cf billing usage get-info-v1` — Returns high-level usage information for the account, including coverage, and subscription metadata. (supports --dry-run)\n- `cf billing usage get-v1` — Returns billable usage data for the account. When no query parameters are provided, returns usage for the current billing period. (supports --dry-run)\n- `cf billing usage query` — Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. This is the filterable counterpart to `GET` on the same path. It is a read-only operation and requires only the `#billing:read` permission; `POST` is used so that filter criteria can be supplied in a request body rather than in the query string. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. The request body is optional. When it is omitted, or when `TimePeriod` is omitted, the range defaults to the start of the current month through today. The maximum date range is 31 days. Filters of different kinds are combined with AND. Values within one tag filter are combined with OR. Filter values that do not match usage produce an empty result set. Results can be grouped by up to two customer resource-tag keys. Grouped values are returned in the `Tags` field. Usage without a requested tag remains in an untagged group, with that key omitted from `Tags`. Requests using tag filtering or grouping return HTTP 400 when tag-aware usage data is unavailable. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"bot-management": "# bot-management — bot-management\n\n## Commands\n\n### Read Operations\n\n- `cf bot-management feedback list` — Returns all feedback reports previously submitted for the specified zone. Feedback reports help improve detection by sharing samples of traffic that were misclassified as bots or humans.\n- `cf bot-management get` — Retrieve a zone's Bot Management Config\n\n### Create Operations\n\n- `cf bot-management feedback create` — Submit a feedback report for the specified zone. Use `type` to indicate whether the report is a false positive (good traffic flagged as bot) or a false negative (bot traffic missed). Furthermore, you can also use `expression` as a wirefilter to identify the affected traffic sample. See more accepted API fields and expression types at https://developers.cloudflare.com/bots/concepts/feedback-loop/#api-fields and https://developers.cloudflare.com/bots/concepts/feedback-loop/#expression-fields, respectively. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf bot-management update` — Updates the Bot Management configuration for a zone. This API is used to update: - **Bot Fight Mode** - **Super Bot Fight Mode** - **Bot Management for Enterprise** See [Bot Plans](https://developers.cloudflare.com/bots/plans/) for more information on the different plans \\ If you recently upgraded or downgraded your plan, refer to the following examples to clean up old configurations. Copy and paste the example body to remove old zone configurations based on your current plan. #### Clean up configuration for Bot Fight Mode plan ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"suppress_session_score\": false } ``` #### Clean up configuration for SBFM Pro plan ```json { \"sbfm_likely_automated\": \"allow\", \"fight_mode\": false } ``` #### Clean up configuration for SBFM Biz plan ```json { \"fight_mode\": false } ``` #### Clean up configuration for BM Enterprise Subscription plan It is strongly recommended that you ensure you have [custom rules](https://developers.cloudflare.com/waf/custom-rules/) in place to protect your zone before disabling the SBFM rules. Without these protections, your zone is vulnerable to attacks. ```json { \"sbfm_likely_automated\": \"allow\", \"sbfm_definitely_automated\": \"allow\", \"sbfm_verified_bots\": \"allow\", \"sbfm_static_resource_protection\": false, \"optimize_wordpress\": false, \"fight_mode\": false } ``` (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -31,6 +33,7 @@
 		"brands": "# brands — brands\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"browser-extension": "# browser-extension — browser-extension\n\n## Commands\n\n### Read Operations\n\n- `cf browser-extension config get` — Returns the browser extension configuration for an account.\n\n### Create Operations\n\n- `cf browser-extension config create` — Creates the browser extension configuration for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf browser-extension config update` — Replaces the browser extension configuration for an account. The configuration must already exist. The shard mapping is immutable. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf browser-extension config delete` — Deletes the browser extension configuration for an account. The shard mapping is preserved and not deleted. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"browser-run": "# browser-run — browser-run\n\n## Commands\n\n### Read Operations\n\n- `cf browser-run crawl get <job-id>` — Returns the result of a crawl job.\n- `cf browser-run devtools browser page get <target-id>` — Establishes a WebSocket connection to a specific Chrome DevTools target or page.\n- `cf browser-run devtools browser targets get <target-id>` — Returns the debuggable target with the given ID.\n- `cf browser-run devtools browser targets list` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-run devtools json get <session-id>` — Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.\n- `cf browser-run devtools session get <session-id>` — Get details for a specific browser session.\n- `cf browser-run devtools session list` — List active browser sessions.\n\n### Create Operations\n\n- `cf browser-run crawl create` — Starts a crawl job for the provided URL and its children. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-run devtools browser create` — Acquires a browser and returns its session ID and websocket URL. Optionally accepts a JSON body with session guardrails to restrict outbound HTTP/S traffic. (supports --dry-run, --body)\n- `cf browser-run devtools browser live-view create <session-id>` — Generates time-limited URLs to view a remote browser session. Set `guardrails: { mode: 'readonly' }` to create a view-only link. (supports --dry-run, --body)\n- `cf browser-run devtools browser targets create <session-id>` — Opens a new tab in the browser. Optionally specify a URL to navigate to. (supports --dry-run)\n\n### Delete Operations\n\n- `cf browser-run crawl delete <job-id>` — Cancels an ongoing crawl job by setting its status to cancelled and stopping all queued URLs. (supports --dry-run)\n- `cf browser-run devtools browser delete <session-id>` — Closes an existing browser session. (supports --dry-run)\n\n### Other Operations\n\n- `cf browser-run devtools browser connect <session-id>` — Establishes a WebSocket connection to an existing browser session. (supports --dry-run)\n- `cf browser-run devtools browser launch` — Acquires and establishes a WebSocket connection to a browser session. Session guardrails may be supplied in the `cf-brapi-guardrails` header as base64url-encoded JSON of the same `guardrails` object the POST body accepts (for example `{\"allowedDomains\":[\"*.example.com\"]}`). (supports --dry-run)\n- `cf browser-run devtools browser protocol <session-id>` — Returns the complete Chrome DevTools Protocol schema including all domains, commands, events, and types. This schema describes the entire CDP API surface. (supports --dry-run)\n- `cf browser-run devtools browser targets activate <target-id>` — Activates (brings to front) a specific browser target by its ID. (supports --dry-run)\n- `cf browser-run devtools browser targets close <target-id>` — Closes a specific browser target (tab, page, etc.) by its ID. Returns 'Target is closing' on success or an error if the target is not found. (supports --dry-run)\n- `cf browser-run devtools browser version <session-id>` — Get browser version metadata. (supports --dry-run)\n- `cf browser-run quick-action accessibility-tree` — Returns the page's accessibility tree. Use `interestingOnly` to only return semantically meaningful nodes; use `root` to scope the tree to a CSS-selector-anchored subtree. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-run quick-action content` — Fetches rendered HTML content from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-run quick-action json` — Gets json from a webpage from a provided URL or HTML. Pass `prompt` or `schema` in the body. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-run quick-action links` — Get links from a web page. (supports --dry-run, --body)\n- `cf browser-run quick-action markdown` — Gets markdown of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. (supports --dry-run, --body)\n- `cf browser-run quick-action pdf` — Fetches rendered PDF from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour. (supports --dry-run, --body)\n- `cf browser-run quick-action scrape` — Get meta attributes like height, width, text and others of selected elements. (supports --dry-run, --body)\n- `cf browser-run quick-action screenshot` — Takes a screenshot of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n- `cf browser-run quick-action snapshot` — Returns the page's HTML content and screenshot. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"build": "# build — Build a project for Cloudflare\n\n## Commands\n\n### Other Operations\n\n- `cf build` — Build a project for Cloudflare\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"cache": "# cache — cache\n\n## Commands\n\n### Read Operations\n\n- `cf cache settings regional-tiered-cache get` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies.\n- `cf cache settings reserve get` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information.\n- `cf cache settings reserve status` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.\n- `cf cache settings smart-tiered-cache get` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.\n- `cf cache settings variants get` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.\n\n### Update Operations\n\n- `cf cache settings regional-tiered-cache edit` — Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies. (supports --dry-run, --body)\n- `cf cache settings reserve edit` — Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information. (supports --dry-run, --body)\n- `cf cache settings smart-tiered-cache edit` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run, --body)\n- `cf cache settings variants edit` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cache settings smart-tiered-cache delete` — Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin. (supports --dry-run)\n- `cf cache settings variants delete` — Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers. (supports --dry-run)\n\n### Other Operations\n\n- `cf cache purge` — ### Purge All Cached Content Removes ALL files from Cloudflare's cache. All tiers can purge everything. ``` {\"purge_everything\": true} ``` ### Purge Cached Content by URL Granularly removes one or more files from Cloudflare's cache by specifying URLs. All tiers can purge by URL. To purge files with custom cache keys, include the headers used to compute the cache key as in the example. If you have a device type or geo in your cache key, you will need to include the CF-Device-Type or CF-IPCountry headers. If you have lang in your cache key, you will need to include the Accept-Language header. **NB:** When including the Origin header, be sure to include the **scheme** and **hostname**. The port number can be omitted if it is the default port (80 for http, 443 for https), but must be included otherwise. Single file purge example with files: ``` {\"files\": [\"http://www.example.com/css/styles.css\", \"http://www.example.com/js/index.js\"]} ``` Single file purge example with url and header pairs: ``` {\"files\": [{\"url\": \"http://www.example.com/cat_picture.jpg\", \"headers\": {\"CF-IPCountry\": \"US\", \"CF-Device-Type\": \"desktop\", \"Accept-Language\": \"zh-CN\"}}, {\"url\": \"http://www.example.com/dog_picture.jpg\", \"headers\": {\"CF-IPCountry\": \"EU\", \"CF-Device-Type\": \"mobile\", \"Accept-Language\": \"en-US\"}}]} ``` ### Purge Cached Content by Tag, Host or Prefix Granularly removes one or more files from Cloudflare's cache either by specifying the host, the associated Cache-Tag, or a Prefix. Flex purge with tags: ``` {\"tags\": [\"a-cache-tag\", \"another-cache-tag\"]} ``` Flex purge with hosts: ``` {\"hosts\": [\"www.example.com\", \"images.example.com\"]} ``` Flex purge with prefixes: ``` {\"prefixes\": [\"www.example.com/foo\", \"images.example.com/bar/baz\"]} ``` ### Availability and limits Please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits). (supports --dry-run, --body)\n- `cf cache purge-environment <environment-id>` — Purge cached content scoped to a specific environment. Supports the same purge types as the zone-level endpoint (purge everything, by URL, by tag, host, or prefix). ### Availability and limits Please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits). (supports --dry-run, --body)\n- `cf cache settings reserve clear` — You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"calls": "# calls — Real-time audio/video communication infrastructure — SFU apps for WebRTC and TURN relay keys\n\n## Commands\n\n### Read Operations\n\n- `cf calls sfu get <app-id>` — Fetches details for a single Calls app.\n- `cf calls sfu list` — Lists all apps in the Cloudflare account\n- `cf calls turn get <key-id>` — Fetches details for a single TURN key.\n- `cf calls turn list` — Lists all TURN keys in the Cloudflare account\n\n### Create Operations\n\n- `cf calls sfu create` — Creates a new Cloudflare calls app. An app is an unique enviroment where each Session can access all Tracks within the app. (supports --dry-run, --body)\n- `cf calls turn create` — Creates a new Cloudflare Calls TURN key. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf calls sfu update <app-id>` — Edit details for a single app. (supports --dry-run, --body)\n- `cf calls turn update <key-id>` — Edit details for a single TURN key. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf calls sfu delete <app-id>` — Deletes an app from Cloudflare Calls (supports --dry-run)\n- `cf calls turn delete <key-id>` — Deletes a TURN key from Cloudflare Calls (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"certificate-authorities": "# certificate-authorities — certificate-authorities\n\n## Commands\n\n### Read Operations\n\n- `cf certificate-authorities hostname-associations get` — List Hostname Associations.\n\n### Update Operations\n\n- `cf certificate-authorities hostname-associations update` — Replace Hostname Associations. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -39,13 +42,14 @@
 		"client-side-security": "# client-side-security — Client-Side Security — monitor JavaScript, connections, and cookies on your pages for supply-chain attacks\n\n## Commands\n\n### Read Operations\n\n- `cf client-side-security connections get <connection-id>` — Returns a webpage connection detected on the zone by connection ID.\n- `cf client-side-security connections list` — Lists outbound connections made by webpages in the zone.\n- `cf client-side-security cookies get <cookie-id>` — Returns a cookie detected on the zone by cookie ID.\n- `cf client-side-security cookies list` — Lists cookies detected on the zone.\n- `cf client-side-security policies get <policy-id>` — Returns a content security rule by ID.\n- `cf client-side-security policies list` — Lists content security rules configured for the zone.\n- `cf client-side-security scripts get <script-id>` — Returns a script detected on the zone by script ID.\n- `cf client-side-security scripts list` — Lists scripts detected on webpages in the zone, with filtering and pagination.\n- `cf client-side-security settings get` — Returns the client-side security product enablement status and reporting behaviors.\n\n### Create Operations\n\n- `cf client-side-security policies create` — Creates a rule that applies a client-side security action when its filter expression matches. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf client-side-security policies update <policy-id>` — Updates the description, action, expression, enabled state, and policy value for a content security rule. (supports --dry-run, --body)\n- `cf client-side-security settings update` — Updates client-side security enablement and reporting behaviors for the zone. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf client-side-security policies delete <policy-id>` — Permanently deletes a content security rule by ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"cloud-connector": "# cloud-connector — Route traffic from Cloudflare directly to cloud provider services (AWS, Azure, GCP) without origin servers\n\n## Commands\n\n### Read Operations\n\n- `cf cloud-connector rules list` — Retrieves the Cloud Connector rules configured for a zone. Rules define how traffic is routed to cloud services.\n\n### Update Operations\n\n- `cf cloud-connector rules update` — Updates Cloud Connector rules for a zone, replacing the existing rule configuration. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"cloudforce-one": "# cloudforce-one — Detection rule management APIs\n\n## Commands\n\n### Read Operations\n\n- `cf cloudforce-one binary-storage get <hash>` — Retrieves a binary file from the Cloudforce One binary storage for analysis.\n- `cf cloudforce-one events aggregate get` — Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.\n- `cf cloudforce-one events categories catalog get` — Lists categories\n- `cf cloudforce-one events dataset events get <event-id>` — Retrieves a specific event by its UUID.\n- `cf cloudforce-one events dataset groups members get <group-id>` — List group members\n- `cf cloudforce-one events dataset indicators relationships list` — Returns sparse relationship edges. Optionally hydrate related entities via `expand`.\n- `cf cloudforce-one events dataset indicators tags get <dataset-id>` — Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.\n- `cf cloudforce-one events dataset permissions get <dataset-id>` — List permissions\n- `cf cloudforce-one events dataset tags indicators get <tag-uuid>` — Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to UUIDs, analytics datasets, or operational datasets. Analytics datasets do not expose tag associations, so the analytics scope returns an empty result.\n- `cf cloudforce-one events dataset target industries get <dataset-id>` — Lists all target industries for a specific dataset\n- `cf cloudforce-one events indicator types get` — Lists indicator types across multiple datasets\n- `cf cloudforce-one events indicators get` — Retrieves indicators across specified datasets, ordered by createdAt descending then UUID, dataset ID, and shard ID ascending. Use the standalone datasetIds value 'all'/'*' for legacy all-datasets behavior, 'analytics' for isAnalytics=true datasets, or 'operational' for isAnalytics=false datasets. If no datasetIds are provided, uses the default dataset.\n- `cf cloudforce-one events relationships get <event-id>` — The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.\n- `cf cloudforce-one events tags categories get` — Returns all Source-of-Truth tag categories for an account.\n- `cf cloudforce-one events tags get` — Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.\n- `cf cloudforce-one events tags relationships list` — Returns sparse relationship edges. Optionally hydrate related entities via `expand`. Fans out across all accessible indicator dataset shards. Analytics datasets do not expose tag associations, so the analytics scope returns an empty result.\n- `cf cloudforce-one events target industries catalog get` — Lists all target industries from industry map catalog\n- `cf cloudforce-one requests assets get <asset-id>` — Retrieves an asset attached to a Cloudforce One intelligence request.\n- `cf cloudforce-one requests get <request-id>` — Retrieves details for a specific Cloudforce One intelligence request.\n- `cf cloudforce-one requests list` — Lists Cloudforce One intelligence requests with filtering and pagination. (supports --body)\n- `cf cloudforce-one requests message get <request-id>` — Lists messages in a Cloudforce One intelligence request conversation. (supports --body)\n- `cf cloudforce-one requests priority get <priority-id>` — Retrieves a specific priority intelligence request from Cloudforce One.\n- `cf cloudforce-one requests priority list` — Lists priority intelligence requests in Cloudforce One. (supports --body)\n- `cf cloudforce-one rules approvals get <id>` — Get a single rule approval with current rule data.\n- `cf cloudforce-one rules approvals list` — Returns rule approvals with optional status, revision, reviewer-scope, and mutation-type filtering.\n- `cf cloudforce-one rules email get <id>` — Get a structured email rule by ID.\n- `cf cloudforce-one rules email list` — Returns structured email rules.\n- `cf cloudforce-one rules email schema get` — Get the field catalog for structured email rules.\n- `cf cloudforce-one rules exemptions get` — Get all exemption rule patterns for the account, grouped by type.\n- `cf cloudforce-one rules get <id>` — Get a single rule by ID.\n- `cf cloudforce-one rules list` — Returns all rules for an account with optional filtering.\n- `cf cloudforce-one rules managed get` — Get DFP managed rule metadata (name and description) from YARA rules.\n- `cf cloudforce-one rules stats get` — Get statistics about rules for the dashboard.\n- `cf cloudforce-one rules tree get` — Get the folder tree structure for rules navigation.\n- `cf cloudforce-one scans config list` — Lists scan configurations for Cloudforce One's network scanning service.\n- `cf cloudforce-one scans results get <config-id>` — Retrieves the latest scan results for a Cloudforce One scan configuration, including discovered open ports.\n- `cf cloudforce-one stakeout collections export <collection-id>` — Streams collection data in the requested format. Supports CSV (default), JSONL, or Markdown via Accept header. Queries items in batches of 1000 to avoid memory/timeout limits.\n- `cf cloudforce-one stakeout collections get <collection-id>` — Retrieves a single collection by ID with its schema and metadata\n- `cf cloudforce-one stakeout collections list` — Retrieves all collections for an account with pagination\n- `cf cloudforce-one stakeout graphs get` — Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. \"event:550e8400-...\". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope.\n- `cf cloudforce-one stakeout items get <item-id>` — Retrieve a single item from a collection by its identifier.\n- `cf cloudforce-one stakeout letter-templates get <template-id>` — Get a specific user-defined takedown letter template by ID. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout letter-templates list` — List user-defined takedown letter templates. System example templates are available via the /templates/examples endpoint.\n- `cf cloudforce-one stakeout takedown-letters get <letter-id>` — Get a specific takedown letter by ID, including the rendered text.\n- `cf cloudforce-one stakeout takedown-letters list` — List all letters for a specific takedown notice.\n- `cf cloudforce-one stakeout takedown-notices get <notice-id>` — Get a specific takedown notice by ID.\n- `cf cloudforce-one stakeout takedown-notices list` — List all takedown notices for the account.\n- `cf cloudforce-one threat-events attackers list` — Lists known threat attackers tracked in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-events categories get <category-id>` — Retrieves details for a specific threat event category.\n- `cf cloudforce-one threat-events categories list` — Lists all threat event categories configured for classifying and organizing threat events.\n- `cf cloudforce-one threat-events countries list` — Lists countries referenced in Cloudforce One threat intelligence data.\n- `cf cloudforce-one threat-events datasets get <dataset-id>` — Retrieves details for a specific threat event dataset.\n- `cf cloudforce-one threat-events datasets list` — Lists all threat event datasets configured in Cloudforce One.\n- `cf cloudforce-one threat-events get <event-id>` — This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.\n- `cf cloudforce-one threat-events indicator-types list` — This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.\n- `cf cloudforce-one threat-events list` — Use `datasetId=all` or `datasetId=*` for the legacy all-datasets scope, `datasetId=analytics` for datasets with `isAnalytics=true`, or `datasetId=operational` for datasets with `isAnalytics=false` (limited to 50). Scope values must be used alone. When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.\n- `cf cloudforce-one threat-events raw get <raw-id>` — Retrieves raw threat event data for a specific event in Cloudforce One.\n- `cf cloudforce-one threat-events target-industries list` — Retrieves the catalog of industry classifications used in Cloudforce One threat intelligence.\n- `cf cloudforce-one threat-signals articles get <article-id>` — Get Threat Signals article.\n- `cf cloudforce-one threat-signals articles list` — List Threat Signals articles.\n- `cf cloudforce-one threat-signals curated-feeds list` — List curated Threat Signals feeds.\n- `cf cloudforce-one threat-signals feeds list` — List Threat Signals feeds.\n- `cf cloudforce-one threat-signals feeds skills get <feed-id>` — Get Threat Signals feed skills.\n- `cf cloudforce-one threat-signals indicators list` — List Threat Signals article indicators.\n- `cf cloudforce-one threat-signals skills get <skill-id>` — Get Threat Signals skill.\n- `cf cloudforce-one threat-signals skills list` — List Threat Signals skills.\n- `cf cloudforce-one threat-signals skills tag-categories get <skill-id>` — Get Threat Signals skill tag categories.\n\n### Create Operations\n\n- `cf cloudforce-one binary-storage create` — Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. (supports --dry-run, --body)\n- `cf cloudforce-one events categories create <category-id>` — Updates a category (supports --dry-run, --body)\n- `cf cloudforce-one events create <event-id>` — Updates an event (supports --dry-run, --body)\n- `cf cloudforce-one events dataset copy create <dataset-id>` — Copies specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset create <dataset-id>` — Updates an existing dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups create` — Create a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset groups members create <group-id>` — Create a group member (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicator types create create <dataset-id>` — Creates a new indicator type and initializes its dedicated Durable Object (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators bulk create <dataset-id>` — Creates multiple indicators at once with their respective types and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators create create <dataset-id>` — Creates a new indicator with the specified type and related datasets. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators relationships create <indicator-id>` — Creates a new relationship with the indicator as the source entity. Indicator↔indicator relationships are not supported. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset move create <dataset-id>` — Moves specified events from one dataset to another dataset (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions create <dataset-id>` — Create a permission (supports --dry-run, --body)\n- `cf cloudforce-one events datasets populate create` — Populate dataset-specific lookup tables from existing Events data with batch processing (supports --dry-run)\n- `cf cloudforce-one events queries create <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events raw create <raw-id>` — Updates a raw event (supports --dry-run, --body)\n- `cf cloudforce-one events relate create create <event-id>` — Creates event references for a event (supports --dry-run, --body)\n- `cf cloudforce-one events relationships create create` — Creates a directed relationship between two events. The relationship is from parent to child with a specified type. (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories create create` — Creates a new Source-of-Truth tag category for an account. (supports --dry-run, --body)\n- `cf cloudforce-one events tags relationships create <tag-uuid>` — Creates a new relationship with the tag as the source entity. Requires a datasetId to locate the Indicators DO. (supports --dry-run, --body)\n- `cf cloudforce-one requests asset-new create <request-id>` — Uploads a new asset to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets create <request-id>` — Lists assets attached to a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests create` — Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. (supports --dry-run, --body)\n- `cf cloudforce-one requests message create <request-id>` — Adds a message to a Cloudforce One intelligence request conversation. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority create` — Creates a new priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one rules create` — Create a new detection rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email create` — Create a structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions create` — Add regex patterns to per-account exemption rules (union semantics). Missing keys leave that type untouched; duplicates are silently deduped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config create` — Creates a new scan configuration for Cloudforce One's network scanning service. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections create` — Creates a collection with four patterns: schema-only (empty collection), rows-only (inferred schema), schema+rows (validated data), or file upload (CSV/JSON/JSONL) (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns create <collection-id>` — Adds a new column to an existing collection schema. Existing items will have NULL for the new column unless a default value is provided. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries create` — Create a new saved brand protection query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items create <collection-id>` — Create one or more items in a collection. Supports single item (data field) or bulk creation (data array). Item data is validated against the collection schema. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates create` — Create a new user-defined takedown letter template (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters create <notice-id>` — Generate a takedown letter for a notice and persist the rendered text. The PDF is generated lazily on download. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices create` — Create a new takedown notice for a domain suspected of trademark infringement. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories create` — Creates a new threat event category in Cloudforce One for organizing and classifying threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events create <account-id-path>` — To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets create` — Creates a new threat event dataset in Cloudforce One for organizing related threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events event-tags create <event-id>` — Adds a tag to a threat event in Cloudforce One for classification and filtering. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events tags create` — Creates a new tag to be used accross threat events. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds create` — Create curated Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds create` — Create Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills create` — Create Threat Signals skill. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf cloudforce-one events dataset groups update <group-id>` — Update a group (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators patch <indicator-id>` — Updates an existing indicator's properties. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset indicators relationships update <rel-uuid>` — Partially updates a relationship by UUID. Only provided fields are changed. (supports --dry-run, --body)\n- `cf cloudforce-one events dataset permissions update <grant-id>` — Update a permission (supports --dry-run, --body)\n- `cf cloudforce-one events queries patch <query-id>` — Update an existing saved event query by its ID (supports --dry-run, --body)\n- `cf cloudforce-one events tags categories patch <category-uuid>` — Updates a Source-of-Truth tag category by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags patch <tag-uuid>` — Updates a Source-of-Truth tag by UUID. (supports --dry-run, --body)\n- `cf cloudforce-one events tags relationships update <rel-uuid>` — Partially updates a relationship by UUID. Requires datasetId query param. (supports --dry-run, --body)\n- `cf cloudforce-one events update bulk patch` — Updates multiple events with the same field values. Maximum 100 events per request. (supports --dry-run, --body)\n- `cf cloudforce-one requests assets update <asset-id>` — Updates an asset in a Cloudforce One intelligence request. (supports --dry-run, --body)\n- `cf cloudforce-one requests message update <message-id>` — Updates a message in a Cloudforce One intelligence request thread. (supports --dry-run, --body)\n- `cf cloudforce-one requests priority update <priority-id>` — Updates a priority intelligence request in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one requests update <request-id>` — Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. (supports --dry-run, --body)\n- `cf cloudforce-one rules email update <id>` — Updates an existing structured email rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules exemptions update` — Replace existing exemption patterns with new values. Each key maps to an array of {old_pattern, new_pattern} entries. Missing keys leave that type untouched. Fails if any old pattern is not found or any new pattern already exists. (supports --dry-run, --body)\n- `cf cloudforce-one rules update <id>` — Updates an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one scans config edit <config-id>` — Updates an existing scan configuration in Cloudforce One's network scanning service. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout collections update <collection-id>` — Updates collection name and/or metadata. Schema (columns) cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout columns update <column-id>` — Update name, type, required, or position of a column. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout domain-queries update <query-id>` — Update a saved brand protection domain query with string match patterns (supports --dry-run, --body)\n- `cf cloudforce-one stakeout items update <item-id>` — Update an item in a collection with partial data. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates update <template-id>` — Update a user-defined takedown letter template. System templates cannot be modified. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-notices update <notice-id>` — Update a takedown notice (e.g. change status to sent, resolved, etc.). (supports --dry-run, --body)\n- `cf cloudforce-one threat-events categories edit <category-id>` — Partially updates a threat event category in Cloudforce One, modifying specific fields without replacing the entire category. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets edit <dataset-id>` — Partially updates a threat event dataset in Cloudforce One, modifying specific fields without replacing the entire dataset configuration. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events edit <event-id>` — Partially updates a threat event in Cloudforce One, modifying specific fields without replacing the entire event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events raw edit <raw-id>` — Partially updates raw threat event data in Cloudforce One, modifying specific fields of the event. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds update <curated-feed-id>` — Update curated Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds skills update <feed-id>` — Set Threat Signals feed skills. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds update <feed-id>` — Update Threat Signals feed. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills tag-categories update <skill-id>` — Replace Threat Signals skill tag categories. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals skills update <skill-id>` — Update Threat Signals skill. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf cloudforce-one events dataset delete <dataset-id>` — Soft-deletes a dataset given a datasetId. (supports --dry-run)\n- `cf cloudforce-one events dataset groups delete <group-id>` — Delete a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups members delete <member-id>` — Delete a group member (supports --dry-run)\n- `cf cloudforce-one events dataset indicators delete <indicator-id>` — Deletes a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events dataset indicators relationships delete <rel-uuid>` — Deletes a relationship by UUID. Idempotent: returns deleted=false if not found. (supports --dry-run)\n- `cf cloudforce-one events dataset permissions delete <grant-id>` — Delete a permission (supports --dry-run)\n- `cf cloudforce-one events delete delete <dataset-id>` — Deletes one or more events (supports --dry-run)\n- `cf cloudforce-one events queries delete <query-id>` — Delete a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories delete <category-uuid>` — Deletes a Source-of-Truth tag category by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags delete <tag-uuid>` — Deletes a Source-of-Truth tag by UUID. (supports --dry-run)\n- `cf cloudforce-one events tags relationships delete <rel-uuid>` — Deletes a relationship by UUID. Idempotent: returns deleted=false if not found. Requires datasetId query param. (supports --dry-run)\n- `cf cloudforce-one requests assets delete <asset-id>` — Removes an asset from a Cloudforce One intelligence request. (supports --dry-run)\n- `cf cloudforce-one requests delete <request-id>` — Deletes a Cloudforce One intelligence request and all associated data. (supports --dry-run)\n- `cf cloudforce-one requests message delete <message-id>` — Removes a message from a Cloudforce One intelligence request thread. (supports --dry-run)\n- `cf cloudforce-one requests priority delete <priority-id>` — Deletes a priority intelligence request from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one rules delete <id>` — Delete an existing rule. (supports --dry-run, --body)\n- `cf cloudforce-one rules email delete <id>` — Delete an existing structured email rule. (supports --dry-run)\n- `cf cloudforce-one rules exemptions delete` — Remove regex patterns from per-account exemption rules. Missing keys leave that type untouched; non-existent patterns are silently skipped. (supports --dry-run, --body)\n- `cf cloudforce-one scans config delete <config-id>` — Deletes a scan configuration from Cloudforce One's network scanning service. (supports --dry-run)\n- `cf cloudforce-one stakeout collections delete <collection-id>` — Deletes a collection and all its items. This action cannot be undone. The Durable Object storage is deleted asynchronously. (supports --dry-run)\n- `cf cloudforce-one stakeout columns delete <column-id>` — Delete a column from the collection schema. Data is preserved as orphaned UUID keys (forensic safety) and filtered from API responses. (supports --dry-run)\n- `cf cloudforce-one stakeout domain-queries delete <query-id>` — Delete a saved brand protection domain query from the account_queries table. This operation will remove the query from the durable object database. Returns 404 if the query ID doesn't exist. (supports --dry-run)\n- `cf cloudforce-one stakeout items delete <item-id>` — Delete an item from a collection by its identifier. (supports --dry-run)\n- `cf cloudforce-one stakeout letter-templates delete <template-id>` — Delete a user-defined takedown letter template. System templates cannot be deleted. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters delete <letter-id>` — Delete a specific takedown letter and its associated PDF from storage. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices delete <notice-id>` — Delete a takedown notice and all associated letters. PDFs are also removed from storage. (supports --dry-run)\n- `cf cloudforce-one threat-events categories delete <category-id>` — Removes a threat event category from Cloudforce One. (supports --dry-run)\n- `cf cloudforce-one threat-events event-tags delete <event-id>` — Removes a tag from a threat event in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events relate delete <event-id>` — Removes a reference link between related threat events in Cloudforce One. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles tags remove <tag-id>` — Remove tag from Threat Signals article. (supports --dry-run)\n- `cf cloudforce-one threat-signals curated-feeds delete <curated-feed-id>` — Delete curated Threat Signals feed. (supports --dry-run)\n- `cf cloudforce-one threat-signals feeds delete <feed-id>` — Delete Threat Signals feed. (supports --dry-run)\n- `cf cloudforce-one threat-signals skills delete <skill-id>` — Delete Threat Signals skill. (supports --dry-run)\n\n### Other Operations\n\n- `cf cloudforce-one events dataset groups get group` — List groups for an account (supports --dry-run)\n- `cf cloudforce-one events dataset groups get v2 <group-id>` — Read a group for an account (supports --dry-run)\n- `cf cloudforce-one events dataset indicators get indicator <indicator-id>` — Retrieves a specific indicator by its UUID. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph ql` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events graphql create graph qlv2` — Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. (supports --dry-run)\n- `cf cloudforce-one events queries create-create` — Create a new saved event query for the account (supports --dry-run, --body)\n- `cf cloudforce-one events queries get event` — Retrieve all saved event queries for the account (supports --dry-run)\n- `cf cloudforce-one events queries get v2 <query-id>` — Retrieve a saved event query by its ID (supports --dry-run)\n- `cf cloudforce-one events tags categories get-by-id <category-uuid>` — Returns a single Source-of-Truth tag category by UUID, including its full schema. (supports --dry-run)\n- `cf cloudforce-one events tags get-by-id <tag-uuid>` — Returns a single Source-of-Truth tag by UUID, including custom fields (properties). (supports --dry-run)\n- `cf cloudforce-one requests constants` — Retrieves constant values used in Cloudforce One requests, including valid statuses and types. (supports --dry-run)\n- `cf cloudforce-one requests priority quota` — Retrieves quota usage for Cloudforce One priority requests. (supports --dry-run)\n- `cf cloudforce-one requests quota` — Retrieves quota usage for Cloudforce One standard requests. (supports --dry-run)\n- `cf cloudforce-one requests types` — Lists available request types for Cloudforce One intelligence requests. (supports --dry-run)\n- `cf cloudforce-one rules approvals cancel <id>` — Cancel a pending rule approval. Only its original requester may cancel it. (supports --dry-run)\n- `cf cloudforce-one rules approvals resubmit <id>` — Create a new pending revision from a rejected rule approval. Only the original requester may resubmit the latest revision. (supports --dry-run, --body)\n- `cf cloudforce-one rules deleteAll` — Delete all rules in an account. (supports --dry-run)\n- `cf cloudforce-one rules email approvals resubmit <id>` — Validates and compiles a complete structured email rule, then creates an immutable pending revision of its rejected approval. (supports --dry-run, --body)\n- `cf cloudforce-one rules email test <id>` — Test a structured email rule against sample email JSON. (supports --dry-run, --body)\n- `cf cloudforce-one rules email updatePendingApproval <id>` — Validate, compile, and replace the proposed structured email rule on a pending approval. Only the original requester may update it. (supports --dry-run, --body)\n- `cf cloudforce-one rules email validate` — Validates structured email rule syntax and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one rules search` — Search rules using hybrid, vector, keyword, or exact retrieval, backed by AI Search with a SQL fallback. (supports --dry-run)\n- `cf cloudforce-one rules validate` — Validates rule syntax, name uniqueness, namespace, and metadata. (supports --dry-run, --body)\n- `cf cloudforce-one scans results getBanners <config-id>` — Retrieves the latest banner grab results for a Cloudforce One scan configuration, including service banners from open ports. (supports --dry-run)\n- `cf cloudforce-one stakeout indicators aggregate` — Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. (supports --dry-run)\n- `cf cloudforce-one stakeout items query <collection-id>` — Retrieves items from a collection with keyset pagination and optional column-based filters (supports --dry-run)\n- `cf cloudforce-one stakeout items search <collection-id>` — Search collection items with advanced filtering. Supports operators (eq, neq, gt, lt, gte, lte, contains, is_empty, is_not_empty) and AND/OR logic for complex queries. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout letter-templates examples` — List system-provided example templates that can be used as starting points when creating custom templates. These templates cannot be used directly for letter generation. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-letters generate` — Generate a takedown letter from a template. Returns V4 JSON for text format or a PDF binary for pdf format. (supports --dry-run, --body)\n- `cf cloudforce-one stakeout takedown-letters get-pdf <letter-id>` — Download the PDF for a stored takedown letter. If no PDF exists yet, it is generated from the stored letter text and cached for future downloads. (supports --dry-run)\n- `cf cloudforce-one stakeout takedown-notices lookup` — Bulk lookup of takedown notices by domain names. Returns an array of { domain, queryId, notice } entries (notice is null when no match exists). Supports optional queryId or queryIds to scope lookups per query. Uses POST to avoid URL length limits when looking up many domains. This endpoint is read-only. Domains are normalized (trimmed, lowercased) and deduplicated. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events bulk-create` — The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. (supports --dry-run, --body)\n- `cf cloudforce-one threat-events datasets raw <event-id>` — Retrieves the raw data associated with an event. Searches across all shards in the dataset. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles bulk-mark-read` — Bulk update Threat Signals article read status. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles get-content <article-id>` — Get Threat Signals article content. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles mark-read <article-id>` — Update Threat Signals article read status. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles skills get-output <skill-id>` — Get Threat Signals article skill output. (supports --dry-run)\n- `cf cloudforce-one threat-signals articles tags add <article-id>` — Add tag to Threat Signals article. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals articles tags generate <article-id>` — Generate Threat Signals article AI tags. (supports --dry-run)\n- `cf cloudforce-one threat-signals curated-feeds bulk-create` — Bulk create curated Threat Signals feeds. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals curated-feeds opt-out` — Opt out of curated Threat Signals feeds. (supports --dry-run, --body)\n- `cf cloudforce-one threat-signals feeds get-raw <feed-id>` — Get Threat Signals feed XML. (supports --dry-run)\n- `cf cloudforce-one threat-signals feeds poll` — Trigger Threat Signals feed poll. (supports --dry-run)\n- `cf cloudforce-one threat-signals health` — Check Threat Signals service health. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"complete": "# complete — Generate and handle shell completions\n\n## Commands\n\n### Other Operations\n\n- `cf complete [shell]` — Generate and handle shell completions\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-interrupts": "# connector-interrupts — connector-interrupts\n\n## Commands\n\n### Read Operations\n\n- `cf connector-interrupts list` — Lists interrupts for a Magic WAN Connector.\n\n### Create Operations\n\n- `cf connector-interrupts create <connector-id>` — Creates an interrupt for a Magic WAN Connector. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-events": "# connector-telemetry-events — connector-telemetry-events\n\n## Commands\n\n### Read Operations\n\n- `cf connector-telemetry-events get <event-n>` — Gets Magic WAN Connector Telemetry Event\n- `cf connector-telemetry-events list` — Lists Magic WAN Connector Telemetry Events\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-events-latest": "# connector-telemetry-events-latest — connector-telemetry-events-latest\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-snapshots": "# connector-telemetry-snapshots — connector-telemetry-snapshots\n\n## Commands\n\n### Read Operations\n\n- `cf connector-telemetry-snapshots get <snapshot-t>` — Gets Magic WAN Connector Telemetry Snapshot\n- `cf connector-telemetry-snapshots list` — Lists Magic WAN Connector Telemetry Snapshots\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connector-telemetry-snapshots-latest": "# connector-telemetry-snapshots-latest — connector-telemetry-snapshots-latest\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"connectors": "# connectors — connectors\n\n## Commands\n\n### Read Operations\n\n- `cf connectors get <connector-id>` — Gets a Magic WAN Connector.\n- `cf connectors list` — Lists Magic WAN Connectors.\n\n### Create Operations\n\n- `cf connectors create` — Creates a Magic WAN Connector. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf connectors edit <connector-id>` — Edits properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n- `cf connectors update <connector-id>` — Updates properties of a Magic WAN Connector. May be used to re-provision a license key. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf connectors delete <connector-id>` — Deletes a Magic WAN Connector. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"containers": "# containers — Deploy and manage Containers applications on Cloudflare's global network\n\n## Commands\n\n### Read Operations\n\n- `cf containers applications get <application-id>` — Returns a single application by id.\n- `cf containers applications instances get <instance-id>` — Returns a container instance belonging to an application.\n- `cf containers applications instances list` — Lists container instances belonging to an application.\n- `cf containers applications list` — Lists all the applications that are associated with your account.\n- `cf containers applications versions list` — Returns all versions for a scheduler-backed application with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`.\n- `cf containers registries list` — Get the list of configured registries in the account.\n\n### Create Operations\n\n- `cf containers applications create` — Create a Containers application. Use `scheduling_policy: \"default\"` for a scheduler-backed application. The Containers scheduler maintains the requested instance count and manages deployment configuration, placement, scaling, versions, and rollouts. Use `scheduling_policy: \"durable_object\"` for a Durable Object-managed application. Each Durable Object creates and manages the lifecycle of its container instance. This request accepts only `name`, `scheduling_policy`, and `durable_objects`. Application-level configuration, scaling, constraints, versions, and rollouts do not apply. (supports --dry-run, --body)\n- `cf containers applications rollouts create <application-id>` — Creates a rollout to update the application's configuration across instances with minimal downtime. Rollouts apply only to scheduler-backed applications with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`. (supports --dry-run, --body)\n- `cf containers registries create` — Registers credentials for a supported private external image registry so Containers can pull images from it. This endpoint does not create a registry or upload an image. Public Docker Hub images and images in the Cloudflare managed registry do not require this configuration. Refer to [Image management](https://developers.cloudflare.com/containers/platform-details/image-management/) for supported registries and instructions for storing registry credentials. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf containers applications edit <application-id>` — Modifies a single application by id. Changes that replace instance deployment configuration, including the image, must be applied with a rollout. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf containers applications delete <application-id>` — Deletes a single application by id. (supports --dry-run)\n- `cf containers registries delete <domain>` — Delete a registry from the account, this will prevent Containers from pulling images from the registry. (supports --dry-run)\n\n### Other Operations\n\n- `cf containers images prepare` — Idempotently starts or observes preparation of the runtime artifacts required to run one digest-pinned managed container image on Cloudflare's network. Returns 202 while durable preparation continues and 200 when the image is ready or preparation has reached a terminal error. (supports --dry-run, --body)\n- `cf containers registries credentials generate <domain>` — Generates credentials for accessing a configured container image registry. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"containers": "# containers — Deploy and manage Containers applications on Cloudflare's global network\n\n## Commands\n\n### Read Operations\n\n- `cf containers applications get <application-id>` — Returns a single application by id.\n- `cf containers applications instances get <instance-id>` — Returns a container instance belonging to an application.\n- `cf containers applications instances list` — Lists container instances belonging to an application.\n- `cf containers applications list` — Lists all the applications that are associated with your account.\n- `cf containers applications versions list` — Returns all versions for a scheduler-backed application with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`.\n- `cf containers images list` — List images in the Cloudflare managed registry.\n- `cf containers registries list` — Get the list of configured registries in the account.\n\n### Create Operations\n\n- `cf containers applications create` — Create a Containers application. Use `scheduling_policy: \"default\"` for a scheduler-backed application. The Containers scheduler maintains the requested instance count and manages deployment configuration, placement, scaling, versions, and rollouts. Use `scheduling_policy: \"durable_object\"` for a Durable Object-managed application. Each Durable Object creates and manages the lifecycle of its container instance. This request accepts only `name`, `scheduling_policy`, and `durable_objects`. Application-level configuration, scaling, constraints, versions, and rollouts do not apply. (supports --dry-run, --body)\n- `cf containers applications rollouts create <application-id>` — Creates a rollout to update the application's configuration across instances with minimal downtime. Rollouts apply only to scheduler-backed applications with `scheduling_policy: \"default\"`. Versions and rollouts do not apply to applications with `scheduling_policy: \"durable_object\"`. (supports --dry-run, --body)\n- `cf containers registries create` — Registers credentials for a supported private external image registry so Containers can pull images from it. This endpoint does not create a registry or upload an image. Public Docker Hub images and images in the Cloudflare managed registry do not require this configuration. Refer to [Image management](https://developers.cloudflare.com/containers/platform-details/image-management/) for supported registries and instructions for storing registry credentials. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf containers applications edit <application-id>` — Modifies a single application by id. Changes that replace instance deployment configuration, including the image, must be applied with a rollout. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf containers applications delete <application-id>` — Deletes a single application by id. (supports --dry-run)\n- `cf containers images delete <image>` — Delete an image tag in the Cloudflare managed registry.\n- `cf containers registries delete <domain>` — Delete a registry from the account, this will prevent Containers from pulling images from the registry. (supports --dry-run)\n\n### Other Operations\n\n- `cf containers build <path>` — Build a Container image from a Dockerfile.\n- `cf containers images prepare` — Idempotently starts or observes preparation of the runtime artifacts required to run one digest-pinned managed container image on Cloudflare's network. Returns 202 while durable preparation continues and 200 when the image is ready or preparation has reached a terminal error. (supports --dry-run, --body)\n- `cf containers push` — Push an existing local Docker image to Cloudflare's managed registry.\n- `cf containers registries credentials generate <domain>` — Generates credentials for accessing a configured container image registry. (supports --dry-run, --body)\n- `cf containers ssh <id> [ssh-command]` — SSH into a container.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"content-scan": "# content-scan — Malicious uploads detection, scan uploaded content in HTTP requests for malware and malicious payloads\n\n## Commands\n\n### Read Operations\n\n- `cf content-scan expressions list` — List the Content Scanning custom expressions configured for the zone, each with its own identifier. A custom expression tells the scanner how to reach content objects in a request it cannot parse on its own, such as files Base64-encoded inside a JSON body.\n- `cf content-scan get` — Get the current Content Scanning status for the zone, together with the date the status was last modified.\n\n### Create Operations\n\n- `cf content-scan expressions create` — Create one or more Content Scanning custom expressions, appending them to the existing list of the zone, and return the updated list. Each expression reaches content objects the scanner cannot find automatically, for example `lookup_json_string(http.request.body.raw, \"file\")`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf content-scan expressions update <expression-id>` — Update the Content Scanning custom expression with the given identifier and return the updated list of expressions. (supports --dry-run, --body)\n- `cf content-scan update` — Update the Content Scanning status by setting the status value to `enabled` or `disabled`. This is equivalent to calling the dedicated enable and disable endpoints. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf content-scan expressions delete <expression-id>` — Delete the Content Scanning custom expression with the given identifier and return the expressions that remain. Content objects reached only by the deleted expression are no longer scanned. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"csamScanner": "# csamScanner — csamScanner\n\n## Commands\n\n### Read Operations\n\n- `cf csamScanner get` — Retrieve the current CSAM Scanner configuration for a zone. The notification email is masked by default in responses.\n\n### Update Operations\n\n- `cf csamScanner edit` — Update the CSAM Scanner configuration for a zone. Allows enabling or disabling CSAM scanning, updating the notification email, and configuring scanning sources. When a new email is provided, email verification is triggered automatically. The `enabled` field is a toggle; the server may adjust it based on whether the notification email is verified. Returns 403 if the zone or account is locked by Trust & Safety. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"ct-alerting": "# ct-alerting — ct-alerting\n\n## Commands\n\n### Read Operations\n\n- `cf ct-alerting get` — Retrieve the Certificate Transparency alerting subscription settings for a zone. Returns whether CT monitoring is enabled and the list of email addresses that receive alerts, if any have been configured.\n\n### Update Operations\n\n- `cf ct-alerting update` — Create or update the Certificate Transparency alerting subscription for a zone. Enables or disables email notifications when certificates are issued for the zone's domains. The `enabled` field is required on every request and controls whether the subscription is active. The `emails` field is optional and, when provided, replaces the stored recipient list for the zone. When `emails` is omitted, the stored recipient list is preserved and only the enabled state is toggled. A maximum of 100 email addresses may be configured per zone. Requests that omit `enabled` are rejected with error code 1008. Subscribe and unsubscribe notification emails are only sent for recipients whose effective subscription state changes. Idempotent requests (no state change) send no notification email. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -57,6 +61,8 @@
 		"d1": "# d1 — D1 is Cloudflare's managed, serverless database with SQLite's SQL semantics, built-in disaster recovery, and Worker and HTTP API access.\n\n## Commands\n\n### Read Operations\n\n- `cf d1 export <database-id>` — Returns a URL where the SQL contents of your D1 can be downloaded. Note: this process may take some time for larger DBs, during which your D1 will be unavailable to serve queries. To avoid blocking your DB unnecessarily, an in-progress export must be continually polled or will automatically cancel. (supports --body)\n- `cf d1 get <database-id>` — Returns the specified D1 database.\n- `cf d1 list` — Returns a list of D1 databases.\n- `cf d1 migrations list <database>` — List unapplied D1 migrations as JSON. Applies nothing.\n\n### Create Operations\n\n- `cf d1 create` — Returns the created D1 database. (supports --dry-run, --body)\n- `cf d1 migrations create <message>` — Create a new empty D1 migration file, numbered one above the highest existing migration. Entirely local — takes no database, needs no credentials and makes no network calls. If an ORM manages your migrations, use its own generator instead; for Drizzle, use `drizzle-kit generate`.\n\n### Update Operations\n\n- `cf d1 edit <database-id>` — Updates partially the specified D1 database. (supports --dry-run, --body)\n- `cf d1 update <database-id>` — Updates the specified D1 database. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf d1 delete <database-id>` — Deletes the specified D1 database. (supports --dry-run)\n\n### Other Operations\n\n- `cf d1 import <database-id>` — Generates a temporary URL for uploading an SQL file to, then instructing the D1 to import it and polling it for status updates. Imports block the D1 for their duration. (supports --dry-run, --body)\n- `cf d1 migrations apply <database>` — Apply any unapplied D1 migrations. Creates the bookkeeping table if absent, diffs the migration files under --dir against what the table records, and applies the rest in numeric order. Wire-compatible with `wrangler d1 migrations apply`: same table shape, same --dir-relative recorded names, same ordering. The database must be identified by ID; names and binding names are not accepted.\n- `cf d1 query <database-id>` — Returns the query result as an object. (supports --dry-run, --body)\n- `cf d1 raw <database-id>` — Returns the query result rows as arrays rather than objects. This is a performance-optimized version of the /query endpoint. (supports --dry-run, --body)\n- `cf d1 time-travel get-bookmark <database-id>` — Retrieves the current bookmark, or the nearest bookmark at or before a provided timestamp. Bookmarks can be used with the restore endpoint to revert the database to a previous point in time. (supports --dry-run)\n- `cf d1 time-travel restore <database-id>` — Restores a D1 database to a previous point in time either via a bookmark or a timestamp. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"data-security": "# data-security — data-security\n\n## Commands\n\n### Other Operations\n\n- `cf data-security posture archiveFindingInstance <finding-id>` — Archive one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture changeFindingSeverity <finding-id>` — Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. (supports --dry-run, --body)\n- `cf data-security posture createContentExport` — Creates a CSV export for content and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingExportCSV` — Creates a CSV export for findings and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createFindingInstancesExportCSV <storage-namespace-id>` — Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. (supports --dry-run, --body)\n- `cf data-security posture createPolicy` — Creates a new policy configuration that defines automated actions to be executed when security findings are detected. A policy can include multiple remediation and/or webhook actions that will be triggered automatically. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobs` — Create one or more remediation jobs tied to a specific Cloudflare Account. (supports --dry-run, --body)\n- `cf data-security posture createRemediationJobsExportCSV` — Creates a CSV export for remediation jobs and accepts optional filters in the payload. (supports --dry-run, --body)\n- `cf data-security posture createWebhook` — Creates a new webhook configuration for sending finding notifications to external endpoints. (supports --dry-run, --body)\n- `cf data-security posture createWebhookJobs` — Creates webhook jobs to send a finding instance to one or more configured webhooks. (supports --dry-run, --body)\n- `cf data-security posture deletePolicy <policy-id>` — Deletes a policy configuration. (supports --dry-run)\n- `cf data-security posture deleteWebhook <webhook-id>` — Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. (supports --dry-run)\n- `cf data-security posture evaluateExistingWebhook <webhook-id>` — Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run)\n- `cf data-security posture evaluateNewWebhook` — Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: \"webhook.test\" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true (supports --dry-run, --body)\n- `cf data-security posture getExportJob <id>` — Retrieves a single export job by its unique identifier (supports --dry-run)\n- `cf data-security posture getFinding <finding-id>` — Gets a security Finding that has been identified as being problematic. (supports --dry-run)\n- `cf data-security posture getFindingInstance <instance-id>` — Gets a security Finding instance by id. (supports --dry-run)\n- `cf data-security posture getFindingType <finding-type-id>` — Retrieve a specific finding type by its unique identifier. (supports --dry-run)\n- `cf data-security posture getPolicyByID <policy-id>` — Retrieves the details of a specific policy configuration, including its associated remediation and webhook actions. (supports --dry-run)\n- `cf data-security posture getRemediationTypesForFindingType <finding-type-id>` — List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. (supports --dry-run)\n- `cf data-security posture getWebhookConfigByID <webhook-id>` — Retrieves a specific webhook configuration by its unique identifier. (supports --dry-run)\n- `cf data-security posture ignoreFinding` — Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. (supports --dry-run, --body)\n- `cf data-security posture listContentAssets` — List DLP content findings (supports --dry-run)\n- `cf data-security posture listExportJobs` — List all export jobs for a given requestor's organization (supports --dry-run)\n- `cf data-security posture listFindingInstances <finding-id>` — Lists all security finding instances for a given security finding. (supports --dry-run)\n- `cf data-security posture listFindings` — List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not. (supports --dry-run)\n- `cf data-security posture listFindingTypes` — List all available finding types with pagination support. (supports --dry-run)\n- `cf data-security posture listPolicies` — Returns a list of integration-scoped policy configurations for the given account. This endpoint supports cursor based pagination. By default, results are returned in sorted order based on created_at. (supports --dry-run)\n- `cf data-security posture listPolicyLogs` — Returns a list of policy invocation logs for the given account, sourced from ClickHouse via Ready Analytics. Each entry represents one execution of a policy against a finding instance, including the actions (remediation jobs and webhooks) it dispatched. Results are scoped to the requesting account's CASB integrations. The `integration_id` query parameter, when supplied, is intersected against the account's integration allowlist; values outside the allowlist are silently dropped. Pagination is offset-based. The response does not include a total row count; clients should treat a result with fewer than `per_page` entries as the end of the list. (supports --dry-run)\n- `cf data-security posture listRemediationJobs` — List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive. (supports --dry-run)\n- `cf data-security posture listWebhooks` — Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. (supports --dry-run)\n- `cf data-security posture resetFindingSeverity <finding-id>` — If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. (supports --dry-run)\n- `cf data-security posture unarchiveFindingInstance <finding-id>` — Remove the archive marking from one or more finding instances. (supports --dry-run, --body)\n- `cf data-security posture unIgnoreFinding` — Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. (supports --dry-run, --body)\n- `cf data-security posture updatePolicy <policy-id>` — Updates an existing policy configuration and replaces its actions. (supports --dry-run, --body)\n- `cf data-security posture updateWebhook <webhook-id>` — Updates an existing webhook configuration with new settings. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dcv-delegation": "# dcv-delegation — dcv-delegation\n\n## Commands\n\n### Read Operations\n\n- `cf dcv-delegation get` — Retrieve the account and zone specific unique identifier used as part of the CNAME target for DCV Delegation.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"deploy": "# deploy — Deploy a project to Cloudflare\n\n## Commands\n\n### Other Operations\n\n- `cf deploy` — Deploy a worker to Cloudflare (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"dev": "# dev — Run the project's Cloudflare dev server\n\n## Commands\n\n### Other Operations\n\n- `cf dev [implArgs]` — Run the project's Cloudflare dev server\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"diagnostics": "# diagnostics — Network diagnostic tools — traceroutes from Cloudflare's edge and endpoint health checks\n\n## Commands\n\n### Read Operations\n\n- `cf diagnostics endpoint-healthchecks get <id>` — Get a single Endpoint Health Check.\n- `cf diagnostics endpoint-healthchecks list` — List Endpoint Health Checks.\n\n### Create Operations\n\n- `cf diagnostics endpoint-healthchecks create` — Create Endpoint Health Check. (supports --dry-run, --body)\n- `cf diagnostics traceroutes create` — Run traceroutes from Cloudflare colos. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf diagnostics endpoint-healthchecks update <id>` — Update a Endpoint Health Check. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf diagnostics endpoint-healthchecks delete <id>` — Delete Endpoint Health Check. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"directory": "# directory — directory\n\n## Commands\n\n### Read Operations\n\n- `cf directory services get <service-id>` — Fetches a single Workers VPC connectivity service by its ID.\n- `cf directory services list` — Lists the Workers VPC connectivity services in the account.\n\n### Create Operations\n\n- `cf directory services create` — Creates a new Workers VPC connectivity service in the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf directory services update <service-id>` — Updates an existing Workers VPC connectivity service by its ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf directory services delete <service-id>` — Removes a single Workers VPC connectivity service by its ID. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"dispatch-namespaces": "# dispatch-namespaces — dispatch-namespaces\n\n## Commands\n\n### Read Operations\n\n- `cf dispatch-namespaces get <dispatch-namespace>` — Get a Workers for Platforms namespace.\n- `cf dispatch-namespaces list` — Fetch a list of Workers for Platforms namespaces.\n- `cf dispatch-namespaces scripts bindings get <script-name>` — Fetch script bindings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts content get <script-name>` — Fetch script content from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts get <script-name>` — Fetch information about a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts list` — Fetch a list of scripts uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets get <secret-name>` — Get a given secret binding (value omitted) on a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts secrets list` — List secrets bound to a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts settings get <script-name>` — Get script settings from a script uploaded to a Workers for Platforms namespace.\n- `cf dispatch-namespaces scripts tags list` — Fetch tags from a script uploaded to a Workers for Platforms namespace.\n\n### Create Operations\n\n- `cf dispatch-namespaces create` — Create a new Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts asset-upload create <script-name>` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags create <tag>` — Put a single tag on a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Update Operations\n\n- `cf dispatch-namespaces edit <dispatch-namespace>` — Patch a Workers for Platforms namespace. Omitted fields are left unchanged. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts content update <script-name>` — Put script content for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts secrets update <script-name>` — Add a secret to a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts settings edit <script-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts tags update <script-name>` — Put script tags for a script uploaded to a Workers for Platforms namespace. (supports --dry-run, --body)\n- `cf dispatch-namespaces scripts update <script-name>` — Upload a worker module to a Workers for Platforms namespace. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf dispatch-namespaces update <dispatch-namespace>` — Update a Workers for Platforms namespace. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf dispatch-namespaces delete <dispatch-namespace>` — Delete a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts delete <script-name>` — Delete a worker from a Workers for Platforms namespace. This call has no response body on a successful delete. (supports --dry-run)\n- `cf dispatch-namespaces scripts secrets delete <secret-name>` — Remove a secret from a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n- `cf dispatch-namespaces scripts tags delete <tag>` — Delete script tag for a script uploaded to a Workers for Platforms namespace. (supports --dry-run)\n\n### Other Operations\n\n- `cf dispatch-namespaces scripts bulk-delete` — Delete multiple scripts from a Workers for Platforms namespace based on optional tag filters. (supports --dry-run)\n- `cf dispatch-namespaces scripts secrets bulk-edit` — Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -103,7 +109,7 @@
 		"mesh": "# mesh — mesh\n\n## Commands\n\n### Read Operations\n\n- `cf mesh nodes configurations get <tunnel-id>` — Gets the high-availability configuration for a WARP Connector tunnel.\n- `cf mesh nodes connections list` — Fetches connection details for a WARP Connector Tunnel.\n- `cf mesh nodes connectors get <connector-id>` — Fetches connector and connection details for a WARP Connector Tunnel.\n- `cf mesh nodes get <tunnel-id>` — Fetches a single Warp Connector Tunnel.\n- `cf mesh nodes list` — Lists and filters Warp Connector Tunnels in an account.\n- `cf mesh nodes token get <tunnel-id>` — Gets the token used to associate warp device with a specific Warp Connector tunnel.\n\n### Create Operations\n\n- `cf mesh nodes create` — Creates a new Warp Connector Tunnel in an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf mesh nodes configurations update <tunnel-id>` — Adds or updates the high-availability configuration for a WARP Connector tunnel. (supports --dry-run, --body)\n- `cf mesh nodes edit <tunnel-id>` — Updates an existing Warp Connector Tunnel. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mesh nodes delete <tunnel-id>` — Deletes a Warp Connector Tunnel from an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf mesh nodes failover <tunnel-id>` — Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"moq": "# moq — MoQ relays: provision a relay, then issue tokens for publishers and subscribers\n\n## Commands\n\n### Read Operations\n\n- `cf moq relays get <relay-id>` — Retrieves a single MoQ relay including config and status. Tokens are NOT included.\n- `cf moq relays list` — Lists all MoQ relays for the account. Returns only metadata. Config, status, and tokens are omitted. Results are cursor-paginated (keyset on the `created` timestamp). Use `created_before` / `created_after` with the `created` value of the first/last item in a page to fetch the adjacent page. `result_info` reports the page `count` and the `total` matching the cursor filters.\n- `cf moq relays tokens list` — Returns metadata for every token the relay accepts. Secrets are never returned, so a token that has been lost cannot be recovered here. There is no expiry filter: compare each token's `expires` to the current time to tell which ones have lapsed.\n\n### Create Operations\n\n- `cf moq relays create` — Provisions a new MoQ relay instance. Auto-creates a publish+subscribe token and a subscribe-only token. Token values are included in the response (shown once). Config is always set to defaults (upstreams off) and cannot be supplied here — sending a non-empty `config` is rejected (21014); `null` or `{}` is accepted as absent. Use PUT to configure the relay after it exists. (supports --dry-run, --body)\n- `cf moq relays tokens create <relay-id>` — Mints a new relay-scoped token and adds it to the relay's accepted-auth registry. The token value (secret) is shown once in the response. A relay may hold up to 10 tokens; creating an 11th is rejected. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf moq relays update <relay-id>` — Updates a relay's name and/or configuration. The relay ID goes in the URL path — `PUT /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level update endpoint. This is also the only way to set a relay's config (config cannot be set at create time). Partial updates: omitted fields are preserved; config sub-objects replace as whole objects when present. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf moq relays delete <relay-id>` — Soft-deletes a MoQ relay. The relay ID goes in the URL path — `DELETE /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level delete endpoint. (supports --dry-run)\n- `cf moq relays tokens delete <jti>` — Revokes a token by removing it from the set the relay accepts. Relays cache that set, so revocation takes effect within seconds rather than instantly, and connections already established with the token are not closed. Revoking an unknown token succeeds, so the call is idempotent. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"mtls-certificates": "# mtls-certificates — mtls-certificates\n\n## Commands\n\n### Read Operations\n\n- `cf mtls-certificates associations get <mtls-certificate-id>` — Lists all active associations between the certificate and Cloudflare services.\n- `cf mtls-certificates get <mtls-certificate-id>` — Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/).\n- `cf mtls-certificates list` — Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/).\n\n### Create Operations\n\n- `cf mtls-certificates create` — Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/). (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf mtls-certificates delete <mtls-certificate-id>` — Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"network": "# network — network\n\n## Commands\n\n### Read Operations\n\n- `cf network routes cidr get <route-id>` — Get a private network route in an account.\n- `cf network routes cidr list` — Lists and filters private network routes in an account.\n- `cf network routes hostname get <hostname-route-id>` — Get a hostname route.\n- `cf network routes hostname list` — Lists and filters hostname routes in an account.\n- `cf network subnets initial-resolved-ip get <address-family>` — Returns the account's default Initial Resolved IP Subnet for the given address family.\n- `cf network subnets list` — Lists and filters subnets in an account.\n- `cf network subnets warp get <subnet-id>` — Get a WARP IP assignment subnet.\n- `cf network virtual-networks get <virtual-network-id>` — Get a virtual network. (supports --body)\n- `cf network virtual-networks list` — Lists and filters virtual networks in an account.\n\n### Create Operations\n\n- `cf network routes cidr create` — Routes a private network through a Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf network routes hostname create` — Create a hostname route. (supports --dry-run, --body)\n- `cf network subnets warp create` — Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not) (supports --dry-run, --body)\n- `cf network virtual-networks create` — Adds a new virtual network to an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network routes cidr edit <route-id>` — Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request. (supports --dry-run, --body)\n- `cf network routes hostname edit <hostname-route-id>` — Updates a hostname route. (supports --dry-run, --body)\n- `cf network subnets cloudflare-source edit <address-family>` — Updates the Cloudflare Source subnet of the given address family (supports --dry-run, --body)\n- `cf network subnets initial-resolved-ip edit <address-family>` — Updates the CIDR for the account's default Initial Resolved IP Subnet of the given address family. The new CIDR must not conflict with existing private routes in the account. (supports --dry-run, --body)\n- `cf network subnets warp edit <subnet-id>` — Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated (supports --dry-run, --body)\n- `cf network virtual-networks edit <virtual-network-id>` — Updates an existing virtual network. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network routes cidr delete <route-id>` — Deletes a private network route from an account. (supports --dry-run)\n- `cf network routes hostname delete <hostname-route-id>` — Delete a hostname route. (supports --dry-run)\n- `cf network subnets warp delete <subnet-id>` — Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result. (supports --dry-run)\n- `cf network virtual-networks delete <virtual-network-id>` — Deletes an existing virtual network. (supports --dry-run)\n\n### Other Operations\n\n- `cf network routes resolve <ip>` — Fetches routes that contain the given IP address. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"network": "# network — network\n\n## Commands\n\n### Read Operations\n\n- `cf network routes cidr get <route-id>` — Get a private network route in an account.\n- `cf network routes cidr list` — Lists and filters private network routes in an account.\n- `cf network routes hostname get <hostname-route-id>` — Get a hostname route.\n- `cf network routes hostname list` — Lists and filters hostname routes in an account.\n- `cf network subnets initial-resolved-ip get <address-family>` — Returns the account's default Initial Resolved IP Subnet for the given address family.\n- `cf network subnets list` — Lists and filters subnets in an account.\n- `cf network subnets warp get <subnet-id>` — Get a WARP IP assignment subnet.\n- `cf network virtual-networks get <virtual-network-id>` — Get a virtual network.\n- `cf network virtual-networks list` — Lists and filters virtual networks in an account.\n\n### Create Operations\n\n- `cf network routes cidr create` — Routes a private network through a Cloudflare Tunnel. (supports --dry-run, --body)\n- `cf network routes hostname create` — Create a hostname route. (supports --dry-run, --body)\n- `cf network subnets warp create` — Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not) (supports --dry-run, --body)\n- `cf network virtual-networks create` — Adds a new virtual network to an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network routes cidr edit <route-id>` — Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request. (supports --dry-run, --body)\n- `cf network routes hostname edit <hostname-route-id>` — Updates a hostname route. (supports --dry-run, --body)\n- `cf network subnets cloudflare-source edit <address-family>` — Updates the Cloudflare Source subnet of the given address family (supports --dry-run, --body)\n- `cf network subnets initial-resolved-ip edit <address-family>` — Updates the CIDR for the account's default Initial Resolved IP Subnet of the given address family. The new CIDR must not conflict with existing private routes in the account. (supports --dry-run, --body)\n- `cf network subnets warp edit <subnet-id>` — Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated (supports --dry-run, --body)\n- `cf network virtual-networks edit <virtual-network-id>` — Updates an existing virtual network. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network routes cidr delete <route-id>` — Deletes a private network route from an account. (supports --dry-run)\n- `cf network routes hostname delete <hostname-route-id>` — Delete a hostname route. (supports --dry-run)\n- `cf network subnets warp delete <subnet-id>` — Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result. (supports --dry-run)\n- `cf network virtual-networks delete <virtual-network-id>` — Deletes an existing virtual network. (supports --dry-run)\n\n### Other Operations\n\n- `cf network routes resolve <ip>` — Fetches routes that contain the given IP address. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"network-interconnects": "# network-interconnects — Physical and virtual private interconnects between your infrastructure and Cloudflare's network\n\n## Commands\n\n### Read Operations\n\n- `cf network-interconnects cnis get <cni>` — Retrieves configuration details for a specific Cloud Network Interconnect (CNI), including connection status and parameters.\n- `cf network-interconnects cnis list` — Lists all Cloud Network Interconnects (CNIs) configured for the account, showing connection status and parameters.\n- `cf network-interconnects interconnects get <icon>` — Retrieves configuration and status details for a specific network interconnect.\n- `cf network-interconnects interconnects list` — Lists all network interconnects configured for the account, including physical and virtual connections.\n- `cf network-interconnects interconnects status <icon>` — Gets the current operational status of a network interconnect, including link state and traffic metrics.\n- `cf network-interconnects settings get` — Retrieves current settings configuration for the specified resource or service.\n- `cf network-interconnects slots get <slot>` — Gets information about a specific infrastructure slot allocation.\n- `cf network-interconnects slots list` — Lists all available infrastructure slots for the account, showing allocation status and capacity.\n\n### Create Operations\n\n- `cf network-interconnects cnis create` — Creates a new Cloud Network Interconnect (CNI) for private network connectivity between Cloudflare and your infrastructure. CNIs enable dedicated, high-performance network links. (supports --dry-run, --body)\n- `cf network-interconnects interconnects create` — Creates a new network interconnect for connecting Cloudflare's network to external networks. Interconnects provide dedicated bandwidth and reduced latency for traffic exchange. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf network-interconnects cnis update <cni>` — Updates the configuration of an existing Cloud Network Interconnect (CNI), including connection parameters and routing settings. (supports --dry-run, --body)\n- `cf network-interconnects settings update` — Updates configuration settings for the specified resource or service. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf network-interconnects cnis delete <cni>` — Permanently removes a Cloud Network Interconnect (CNI) configuration. The private network connection will be terminated. (supports --dry-run)\n- `cf network-interconnects interconnects delete <icon>` — Permanently removes a network interconnect configuration. The physical or virtual connection will be terminated. (supports --dry-run)\n\n### Other Operations\n\n- `cf network-interconnects interconnects loa <icon>` — Downloads the Letter of Authorization (LOA) for a network interconnect, required for physical cross-connect provisioning. (supports --dry-run)\n- `cf network-interconnects interconnects loa-default-name <icon>` — Retrieves the default customer name that will be used in the LOA if no name is provided to the `/accounts/{account_id}/cni/interconnects/{icon}/loa` endpoint. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"oauth-clients": "# oauth-clients — oauth-clients\n\n## Commands\n\n### Read Operations\n\n- `cf oauth-clients get <oauth-client-id>` — Get details of a specific OAuth client.\n- `cf oauth-clients list` — List all OAuth clients for an account.\n\n### Create Operations\n\n- `cf oauth-clients create` — Create a new OAuth client for an account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf oauth-clients update <oauth-client-id>` — Update an existing OAuth client. Only include fields you want to update. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf oauth-clients delete <oauth-client-id>` — Delete an OAuth client. (supports --dry-run)\n\n### Other Operations\n\n- `cf oauth-clients delete-rotated-secret <oauth-client-id>` — Removes the old client secret after a rotation, keeping only the new one. Use this after you have updated your client configuration to use the new secret. The `has_rotated_secret` field on the client indicates whether there is an old secret to delete. (supports --dry-run)\n- `cf oauth-clients rotate-secret <oauth-client-id>` — Creates a second client secret so you can update your client configuration before deleting the old one. The `has_rotated_secret` field on the client will be set to `true`. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"oauth-scopes": "# oauth-scopes — oauth-scopes\n\n## Commands\n\n### Read Operations\n\n- `cf oauth-scopes list` — List all available OAuth scopes. This endpoint requires authentication but has no authorization role requirements.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -129,7 +135,7 @@
 		"realtimekit": "# realtimekit — SDK-backed meetings, participants, recordings, livestreams, and webhooks\n\n## Commands\n\n### Read Operations\n\n- `cf realtimekit analytics livestreams daily get <app-id>` — Returns day-wise livestream analytics for the specified time range.\n- `cf realtimekit analytics livestreams get <app-id>` — Returns livestream analytics for the specified time range.\n- `cf realtimekit analytics usage get <app-id>` — Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date.\n- `cf realtimekit apps get <app-id>` — Fetch details for an app in your account.\n- `cf realtimekit apps list` — Fetch all apps for your account\n- `cf realtimekit livestreams get <livestream-id>` — Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API.\n- `cf realtimekit livestreams list` — Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter.\n- `cf realtimekit livestreams sessions get <livestream-session-id>` — Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API.\n- `cf realtimekit meetings active get <meeting-id>` — Returns details of an ongoing active session for the given meeting ID.\n- `cf realtimekit meetings get <meeting-id>` — Returns a meeting details in an App for the given meeting ID.\n- `cf realtimekit meetings list` — Returns all meetings for the given App ID.\n- `cf realtimekit meetings livestream get <meeting-id>` — Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.\n- `cf realtimekit meetings participants get <participant-id>` — Returns a participant details for the given meeting and participant ID.\n- `cf realtimekit meetings participants list` — Returns all participants detail for the given meeting ID.\n- `cf realtimekit presets get <preset-id>` — Fetches details of a preset using the provided preset ID\n- `cf realtimekit presets list` — Fetches all the presets belonging to an App.\n- `cf realtimekit recordings active get <meeting-id>` — Returns the active recording details for the given meeting ID.\n- `cf realtimekit recordings get <recording-id>` — Returns details of a recording for the given recording ID.\n- `cf realtimekit recordings list` — Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID.\n- `cf realtimekit sessions chat export <session-id>` — Returns a URL to download all chat messages of the session ID in CSV format.\n- `cf realtimekit sessions get <session-id>` — Returns data of the given session ID including recording details.\n- `cf realtimekit sessions list` — Returns details of all sessions of an App.\n- `cf realtimekit sessions livestreams get <session-id>` — Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.\n- `cf realtimekit sessions participants get <participant-id>` — Returns details of the given participant ID along with call statistics for the given session ID.\n- `cf realtimekit sessions participants list` — Returns a list of participants for the given session ID.\n- `cf realtimekit sessions peers get <peer-id>` — Returns participant details for the given peer ID along with call statistics.\n- `cf realtimekit sessions summaries export <session-id>` — Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text.\n- `cf realtimekit sessions transcripts export <session-id>` — Returns a URL to download the transcript for the session ID in CSV format.\n- `cf realtimekit webhooks events list` — Returns the list of webhook event names supported by RealtimeKit.\n- `cf realtimekit webhooks get <webhook-id>` — Returns webhook details for the given webhook ID.\n- `cf realtimekit webhooks list` — Returns details of all webhooks for an App.\n\n### Create Operations\n\n- `cf realtimekit apps create` — Create new app for your account (supports --dry-run, --body)\n- `cf realtimekit meetings active polls create <meeting-id>` — Creates a new poll in an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings create <app-id>` — Create a meeting for the given App ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants create <meeting-id>` — Adds a participant to the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets create <app-id>` — Creates a preset belonging to the current App (supports --dry-run, --body)\n- `cf realtimekit webhooks create <app-id>` — Adds a new webhook to an App. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf realtimekit meetings participants update <participant-id>` — Updates a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings update <meeting-id>` — Updates a meeting in an App for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets update <preset-id>` — Update a preset by the provided preset ID (supports --dry-run, --body)\n- `cf realtimekit webhooks update <webhook-id>` — Edits the webhook details for the given webhook ID. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf realtimekit meetings participants delete <participant-id>` — Deletes a participant for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit presets delete <preset-id>` — Deletes a preset using the provided preset ID (supports --dry-run)\n- `cf realtimekit webhooks delete <webhook-id>` — Removes a webhook for the given webhook ID. (supports --dry-run)\n\n### Other Operations\n\n- `cf realtimekit livestreams sessions list-active <livestream-id>` — Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API. (supports --dry-run)\n- `cf realtimekit livestreams start <meeting-id>` — Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run, --body)\n- `cf realtimekit livestreams stop <meeting-id>` — Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API. (supports --dry-run)\n- `cf realtimekit meetings active kick <meeting-id>` — Kicks one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active kick-all <meeting-id>` — Kicks all participants from an active session for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings active mute <meeting-id>` — Mutes one or more participants from an active session using user ID or custom participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings active mute-all <meeting-id>` — Mutes all participants of an active session for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit meetings livestream list-active <meeting-id>` — Returns details of all active livestreams for the given meeting ID. (supports --dry-run)\n- `cf realtimekit meetings participants replace <participant-id>` — Replaces a participant's details for the given meeting and participant ID. (supports --dry-run, --body)\n- `cf realtimekit meetings participants tokens refresh <participant-id>` — Regenerates participant's authentication token for the given meeting and participant ID. (supports --dry-run)\n- `cf realtimekit meetings replace <meeting-id>` — Replaces all the details for the given meeting ID. (supports --dry-run, --body)\n- `cf realtimekit presets replace <preset-id>` — Replace all details for the preset using the provided preset ID. (supports --dry-run, --body)\n- `cf realtimekit recordings control <recording-id>` — Pause/Resume/Stop a given recording ID. (supports --dry-run, --body)\n- `cf realtimekit recordings start <app-id>` — Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used. (supports --dry-run, --body)\n- `cf realtimekit recordings tracks start <app-id>` — Starts track recording for a meeting. Track recording currently records separate participant audio tracks as WebM files in the RealtimeKit bucket. Video track recording is in development. For more information, refer to [Track recording](/realtime/realtimekit/recording-guide/track-recording/). (supports --dry-run, --body)\n- `cf realtimekit sessions summaries generate <session-id>` — Trigger Summary generation of Transcripts for the session ID. (supports --dry-run)\n- `cf realtimekit webhooks replace <webhook-id>` — Replace all details for the given webhook ID. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"recent-submissions": "# recent-submissions — recent-submissions\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"refute": "# refute — refute\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"registrar": "# registrar — registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar extensions get <extension>` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar extensions list` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar registrations get <domain-name>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create [domain-name]` — Register a domain. Billable and non-refundable — a successful registration charges the account's default payment method. Input fields are extension-specific: they come from the extension's registration schema (`GET /registrar/extensions/{name}`) at run time, so run `cf registrar registrations create <domain> --help` to list the fields for that domain's extension, or pass a complete payload with --body. Required fields are prompted for interactively. Check availability and pricing first with `cf registrar domain-check`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domain-name>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar registrations check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar registrations get-registration-status <domain-name>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domain-name>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n- `cf registrar registrations search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"registrar": "# registrar — registrar\n\n## Commands\n\n### Read Operations\n\n- `cf registrar extensions get <extension>` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar extensions list` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar registrations get <domain-name>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar registrations create [domain-name]` — Register a domain. Billable and non-refundable — a successful registration charges the account's default payment method. Input fields are extension-specific: they come from `GET /registrar/extensions/{name}` at run time. Humans can run `create <domain> --help` and use prompts; reusable contacts can be passed as `--contacts @contacts.json`. Agents should call with `--dry-run --body '<json>'`: incomplete input returns structured `missingFields` with paths, choices, labels, and acknowledgement text without submitting. Retain the other input, collect the missing values, and repeat the dry run before checking availability and creating with explicit confirmation. Inspect unfinished workflows with `cf registrar registrations get-registration-status <domain>`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar registrations update <domain-name>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar registrations check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar registrations get-registration-status <domain-name>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar registrations get-update-status <domain-name>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n- `cf registrar registrations search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"registrar-sandbox": "# registrar-sandbox — registrar-sandbox\n\n## Commands\n\n### Read Operations\n\n- `cf registrar-sandbox extensions get <extension>` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar-sandbox extensions list` — Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.\n- `cf registrar-sandbox registrations get <domain-name>` — Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.\n- `cf registrar-sandbox registrations list` — Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.\n\n### Create Operations\n\n- `cf registrar-sandbox registrations create` — Starts a domain registration workflow. ### Prerequisites - The account must not already be at the maximum supported domain limit. A single account may own up to 500 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf registrar-sandbox registrations update <domain-name>` — Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf registrar-sandbox registrations check` — Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains. (supports --dry-run, --body)\n- `cf registrar-sandbox registrations get-registration-status <domain-name>` — Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ``` (supports --dry-run)\n- `cf registrar-sandbox registrations get-update-status <domain-name>` — Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely. (supports --dry-run)\n- `cf registrar-sandbox registrations search` — Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., \"acme corp\" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., \"coffee shop\" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., \"example.com\" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., \"com\" or \".app\") is not supported. Provide a keyword or domain name. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"reporting": "# reporting — reporting\n\n## Commands\n\n### Read Operations\n\n- `cf reporting industry get` — Gets the industry classification for an account.\n- `cf reporting policies get <policy-id>` — Gets a reporting policy by identifier.\n- `cf reporting policies list` — Lists all reporting policies for an account.\n- `cf reporting reports get <report-id>` — Gets a generated report by identifier.\n- `cf reporting reports list` — Lists all generated reports for an account.\n\n### Update Operations\n\n- `cf reporting industry update` — Updates the industry classification for an account. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"request-tracers": "# request-tracers — Trace how a request would be processed through Cloudflare's rules and configuration pipeline\n\n## Commands\n\n### Create Operations\n\n- `cf request-tracers traces create` — Traces a simulated HTTP request through Cloudflare's edge to analyze how rules, settings, and configurations would process the request. Useful for debugging firewall rules, page rules, and other request transformations without sending actual traffic. Supports custom headers, cookies, body content, and geolocation context. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -140,6 +146,7 @@
 		"rum": "# rum — Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics\n\n## Commands\n\n### Read Operations\n\n- `cf rum rules list` — Lists all the rules in a Web Analytics ruleset.\n- `cf rum site-info get <site-id>` — Retrieves a Web Analytics site.\n- `cf rum site-info list` — Lists all Web Analytics sites of an account.\n\n### Create Operations\n\n- `cf rum rules create <ruleset-id>` — Creates a new rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info create` — Creates a new Web Analytics site. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf rum rules update <rule-id>` — Updates a rule in a Web Analytics ruleset. (supports --dry-run, --body)\n- `cf rum site-info update <site-id>` — Updates an existing Web Analytics site. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf rum rules delete <rule-id>` — Deletes an existing rule from a Web Analytics ruleset. (supports --dry-run)\n- `cf rum site-info delete <site-id>` — Deletes an existing Web Analytics site. (supports --dry-run)\n\n### Other Operations\n\n- `cf rum rules bulk-create` — Modifies one or more rules in a Web Analytics ruleset with a single request. (supports --dry-run, --body)\n- `cf rum site-info list-site-tags` — Returns all site tags for an account as an array of site tag strings. This endpoint returns all results without pagination. (supports --dry-run)\n- `cf rum site-info list-zone-tags` — Returns all zone tags associated with Web Analytics sites for an account. These can be used to filter or exclude zones in the zone selection input. This endpoint returns all results without pagination. (supports --dry-run)\n- `cf rum site-info validate-hostname <hostname>` — Validates that the provided hostname is well-formed, does not contain wildcards, and has a valid TLD. Returns an empty result on success. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scan-logo": "# scan-logo — scan-logo\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scan-page": "# scan-page — scan-page\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"schema": "# schema — Show API schema details for a command\n\n## Commands\n\n### Read Operations\n\n- `cf schema [command]` — Show API schema details for a command\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"scim": "# scim — SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account\n\n## Commands\n\n### Read Operations\n\n- `cf scim groups get <group-id>` — Retrieves a single SCIM Group resource by group ID.\n- `cf scim groups list` — Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.\n- `cf scim resource-types get <resource-type-id>` — Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.\n- `cf scim resource-types list` — Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.\n- `cf scim schemas get <schema-id>` — Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.\n- `cf scim schemas list` — Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.\n- `cf scim service-provider-config get` — Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.\n- `cf scim users get <user-id>` — Retrieves a single account member as a SCIM User resource by user tag.\n- `cf scim users list` — Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq \"user@example.com\"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.\n\n### Create Operations\n\n- `cf scim groups create` — Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups). (supports --dry-run, --body)\n- `cf scim users create` — Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf scim groups edit <group-id>` — Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported. (supports --dry-run, --body)\n- `cf scim users edit <user-id>` — Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq \"work\"].value` is also accepted as an alias for `userName`. (supports --dry-run, --body)\n- `cf scim users update <user-id>` — Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf scim groups delete <group-id>` — Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success. (supports --dry-run)\n- `cf scim users delete <user-id>` — Deprovisions a SCIM User by removing their membership from this account (RFC 7644 Section 3.6). This does not delete the global Cloudflare user. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"search": "# search — search\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"secrets-store": "# secrets-store — Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products\n\n## Commands\n\n### Read Operations\n\n- `cf secrets-store quota get` — Lists the number of secrets used in the account.\n- `cf secrets-store secrets get <secret-id>` — Returns details of a single secret.\n- `cf secrets-store secrets list` — Lists all store secrets.\n- `cf secrets-store stores list` — Lists all the stores in an account.\n\n### Create Operations\n\n- `cf secrets-store secrets bulk create <store-id>` — Creates a secret in the account. (supports --dry-run, --body)\n- `cf secrets-store stores create` — Creates a store in the account. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf secrets-store secrets edit <secret-id>` — Updates a single secret. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf secrets-store secrets bulk delete <store-id>` — Deletes one or more secrets. (supports --dry-run, --body)\n- `cf secrets-store secrets delete <secret-id>` — Deletes a single secret. (supports --dry-run)\n- `cf secrets-store stores delete <store-id>` — Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the \"store_not_empty\" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter. (supports --dry-run)\n\n### Other Operations\n\n- `cf secrets-store secrets duplicate <secret-id>` — Creates a duplicate of the secret, keeping the value. (supports --dry-run, --body)\n- `cf secrets-store system-stores get by id <store-id>` — Returns details of a single store. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -158,6 +165,7 @@
 		"tags": "# tags — tags\n\n## Commands\n\n### Read Operations\n\n- `cf tags resources list` — Lists all tagged resources for an account.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tenant": "# tenant — tenant\n\n## Commands\n\n### Read Operations\n\n- `cf tenant account list` — List of accounts for the Tenant.\n- `cf tenant account-type list` — List of account types available for the Tenant to provision accounts.\n- `cf tenant entitlement list` — List of innate entitlements available for the Tenant.\n- `cf tenant get <tenant-id>` — Retrieves a Tenant by Tenant ID.\n- `cf tenant membership list` — List of active members (Cloudflare users) for the Tenant.\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tenant-custom-nameservers": "# tenant-custom-nameservers — tenant-custom-nameservers\n\n## Commands\n\n### Read Operations\n\n- `cf tenant-custom-nameservers get <tenant-tag>` — Lists a tenant's custom nameservers.\n\n### Create Operations\n\n- `cf tenant-custom-nameservers create <tenant-tag>` — Adds a custom nameserver for a tenant. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf tenant-custom-nameservers delete <custom-ns-id>` — Deletes a tenant's custom nameserver. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"tools": "# tools — \n\n## Commands\n\n### Read Operations\n\n- `cf tools` — Output MCP tool definitions\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"total-queries": "# total-queries — total-queries\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tracked-domains": "# tracked-domains — tracked-domains\n\n## Commands\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"tunnel": "# tunnel — tunnel\n\n## Commands\n\n### Read Operations\n\n- `cf tunnel config get <tunnel-id>` — Retrieves the configuration for a remotely managed Cloudflare Tunnel.\n- `cf tunnel connections list` — Lists the connections for a Cloudflare Tunnel, including connector IDs, cloudflared versions, and Cloudflare locations.\n- `cf tunnel connectors get <connector-id>` — Retrieves a connector and its connection details for a Cloudflare Tunnel, including its cloudflared version, architecture, and connected Cloudflare locations.\n- `cf tunnel get <tunnel-id>` — Fetches a single Cloudflare Tunnel.\n- `cf tunnel list` — Lists and filters Cloudflare Tunnels in an account.\n- `cf tunnel token get <tunnel-id>` — Retrieves the token used to run cloudflared and associate it with a specific Cloudflare Tunnel. Treat the token as a secret.\n\n### Create Operations\n\n- `cf tunnel create` — Creates a remotely or locally managed Cloudflare Tunnel in an account. After creation, retrieve its token and run cloudflared to establish the connector connection. (supports --dry-run, --body)\n- `cf tunnel management token create <tunnel-id>` — Creates a short-lived management token for the requested Tunnel management resources, such as streaming logs. Treat the token as a secret. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf tunnel config update <tunnel-id>` — Replaces the configuration for a remotely managed Cloudflare Tunnel, including its ingress rules and origin request settings. (supports --dry-run, --body)\n- `cf tunnel edit <tunnel-id>` — Updates the name or secret of an existing Cloudflare Tunnel. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf tunnel delete <tunnel-id>` — Permanently deletes a Cloudflare Tunnel from an account. The tunnel must have no active connections. (supports --dry-run)\n\n### Other Operations\n\n- `cf tunnel connections cleanup <tunnel-id>` — Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -173,7 +181,7 @@
 		"waiting-rooms": "# waiting-rooms — Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages\n\n## Commands\n\n### Read Operations\n\n- `cf waiting-rooms account-waiting-rooms list` — Lists waiting rooms for account or zone.\n- `cf waiting-rooms events details get <event-id>` — Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.\n- `cf waiting-rooms events get <event-id>` — Fetches a single configured event for a waiting room.\n- `cf waiting-rooms events list` — Lists events for a waiting room.\n- `cf waiting-rooms get <waiting-room-id>` — Fetches a single configured waiting room.\n- `cf waiting-rooms rules get <waiting-room-id>` — Lists rules for a waiting room.\n- `cf waiting-rooms settings get` — Get zone-level Waiting Room settings.\n- `cf waiting-rooms statuses get <waiting-room-id>` — Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.\n\n### Create Operations\n\n- `cf waiting-rooms create` — Creates a new waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time. (supports --dry-run, --body)\n- `cf waiting-rooms rules create <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf waiting-rooms edit <waiting-room-id>` — Patches a configured waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events edit <event-id>` — Patches a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms events update <event-id>` — Updates a configured event for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules edit <rule-id>` — Patches a rule for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms rules update <waiting-room-id>` — Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room. (supports --dry-run, --body)\n- `cf waiting-rooms settings edit` — Patch zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms settings update` — Replace zone-level Waiting Room settings. (supports --dry-run, --body)\n- `cf waiting-rooms update <waiting-room-id>` — Updates a configured waiting room. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf waiting-rooms delete <waiting-room-id>` — Deletes a waiting room. (supports --dry-run)\n- `cf waiting-rooms events delete <event-id>` — Deletes an event for a waiting room. (supports --dry-run)\n- `cf waiting-rooms rules delete <rule-id>` — Deletes a rule for a waiting room. (supports --dry-run)\n\n### Other Operations\n\n- `cf waiting-rooms page preview` — Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \\\"Welcome\\\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"web-assets": "# web-assets — web-assets\n\n## Commands\n\n### Read Operations\n\n- `cf web-assets discovery get` — Returns the latest API operations discovered from zone traffic, rendered as OpenAPI schemas.\n- `cf web-assets discovery operations get <discovery-id>` — Returns a discovered web or API operation by discovery ID.\n- `cf web-assets discovery operations list` — Returns the latest web and API operations discovered from zone traffic.\n- `cf web-assets labels list` — Returns all managed and user-defined labels available for web and API operations in the zone.\n- `cf web-assets labels managed get <name>` — Returns a managed label and the web and API operations associated with it.\n- `cf web-assets labels user get <name>` — Returns a user-defined label and the web and API operations associated with it.\n- `cf web-assets operations get <operation-id>` — Returns a web or API operation, including its schema validation settings and requested feature data.\n- `cf web-assets operations list` — Lists web and API operations tracked for the zone, including each operation's method, path, and feature configuration.\n- `cf web-assets schemas list` — Returns tracked web and API operations and their feature configuration rendered as OpenAPI schemas.\n\n### Create Operations\n\n- `cf web-assets operations create` — Creates one web or API operation. The host, method, and path are normalized; an existing matching operation is returned instead of duplicated. (supports --dry-run, --body)\n- `cf web-assets operations labels create <operation-id>` — Attaches one or more labels to a web or API operation. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web-assets discovery operations edit <discovery-id>` — Updates the state of a discovered web or API operation. (supports --dry-run, --body)\n- `cf web-assets labels managed operations update <name>` — Replaces the complete set of web and API operations attached to the managed label. (supports --dry-run, --body)\n- `cf web-assets labels user edit <name>` — Updates only the supplied fields on a user-defined label. (supports --dry-run, --body)\n- `cf web-assets labels user operations update <name>` — Replaces the complete set of web and API operations attached to the user-defined label. (supports --dry-run, --body)\n- `cf web-assets labels user update <name>` — Replaces all editable fields on a user-defined label. (supports --dry-run, --body)\n- `cf web-assets operations labels update <operation-id>` — Replaces the complete label set on a web or API operation. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web-assets labels user delete <name>` — Deletes a user-defined label and removes its associations with web and API operations. (supports --dry-run)\n- `cf web-assets operations delete <operation-id>` — Deletes a web or API operation from endpoint management so its feature configuration is no longer tracked. (supports --dry-run)\n- `cf web-assets operations labels delete <operation-id>` — Removes one or more labels from a web or API operation. (supports --dry-run, --body)\n\n### Other Operations\n\n- `cf web-assets discovery operations bulk-edit` — Updates the state of one or more discovered web and API operations. (supports --dry-run, --body)\n- `cf web-assets labels user bulk-create` — Creates one or more user-defined labels for classifying web and API operations. (supports --dry-run, --body)\n- `cf web-assets labels user bulk-delete` — Deletes one or more user-defined labels and removes their associations with web and API operations. (supports --dry-run, --body)\n- `cf web-assets operations bulk-create` — Creates one or more web or API operations. Hosts, methods, and paths are normalized; an existing matching operation is returned instead of duplicated. (supports --dry-run, --body)\n- `cf web-assets operations bulk-delete` — Deletes multiple web or API operations from endpoint management in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-create` — Attaches labels to multiple web or API operations in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-delete` — Removes labels from multiple web or API operations in one request. (supports --dry-run, --body)\n- `cf web-assets operations labels bulk-update` — Replaces the complete label sets on multiple web or API operations in one request. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"web3": "# web3 — web3\n\n## Commands\n\n### Read Operations\n\n- `cf web3 hostnames get <identifier>` — Web3 Hostname Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries get <content-list-entry-identifier>` — IPFS Universal Path Gateway Content List Entry Details\n- `cf web3 hostnames ipfs-universal-paths content-lists entries list` — List IPFS Universal Path Gateway Content List Entries\n- `cf web3 hostnames ipfs-universal-paths content-lists get <identifier>` — IPFS Universal Path Gateway Content List Details\n- `cf web3 hostnames list` — List Web3 Hostnames\n\n### Create Operations\n\n- `cf web3 hostnames create` — Create Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries create <identifier>` — Create IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf web3 hostnames edit <identifier>` — Edit Web3 Hostname (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries update <content-list-entry-identifier>` — Edit IPFS Universal Path Gateway Content List Entry (supports --dry-run, --body)\n- `cf web3 hostnames ipfs-universal-paths content-lists update <identifier>` — Update IPFS Universal Path Gateway Content List (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf web3 hostnames delete <identifier>` — Delete Web3 Hostname (supports --dry-run)\n- `cf web3 hostnames ipfs-universal-paths content-lists entries delete <content-list-entry-identifier>` — Delete IPFS Universal Path Gateway Content List Entry (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
-		"workers": "# workers — workers\n\n## Commands\n\n### Read Operations\n\n- `cf workers account-settings get` — Fetches Worker account settings for an account.\n- `cf workers beta workers get <worker-id>` — Get details about a specific Worker.\n- `cf workers beta workers list` — List all Workers for an account.\n- `cf workers beta workers versions get <version-id>` — Get details about a specific version.\n- `cf workers beta workers versions list` — List all versions for a Worker.\n- `cf workers deployments get <deployment-id>` — Get information about a Worker Deployment.\n- `cf workers deployments list` — List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.\n- `cf workers domains get <domain-id>` — Gets information about a domain.\n- `cf workers domains list` — Lists all domains for an account.\n- `cf workers placement regions list` — Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.\n- `cf workers routes get <route-id>` — Returns information about a route, including URL pattern and Worker.\n- `cf workers routes list` — Returns routes for a zone.\n- `cf workers scripts content get` — Fetch script content only.\n- `cf workers scripts get` — Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.\n- `cf workers scripts list` — Fetch a list of uploaded workers.\n- `cf workers scripts schedules get` — Fetches Cron Triggers for a Worker.\n- `cf workers scripts script-and-version-settings get` — Get metadata and config, such as bindings or usage model.\n- `cf workers scripts settings get` — Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.\n- `cf workers scripts subdomain get` — Get if the Worker is available on the workers.dev subdomain.\n- `cf workers scripts tail get` — Get list of tails currently deployed on a Worker.\n- `cf workers scripts usage-model get` — Fetches the Usage Model for a given Worker.\n- `cf workers secrets get <secret-name>` — Get a given secret binding (value omitted) on a script.\n- `cf workers secrets list` — List secrets bound to a script.\n- `cf workers services environments content get <environment-name>` — Get script content from a worker with an environment.\n- `cf workers services environments settings get <environment-name>` — Get script settings from a worker with an environment.\n- `cf workers subdomains get` — Returns a Workers subdomain for an account.\n- `cf workers versions get <version-id>` — Retrieves detailed information about a specific version of a Workers script.\n- `cf workers versions list` — List of Worker Versions. The first version in the list is the latest version.\n\n### Create Operations\n\n- `cf workers assets upload create` — Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers beta workers create` — Create a new Worker. (supports --dry-run, --body)\n- `cf workers beta workers versions create <worker-id>` — Create a new version. (supports --dry-run, --body)\n- `cf workers deployments create` — Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker. (supports --dry-run, --body)\n- `cf workers routes create` — Creates a route that maps a URL pattern to a Worker. (supports --dry-run, --body)\n- `cf workers scripts assets upload create` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers scripts subdomain create` — Enable or disable the Worker on the workers.dev subdomain. (supports --dry-run, --body)\n- `cf workers scripts tail create` — Starts a tail that receives logs and exception from a Worker. (supports --dry-run)\n- `cf workers versions create` — Upload a Worker Version without deploying to Cloudflare's network. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers account-settings update` — Creates Worker account settings for an account. (supports --dry-run, --body)\n- `cf workers beta workers edit <worker-id>` — Perform a partial update on a Worker, where omitted properties are left unchanged from their current values. (supports --dry-run, --body)\n- `cf workers beta workers update <worker-id>` — Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint. (supports --dry-run, --body)\n- `cf workers beta workers versions edit <worker-id>` — Only `/versions/latest` is supported. Creates a new version by applying a JSON Merge Patch (RFC 7396) to the latest version. Patching a specific version ID is not supported. Omitted fields are inherited from the latest version. (supports --dry-run, --body)\n- `cf workers domains update` — Attaches a domain that routes traffic to a Worker. (supports --dry-run, --body)\n- `cf workers routes update <route-id>` — Updates the URL pattern or Worker associated with a route. (supports --dry-run, --body)\n- `cf workers scripts content update` — Put script content without touching config or metadata. (supports --dry-run, --body)\n- `cf workers scripts schedules update` — Updates Cron Triggers for a Worker. (supports --dry-run, --body)\n- `cf workers scripts script-and-version-settings edit` — Patch metadata or config, such as bindings or usage model. (supports --dry-run, --body)\n- `cf workers scripts settings edit` — Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers. (supports --dry-run, --body)\n- `cf workers scripts update` — Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers scripts usage-model update` — Updates the Usage Model for a given Worker. Requires a Workers Paid subscription. (supports --dry-run, --body)\n- `cf workers secrets update <name>` — Add a secret to a script. (supports --dry-run, --body)\n- `cf workers services environments content update <environment-name>` — Put script content from a worker with an environment. (supports --dry-run, --body)\n- `cf workers services environments settings edit <environment-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf workers subdomains update` — Creates a Workers subdomain for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers beta workers delete <worker-id>` — Delete a Worker and all its associated resources (versions, deployments, etc.). (supports --dry-run)\n- `cf workers beta workers versions delete <version-id>` — Delete a version. (supports --dry-run)\n- `cf workers deployments delete <deployment-id>` — Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted. (supports --dry-run)\n- `cf workers domains delete <domain-id>` — Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain. (supports --dry-run)\n- `cf workers routes delete <route-id>` — Deletes a route. (supports --dry-run)\n- `cf workers scripts delete` — Delete your worker. This call has no response body on a successful delete. (supports --dry-run)\n- `cf workers scripts subdomain delete` — Disable all workers.dev subdomains for a Worker. (supports --dry-run)\n- `cf workers scripts tail delete <id>` — Deletes a tail from a Worker. (supports --dry-run)\n- `cf workers secrets delete <secret-name>` — Remove a secret from a script. (supports --dry-run)\n- `cf workers subdomains delete` — Deletes a Workers subdomain for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers scripts search` — Search for Workers in an account. (supports --dry-run)\n- `cf workers secrets bulk-edit` — Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
+		"workers": "# workers — workers\n\n## Commands\n\n### Read Operations\n\n- `cf workers account-settings get` — Fetches Worker account settings for an account.\n- `cf workers beta workers get <worker-id>` — Get details about a specific Worker.\n- `cf workers beta workers list` — List all Workers for an account.\n- `cf workers beta workers versions get <version-id>` — Get details about a specific version.\n- `cf workers beta workers versions list` — List all versions for a Worker.\n- `cf workers deployments get <deployment-id>` — Get information about a Worker Deployment.\n- `cf workers deployments list` — List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.\n- `cf workers domains get <domain-id>` — Gets information about a domain.\n- `cf workers domains list` — Lists all domains for an account.\n- `cf workers placement regions list` — Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.\n- `cf workers routes get <route-id>` — Returns information about a route, including URL pattern and Worker.\n- `cf workers routes list` — Returns routes for a zone.\n- `cf workers scripts content get` — Fetch script content only.\n- `cf workers scripts get` — Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.\n- `cf workers scripts list` — Fetch a list of uploaded workers.\n- `cf workers scripts schedules get` — Fetches Cron Triggers for a Worker.\n- `cf workers scripts script-and-version-settings get` — Get metadata and config, such as bindings or usage model.\n- `cf workers scripts settings get` — Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.\n- `cf workers scripts subdomain get` — Get if the Worker is available on the workers.dev subdomain.\n- `cf workers scripts tail get` — Get list of tails currently deployed on a Worker.\n- `cf workers scripts usage-model get` — Fetches the Usage Model for a given Worker.\n- `cf workers secrets get <secret-name>` — Get a given secret binding (value omitted) on a script.\n- `cf workers secrets list` — List secrets bound to a script.\n- `cf workers services environments content get <environment-name>` — Get script content from a worker with an environment.\n- `cf workers services environments settings get <environment-name>` — Get script settings from a worker with an environment.\n- `cf workers subdomains get` — Returns a Workers subdomain for an account.\n- `cf workers versions get <version-id>` — Retrieves detailed information about a specific version of a Workers script.\n- `cf workers versions list` — List of Worker Versions. The first version in the list is the latest version.\n\n### Create Operations\n\n- `cf workers assets upload create` — Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers beta workers create` — Create a new Worker. (supports --dry-run, --body)\n- `cf workers beta workers versions create <worker-id>` — Create a new version. (supports --dry-run, --body)\n- `cf workers deployments create` — Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker. (supports --dry-run, --body)\n- `cf workers routes create` — Creates a route that maps a URL pattern to a Worker. (supports --dry-run, --body)\n- `cf workers scripts assets upload create` — Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/. (supports --dry-run, --body)\n- `cf workers scripts subdomain create` — Enable or disable the Worker on the workers.dev subdomain. (supports --dry-run, --body)\n- `cf workers scripts tail create` — Starts a tail that receives logs and exception from a Worker. (supports --dry-run)\n- `cf workers versions create` — Upload a new Worker Version without deploying it (supports --dry-run)\n\n### Update Operations\n\n- `cf workers account-settings update` — Creates Worker account settings for an account. (supports --dry-run, --body)\n- `cf workers beta workers edit <worker-id>` — Perform a partial update on a Worker, where omitted properties are left unchanged from their current values. (supports --dry-run, --body)\n- `cf workers beta workers update <worker-id>` — Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint. (supports --dry-run, --body)\n- `cf workers beta workers versions edit <worker-id>` — Only `/versions/latest` is supported. Creates a new version by applying a JSON Merge Patch (RFC 7396) to the latest version. Patching a specific version ID is not supported. Omitted fields are inherited from the latest version. (supports --dry-run, --body)\n- `cf workers domains update` — Attaches a domain that routes traffic to a Worker. (supports --dry-run, --body)\n- `cf workers routes update <route-id>` — Updates the URL pattern or Worker associated with a route. (supports --dry-run, --body)\n- `cf workers scripts content update` — Put script content without touching config or metadata. (supports --dry-run, --body)\n- `cf workers scripts schedules update` — Updates Cron Triggers for a Worker. (supports --dry-run, --body)\n- `cf workers scripts script-and-version-settings edit` — Patch metadata or config, such as bindings or usage model. (supports --dry-run, --body)\n- `cf workers scripts settings edit` — Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers. (supports --dry-run, --body)\n- `cf workers scripts update` — Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/. (supports --dry-run, --body)\n- `cf workers scripts usage-model update` — Updates the Usage Model for a given Worker. Requires a Workers Paid subscription. (supports --dry-run, --body)\n- `cf workers secrets update <name>` — Add a secret to a script. (supports --dry-run, --body)\n- `cf workers services environments content update <environment-name>` — Put script content from a worker with an environment. (supports --dry-run, --body)\n- `cf workers services environments settings edit <environment-name>` — Patch script metadata, such as bindings. (supports --dry-run, --body)\n- `cf workers subdomains update` — Creates a Workers subdomain for an account. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers beta workers delete <worker-id>` — Delete a Worker and all its associated resources (versions, deployments, etc.). (supports --dry-run)\n- `cf workers beta workers versions delete <version-id>` — Delete a version. (supports --dry-run)\n- `cf workers deployments delete <deployment-id>` — Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted. (supports --dry-run)\n- `cf workers domains delete <domain-id>` — Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain. (supports --dry-run)\n- `cf workers routes delete <route-id>` — Deletes a route. (supports --dry-run)\n- `cf workers scripts delete` — Delete your worker. This call has no response body on a successful delete. (supports --dry-run)\n- `cf workers scripts subdomain delete` — Disable all workers.dev subdomains for a Worker. (supports --dry-run)\n- `cf workers scripts tail delete <id>` — Deletes a tail from a Worker. (supports --dry-run)\n- `cf workers secrets delete <secret-name>` — Remove a secret from a script. (supports --dry-run)\n- `cf workers subdomains delete` — Deletes a Workers subdomain for an account. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers check` — Profile a Worker's startup performance locally using Build Output Specification files.\n- `cf workers scripts search` — Search for Workers in an account. (supports --dry-run)\n- `cf workers secrets bulk-edit` — Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged. (supports --dry-run, --body)\n- `cf workers triggers deploy` — Apply triggers (Routes, Workflows, Cron triggers etc.) (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"workers-builds": "# workers-builds — Automated build and deployment pipeline for Workers — track builds, logs, and repo connections\n\n## Commands\n\n### Read Operations\n\n- `cf workers-builds builds get <build-uuid>` — Retrieve detailed information about a specific build\n- `cf workers-builds builds list` — Get all builds for a specific worker script with pagination\n- `cf workers-builds builds logs get <build-uuid>` — Retrieve logs for a specific build with cursor-based pagination\n- `cf workers-builds deploy-hooks get <deploy-hook-uuid>` — Get details of a specific deploy hook.\n- `cf workers-builds deploy-hooks list` — Get all deploy hooks for a specific worker script.\n- `cf workers-builds repos config-autofill get <repo-id>` — Analyze repository for automatic configuration detection\n- `cf workers-builds tokens list` — Get all build tokens with pagination\n- `cf workers-builds triggers environment-variables list` — Get all environment variables for a trigger\n- `cf workers-builds triggers list` — Get all triggers for a specific worker script\n- `cf workers-builds workers get <script-tag>` — Retrieve the build configuration for a specific Worker script, including git repository details and production settings.\n\n### Create Operations\n\n- `cf workers-builds deploy-hooks create <script-name>` — Create a new deploy hook for a worker script. (supports --dry-run, --body)\n- `cf workers-builds tokens create` — Create a new build authentication token (supports --dry-run, --body)\n- `cf workers-builds triggers create` — Create a new CI/CD trigger (supports --dry-run, --body)\n- `cf workers-builds workers create` — Create a new build configuration for a Worker script, linking it to a git repository with CI/CD triggers. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workers-builds deploy-hooks update <deploy-hook-uuid>` — Update an existing deploy hook. (supports --dry-run, --body)\n- `cf workers-builds triggers update <trigger-uuid>` — Update an existing CI/CD trigger (supports --dry-run, --body)\n- `cf workers-builds workers edit <script-tag>` — Update the build configuration for a Worker script. Supports partial updates to git repository settings and production build settings. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workers-builds deploy-hooks delete <deploy-hook-uuid>` — Delete a deploy hook. (supports --dry-run)\n- `cf workers-builds repos connections delete <repo-connection-uuid>` — Remove a repository connection (supports --dry-run)\n- `cf workers-builds tokens delete <build-token-uuid>` — Remove a build authentication token (supports --dry-run)\n- `cf workers-builds triggers delete <trigger-uuid>` — Remove a CI/CD trigger (supports --dry-run)\n- `cf workers-builds triggers environment-variables delete <environment-variable-key>` — Remove a specific environment variable from a trigger (supports --dry-run)\n- `cf workers-builds workers delete <script-tag>` — Delete the build configuration for a Worker script. (supports --dry-run)\n\n### Other Operations\n\n- `cf workers-builds builds cancel <build-uuid>` — Cancel a running or queued build (supports --dry-run)\n- `cf workers-builds deploy-hooks trigger <deploy-hook-uuid>` — Trigger a build using a deploy hook. This endpoint does not require authentication - the deploy_hook_uuid acts as a secret token. (supports --dry-run)\n- `cf workers-builds get-account-limits` — Retrieve account limits and usage information (supports --dry-run)\n- `cf workers-builds get-builds-by-version` — Retrieve builds for specific version IDs (supports --dry-run)\n- `cf workers-builds get-latest-builds` — Retrieve the most recent builds for multiple worker scripts (supports --dry-run)\n- `cf workers-builds repos connections upsert` — Upsert a repository connection for CI/CD integration (supports --dry-run, --body)\n- `cf workers-builds triggers create-build <trigger-uuid>` — Trigger a manual build for a specific trigger (supports --dry-run, --body)\n- `cf workers-builds triggers environment-variables upsert <trigger-uuid>` — Create or update environment variables for a trigger (supports --dry-run, --body)\n- `cf workers-builds triggers purge-cache <trigger-uuid>` — Clear the build cache for a specific trigger (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"workflows": "# workflows — Durable, multi-step workflows that run on Workers with automatic retries and state persistence\n\n## Commands\n\n### Read Operations\n\n- `cf workflows get <workflow-name>` — Retrieves configuration and metadata for a specific workflow.\n- `cf workflows instances get <instance-id>` — Retrieves logs and execution status for a specific workflow instance.\n- `cf workflows instances list` — Lists all instances of a workflow with their execution status.\n- `cf workflows instances step get <instance-id>` — Retrieves the full, untruncated output for a specific step on a workflow instance. Returns a flat status-shaped JSON body with step `status` ('running' | 'waiting' | 'complete' | 'errored'), `error` (nullable), and `output` (the step value, or null while running/waiting/errored). When the step returned a ReadableStream from step.do, the response is served as 'application/octet-stream' with the raw bytes as the body instead of JSON. A `status='running'` response with non-null `error` indicates the step is currently retrying after a prior attempt failed.\n- `cf workflows list` — Lists all workflows configured for the account.\n- `cf workflows settings get` — Retrieves account-level Workflows settings, such as the default instance retention.\n- `cf workflows versions get <version-id>` — Retrieves details for a specific deployed workflow version.\n- `cf workflows versions list` — Lists all deployed versions of a workflow.\n\n### Create Operations\n\n- `cf workflows instances batch create <workflow-name>` — Creates multiple workflow instances in a single batch operation. (supports --dry-run, --body)\n- `cf workflows instances create <workflow-name>` — Creates a new instance of a workflow, starting its execution. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf workflows settings edit` — Updates only the account-level Workflows settings fields present in the request body. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf workflows delete <workflow-name>` — Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it. (supports --dry-run)\n- `cf workflows instances delete <instance-id>` — Deletes a workflow instance and its stored state. (supports --dry-run)\n\n### Other Operations\n\n- `cf workflows instances events send <event-type>` — Sends an event to a running workflow instance to trigger state transitions. (supports --dry-run)\n- `cf workflows instances pause <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances restart <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances resume <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows instances terminate <instance-id>` — Changes the execution status of a workflow instance (e.g., pause, resume, terminate). (supports --dry-run, --body)\n- `cf workflows versions graph <version-id>` — Retrieves the graph visualization of a workflow version. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zaraz": "# zaraz — Server-side tag manager — load third-party tools (analytics, pixels, etc.) from Cloudflare's edge without client-side JS\n\n## Commands\n\n### Read Operations\n\n- `cf zaraz config get` — Gets latest Zaraz configuration for a zone. It can be preview or published configuration, whichever was the last updated. Secret variables values will not be included.\n- `cf zaraz default get` — Gets default Zaraz configuration for a zone.\n- `cf zaraz export get` — Exports full current published Zaraz configuration for a zone, secret variables included.\n- `cf zaraz history configs get` — Gets a history of published Zaraz configurations by ID(s) for a zone.\n- `cf zaraz history list` — Lists a history of published Zaraz configuration records for a zone.\n- `cf zaraz workflow get` — Gets Zaraz workflow for a zone.\n\n### Create Operations\n\n- `cf zaraz publish create` — Publish current Zaraz preview configuration for a zone. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zaraz config update` — Updates Zaraz configuration for a zone. (supports --dry-run, --body)\n- `cf zaraz history update` — Restores a historical published Zaraz configuration by ID for a zone. (supports --dry-run, --body)\n- `cf zaraz workflow update` — Updates Zaraz workflow for a zone. (supports --dry-run, --body)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
@@ -181,5 +189,5 @@
 		"zone": "# zone — zone\n\n## Commands\n\n### Other Operations\n\n- `cf zone activate` — Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n",
 		"zones": "# zones — Zones are domains on Cloudflare — list, create, and configure domain settings\n\n## Commands\n\n### Read Operations\n\n- `cf zones aegis get` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.\n- `cf zones fonts get` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.\n- `cf zones get` — Retrieves detailed information about a specific zone identified by its zone ID. Returns zone configuration, status, nameservers, and associated metadata.\n- `cf zones holds get` — Retrieve whether the zone is subject to a zone hold, and metadata about the hold.\n- `cf zones list` — Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.\n- `cf zones origin-h2-max-streams get` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.\n- `cf zones origin-max-http-version get` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\".\n- `cf zones plans get <plan-identifier>` — Details of the available plan that the zone can subscribe to.\n- `cf zones plans list` — Lists available plans the zone can subscribe to.\n- `cf zones rate-plans get` — Lists all rate plans the zone can subscribe to.\n- `cf zones rum get` — Retrieves RUM status for a zone.\n- `cf zones settings get <setting-id>` — Fetch a single zone setting by name\n- `cf zones speed-brain get` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.\n- `cf zones subscriptions get` — Lists zone subscription details.\n\n### Create Operations\n\n- `cf zones create` — Creates a new zone (domain) in your Cloudflare account. The zone is created in a pending state and must be activated by updating your domain's nameservers to point to Cloudflare, or by completing the verification process for partial (CNAME) setups. (supports --dry-run, --body)\n- `cf zones holds create` — Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. Zone holds cannot be enabled on CDN-only zones. (supports --dry-run)\n- `cf zones subscriptions create` — Create a zone subscription, either plan or add-ons. (supports --dry-run, --body)\n\n### Update Operations\n\n- `cf zones aegis edit` — Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses. (supports --dry-run, --body)\n- `cf zones edit` — Edits a zone. Only one zone property can be changed at a time. (supports --dry-run, --body)\n- `cf zones fonts edit` — Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information. (supports --dry-run, --body)\n- `cf zones holds edit` — Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. Existing zone holds can be removed from CDN-only zones by setting `hold_after` to `null`. Other zone hold updates cannot be made on CDN-only zones. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run, --body)\n- `cf zones origin-h2-max-streams edit` — Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled. (supports --dry-run, --body)\n- `cf zones origin-max-http-version edit` — Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is \"2\" for all plan types except Enterprise where it is \"1\". (supports --dry-run, --body)\n- `cf zones rum edit` — Toggles RUM on/off for an existing zone. (supports --dry-run, --body)\n- `cf zones settings edit <setting-id>` — Updates a single zone setting by the identifier (supports --dry-run, --body)\n- `cf zones speed-brain edit` — Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information. (supports --dry-run, --body)\n- `cf zones subscriptions update` — Updates zone subscriptions, either plan or add-ons. (supports --dry-run, --body)\n\n### Delete Operations\n\n- `cf zones delete` — Deletes an existing zone. (supports --dry-run)\n- `cf zones holds delete` — Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. Existing zone holds can be removed from CDN-only zones when `hold_after` is not provided. Active holds are automatically disabled when a zone transitions to CDN-only mode. (supports --dry-run)\n- `cf zones subscriptions delete` — Deletes a zone's subscription. (supports --dry-run)\n\n## Safety Guidelines\n\n- Always use `--dry-run` before destructive operations (delete, update)\n"
 	},
-	"universal": "# cf CLI Agent Guide\n\n## Authentication\n- Preferred: Set CLOUDFLARE_API_TOKEN environment variable\n- Alternative: `cf auth login` for OAuth flow\n- Verify: `cf auth whoami`\n\n## Output\n- All output is JSON; pipe through `jq` for transforms\n\n## Safety\n- Always use `--dry-run` before create/update/delete operations\n- Use `--body '{...}'` for complex request payloads\n- Verify zone resolution with `--quiet` disabled\n\n## Context Resolution\n\nAccount ID priority (highest to lowest):\n1. `CLOUDFLARE_ACCOUNT_ID` environment variable\n2. The named `settings` export in `cloudflare.config.ts`\n3. Cached or interactive account selection\n\nZone priority (highest to lowest):\n1. `--zone` / `-z` flag\n2. `CLOUDFLARE_ZONE_ID` environment variable\n\n## Introspection\n- `cf schema --list` — list all available API schemas\n- `cf schema dns records create` — get full request/response schema for a command\n- `cf agent-context [product]` — load agent skill files\n- `cf tools` — get MCP tool definitions\n\n## Error Handling\n- Non-zero exit codes indicate errors\n- Error details are in stderr\n- Check `cf auth whoami` if you get 401 errors\n"
+	"universal": "# cf CLI Agent Guide\n\n## Authentication\n- Preferred: Set CLOUDFLARE_API_TOKEN environment variable\n- Alternative: `cf auth login` for OAuth flow\n- Verify: `cf auth whoami`\n\n## Output\n- All output is JSON; pipe through `jq` for transforms\n\n## Safety\n- Always use `--dry-run` before create/update/delete operations\n- Use `--body '{...}'` for complex request payloads\n- Verify zone resolution with `--quiet` disabled\n\n## Context Resolution\n\nAccount ID priority (highest to lowest):\n1. `CLOUDFLARE_ACCOUNT_ID` environment variable\n2. The account settings in `cloudflare.config.ts`'s default export\n3. Cached or interactive account selection\n\nZone priority (highest to lowest):\n1. `--zone` / `-z` flag\n2. `CLOUDFLARE_ZONE_ID` environment variable\n\n## Introspection\n- `cf schema --list` — list all available API schemas\n- `cf schema dns records create` — get full request/response schema for a command\n- `cf agent-context [product]` — load agent skill files\n- `cf agent-context auth` — load auth command guidance\n- `cf tools` — get MCP tool definitions\n\n## Error Handling\n- Non-zero exit codes indicate errors\n- Error details are in stderr\n- Check `cf auth whoami` if you get 401 errors\n"
 }