From c2890575345a91166d6b01d113e57341f704e190 Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Tue, 27 Oct 2026 19:03:15 +0000
Subject: [PATCH 1/4] refactor(forge): plan calls with forge's plain-data
 requests

Forge's MCP target now generates tools, not a server (cloudflare/forge#71):
the runtime is _/tool.ts alone, and buildRequest returns the request as
plain data. planCall spreads it into the plan instead of reading a Request
back apart, and imports buildRequest and InvalidArguments directly rather
than taking them as arguments.
---
 AGENTS.md                           |   4 +-
 forge.json                          |   4 +-
 src/forge-tools/plan.ts             |  39 +++----
 src/forge-tools/worker.ts           |  19 +---
 src/generated/forge-mcp/README.md   |   2 +-
 src/generated/forge-mcp/_/index.ts  |  20 ----
 src/generated/forge-mcp/_/server.ts | 156 ----------------------------
 src/generated/forge-mcp/_/tool.ts   |  25 ++++-
 tests/forge-tools-plan.test.ts      |  10 +-
 9 files changed, 47 insertions(+), 232 deletions(-)
 delete mode 100644 src/generated/forge-mcp/_/index.ts
 delete mode 100644 src/generated/forge-mcp/_/server.ts

diff --git a/AGENTS.md b/AGENTS.md
index 0d3fd620..e4f95c12 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -189,8 +189,8 @@ The consent page offers minimal, read-only and full-access templates. Minimal is
 `?codemode=false` asks for direct tools; `?experimentalForge=true` changes how they are built: from code forge generates instead of `mcp-tools.json`. The flag is opt-in while the forge tools soak, and is meant to become how `?codemode=false` works. Code Mode ignores it, since it already reads the Forge spec. The earlier `?forge=true` preview param is gone; it now serves Code Mode.
 
 
-- `src/generated/forge-mcp/` is TypeScript that `forge openapi.forge.json --target mcp` writes, committed and never edited by hand. Each group's `tools.ts` has its tools: schema, hints, the method's extensions, and a `request(args)` function that builds the API request. Each tool also has `responses`: the JSON Schema of every response body the method declares, by status, from the shared `outputs.ts` models; `tools/list` never sends them (see Response schema checks). Each tool with a JSON body on every 2xx response also has `outputSchema`, that body's schema (or `anyOf` the distinct ones) with the models it reaches in `$defs`; `listTools` sends it only when asked (see the output schema bullet below). `schemas.ts` files hold the shared argument models, `source.json` the `openapi.forge.json` release they came from (written by `generate-tools.ts`), `index.ts` exports every tool, `README.md` lists the methods without a tool and why, and `_/` is forge's runtime for serving them on an `McpServer`. oxfmt and oxlint skip it
-- The MCP target lives on the long-lived `forge-mcp` branch of `cloudflare/forge`, kept rebased on its main; `forge.json` pins the commit. `FORGE_BINARY=… npm run generate:tools` regenerates locally. `.github/workflows/forge-tools.yml` builds that forge, regenerates from the latest `openapi.forge.json` every six hours, runs the type check and tests, and opens or updates the `bot/forge-tools` pull request when the code changes. The pull request is opened with `GITHUB_TOKEN`, so CI doesn't run on it; the workflow's own type check and tests are the check. Merging it deploys both Workers through Workers Builds. To change the generator, bump `forge.json`'s `ref`
+- `src/generated/forge-mcp/` is TypeScript that `forge openapi.forge.json --target mcp` writes, committed and never edited by hand. Each group's `tools.ts` has its tools: schema, hints, the method's extensions, and a `request(args)` function that builds the API request. Each tool also has `responses`: the JSON Schema of every response body the method declares, by status, from the shared `outputs.ts` models; `tools/list` never sends them (see Response schema checks). Each tool with a JSON body on every 2xx response also has `outputSchema`, that body's schema (or `anyOf` the distinct ones) with the models it reaches in `$defs`; `listTools` sends it only when asked (see the output schema bullet below). `schemas.ts` files hold the shared argument models, `source.json` the `openapi.forge.json` release they came from (written by `generate-tools.ts`), `index.ts` exports every tool, `README.md` lists the methods without a tool and why, and `_/tool.ts` is forge's runtime: `listTools`, `toolsByName`, and `buildRequest`, which returns a call's request as plain data (`{ method, url, headers, body? }`) that `plan()` hands over RPC as it is. Forge generates no server. oxfmt and oxlint skip it
+- The MCP target is proposed for `cloudflare/forge`'s main in cloudflare/forge#71; until it merges, `forge.json` pins a commit of that PR's `mcp` branch. `FORGE_BINARY=… npm run generate:tools` regenerates locally. `.github/workflows/forge-tools.yml` builds that forge, regenerates from the latest `openapi.forge.json` every six hours, runs the type check and tests, and opens or updates the `bot/forge-tools` pull request when the code changes. The pull request is opened with `GITHUB_TOKEN`, so CI doesn't run on it; the workflow's own type check and tests are the check. Merging it deploys both Workers through Workers Builds. To change the generator, bump `forge.json`'s `ref`
 - The generated tools run in their own Worker, the **forge tools service** (`src/forge-tools/worker.ts`, `wrangler.forge-tools.jsonc`, `cloudflare-api-mcp-forge-tools[-staging|-dev]`), which the main Worker reaches through its `FORGE_TOOLS` service binding. Code Mode isolates never compile the ~10 MB of generated code: workerd compiles every module a Worker uploads at startup, so in the main Worker a lazy import still cost ~27 ms per isolate, and a separate uploaded module didn't help. The service holds no credentials, makes no requests, and has no route. Its RPC methods are `listJson({ outputSchema })`, the tools as `tools/list` sends them as one JSON string, with or without their output schemas, which the main Worker parses once per isolate (`getForgeToolList()` in `src/isolate-cache.ts`; decoding ~3,000 nested objects over RPC cost ~200–300 ms of CPU per `tools/list`), `plan(name, args, { baseUrl, sessionAccountId })`, the request a call makes (`src/forge-tools/plan.ts`), and `checkResponse(...)`, which checks a trimmed response against the generated response schemas.
 - `src/forge-tools/cloudflare.ts` applies the Cloudflare policy once per service isolate: `account_id` is optional with one description, and so is a merged tool's `account_or_zone_id` (the document gives `account_or_zone` its values). Permissions come from each tool's `x-api-token-group` extension, which clients never see
 - `src/tools/forge-tools.ts`, in the main Worker, serves `?codemode=false&experimentalForge=true`: `docs` and `whoami` itself, and the generated tools from the service. It sends each planned request with the session's token, which never leaves the main Worker, and explains refused calls and steps up OAuth scopes like the other direct tools
diff --git a/forge.json b/forge.json
index 8ce4413f..0798209d 100644
--- a/forge.json
+++ b/forge.json
@@ -1,5 +1,5 @@
 {
-  "$comment": "The forge that generates src/generated/forge-mcp: a commit of the forge-mcp branch. Bump ref to pick up generator changes; CI builds it.",
+  "$comment": "The forge that generates src/generated/forge-mcp: a commit of cloudflare/forge. Bump ref to pick up generator changes; CI builds it.",
   "repository": "cloudflare/forge",
-  "ref": "ce4183c985f34c384d83718b5d502ac3517f6920"
+  "ref": "dc86ee0992faf9b83d0bfa7b49bf2c4a1595f87a"
 }
diff --git a/src/forge-tools/plan.ts b/src/forge-tools/plan.ts
index e71818f7..f90b29e1 100644
--- a/src/forge-tools/plan.ts
+++ b/src/forge-tools/plan.ts
@@ -1,4 +1,10 @@
-import type { Args, Tool } from '../generated/forge-mcp'
+import {
+  buildRequest,
+  InvalidArguments,
+  type Args,
+  type HttpRequest,
+  type Tool
+} from '../generated/forge-mcp/_/tool'
 import { permissionsOf } from './cloudflare'
 
 const ACCOUNT_OR_ZONE_PREFIX = '/{account_or_zone}/{account_or_zone_id}'
@@ -21,32 +27,23 @@ export type CallPlan =
   | { readonly kind: 'invalid'; readonly message: string }
   /** The tool takes an account, the caller left it out, and the session has more than one. */
   | { readonly kind: 'needs_account' }
-  | {
+  | (HttpRequest & {
       readonly kind: 'request'
-      readonly method: string
-      readonly url: string
-      readonly headers: Readonly<Record<string, string>>
-      readonly body?: string
       /** The tool's path template, such as `/accounts/{account_id}/d1/database`. */
       readonly template: string
       /** The API token permissions the method accepts. */
       readonly permissions?: readonly string[]
       /** The account the request names, if any, for explaining a refusal. */
       readonly accountId?: string
-    }
+    })
 
 /**
  * Plans calling `tool` with `given`: fills in the session's account where the
  * tool takes one and the caller left it out, then builds the request with the
- * tool's generated code.
+ * tool's generated code. The request is plain data, so the plan crosses RPC
+ * as it is.
  */
-export async function planCall(
-  tool: Tool,
-  given: Args,
-  options: PlanOptions,
-  build: (tool: Tool, args: Args, baseUrl: string) => Request,
-  isInvalidArguments: (error: unknown) => boolean
-): Promise<CallPlan> {
+export function planCall(tool: Tool, given: Args, options: PlanOptions): CallPlan {
   const key = accountKey(tool, given)
   let args = given
   if (key && given[key] === undefined) {
@@ -54,22 +51,18 @@ export async function planCall(
     args = { ...given, [key]: options.sessionAccountId }
   }
 
-  let request: Request
+  let request: HttpRequest
   try {
-    request = build(tool, args, options.baseUrl)
+    request = buildRequest(tool, args, options.baseUrl)
   } catch (error) {
-    if (isInvalidArguments(error)) return { kind: 'invalid', message: (error as Error).message }
+    if (error instanceof InvalidArguments) return { kind: 'invalid', message: error.message }
     throw error
   }
-  const body = request.body ? await request.text() : undefined
   const permissions = permissionsOf(tool)
   const accountId = accountIdOf(args)
   return {
     kind: 'request',
-    method: request.method,
-    url: request.url,
-    headers: Object.fromEntries(request.headers),
-    ...(body !== undefined && { body }),
+    ...request,
     template: tool.path,
     ...(permissions && { permissions }),
     ...(accountId && { accountId })
diff --git a/src/forge-tools/worker.ts b/src/forge-tools/worker.ts
index 99b0da21..3a0c60d1 100644
--- a/src/forge-tools/worker.ts
+++ b/src/forge-tools/worker.ts
@@ -10,14 +10,7 @@
  * the main Worker reaches it through its `FORGE_TOOLS` service binding.
  */
 import { WorkerEntrypoint } from 'cloudflare:workers'
-import {
-  buildRequest,
-  InvalidArguments,
-  listTools,
-  tools as generatedTools,
-  toolsByName,
-  type Args
-} from '../generated/forge-mcp'
+import { listTools, tools as generatedTools, toolsByName, type Args } from '../generated/forge-mcp'
 import { cloudflareTool } from './cloudflare'
 import { planCall, type CallPlan, type PlanOptions } from './plan'
 import {
@@ -135,16 +128,10 @@ export default class ForgeTools extends WorkerEntrypoint {
    * The request calling the tool `name` with `args` makes, or why it can't be
    * made, and what of a successful response its output schema describes.
    */
-  async plan(name: string, args: Args, options: PlanOptions): Promise<ToolCallPlan> {
+  plan(name: string, args: Args, options: PlanOptions): ToolCallPlan {
     const tool = toolsByName(tools).get(name)
     if (!tool) return { kind: 'unknown' }
-    const plan = await planCall(
-      tool,
-      args,
-      options,
-      buildRequest,
-      (error) => error instanceof InvalidArguments
-    )
+    const plan = planCall(tool, args, options)
     return plan.kind === 'request' && tool.outputSchema
       ? { ...plan, payload: payloadKind(tool) }
       : plan
diff --git a/src/generated/forge-mcp/README.md b/src/generated/forge-mcp/README.md
index cf9b4378..3cf2a360 100644
--- a/src/generated/forge-mcp/README.md
+++ b/src/generated/forge-mcp/README.md
@@ -2,7 +2,7 @@
 
 # MCP tools
 
-3033 tools in 1033 groups. `index.ts` exports them as `tools`, with the runtime in `_/tool.ts` that builds their requests; `_/server.ts` serves them on an `McpServer`.
+3033 tools in 1033 groups. `index.ts` exports them as `tools`, with the runtime in `_/tool.ts` that lists them and builds their requests.
 
 ## Methods without a tool
 
diff --git a/src/generated/forge-mcp/_/index.ts b/src/generated/forge-mcp/_/index.ts
deleted file mode 100644
index e289874d..00000000
--- a/src/generated/forge-mcp/_/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-// Code generated by forge. DO NOT EDIT.
-/* eslint-disable */
-
-export {
-  buildRequest,
-  InvalidArguments,
-  listTools,
-  pathParam,
-  toolsByName,
-  type ApiRequest,
-  type Args,
-  type HeaderParam,
-  type InputSchema,
-  type JsonSchema,
-  type QueryParam,
-  type Tool,
-  type ToolAnnotations,
-  type ToolResponses,
-} from './tool.js';
-export { callTool, createHandler, readBody, serveTools, type CallContext, type HandlerOptions } from './server.js';
diff --git a/src/generated/forge-mcp/_/server.ts b/src/generated/forge-mcp/_/server.ts
deleted file mode 100644
index e0edd791..00000000
--- a/src/generated/forge-mcp/_/server.ts
+++ /dev/null
@@ -1,156 +0,0 @@
-// Code generated by forge. DO NOT EDIT.
-/* eslint-disable */
-
-import {
-  createMcpHandler,
-  McpServer,
-  type CallToolResult,
-  type Implementation,
-  type Tool as McpTool,
-} from '@modelcontextprotocol/server';
-
-import { buildRequest, InvalidArguments, listTools, toolsByName, type Args, type Tool } from './tool.js';
-
-/** What a tool call needs besides the tool and its arguments. */
-export interface CallContext {
-  /** The API's base URL. */
-  readonly baseUrl: string;
-  /** Headers every API request sends, such as `Authorization`. */
-  readonly headers?: HeadersInit;
-  readonly fetch?: (request: Request) => Promise<Response>;
-  /**
-   * Returns the text of the result. By default a JSON body is pretty-printed,
-   * text is kept, and an error starts with the status.
-   */
-  readonly formatResult?: (body: unknown, response: Response) => string;
-}
-
-/**
- * Serves `tools` on `server` with low-level `tools/list` and `tools/call`
- * handlers, rather than registering each tool, which for thousands of tools
- * costs more than the request. `call` makes the API request, and `extra`
- * tools the server serves itself are listed first.
- */
-export function serveTools(
-  server: McpServer,
-  tools: readonly Tool[],
-  call: (tool: Tool, args: Args) => Promise<CallToolResult>,
-  extra: readonly McpTool[] = [],
-): void {
-  const listing = extra.length > 0 ? [...extra, ...listTools(tools)] : listTools(tools);
-  const byName = toolsByName(tools);
-  server.server.registerCapabilities({ tools: { listChanged: false } });
-  // The SDK types the list as mutable; it only serializes it.
-  server.server.setRequestHandler('tools/list', () => ({ tools: listing as McpTool[] }));
-  server.server.setRequestHandler('tools/call', async (request) => {
-    const tool = byName.get(request.params.name);
-    if (!tool) {
-      return errorResult(`Unknown tool: ${request.params.name}`);
-    }
-    return call(tool, request.params.arguments ?? {});
-  });
-}
-
-/**
- * Calls `tool`: builds its request, sends it, and returns the response as the
- * result. A response that isn't 2xx is a result with `isError: true` rather
- * than a protocol error, so the model sees what the API said.
- */
-export async function callTool(tool: Tool, args: Args, context: CallContext): Promise<CallToolResult> {
-  let request: Request;
-  try {
-    request = buildRequest(tool, args, context.baseUrl);
-  } catch (err) {
-    if (err instanceof InvalidArguments) {
-      return errorResult(err.message);
-    }
-    throw err;
-  }
-  for (const [name, value] of new Headers(context.headers)) {
-    request.headers.set(name, value);
-  }
-  const response = await (context.fetch ?? fetch)(request);
-  const body = await readBody(response);
-  const text = (context.formatResult ?? defaultFormat)(body, response);
-  return response.ok ? { content: [{ type: 'text', text }] } : errorResult(text);
-}
-
-/**
- * Returns the body of `response`: parsed JSON, text, or for anything else a
- * sentence saying what it was, since a tool result can't carry the bytes.
- */
-export async function readBody(response: Response): Promise<unknown> {
-  const type = response.headers.get('Content-Type') ?? '';
-  if (/json/i.test(type)) {
-    const text = await response.text();
-    try {
-      return text ? JSON.parse(text) : text;
-    } catch {
-      return text;
-    }
-  }
-  if (type === '' || /^text\/|xml|javascript|yaml|csv/i.test(type)) {
-    return response.text();
-  }
-  const size = (await response.arrayBuffer()).byteLength;
-  return `The response is ${size} bytes of ${type}, which this tool can't show.`;
-}
-
-function defaultFormat(body: unknown, response: Response): string {
-  const text = typeof body === 'string' ? body : JSON.stringify(body, null, 2);
-  return response.ok ? text : `${response.status} ${response.statusText}\n${text}`.trim();
-}
-
-function errorResult(text: string): CallToolResult {
-  return { content: [{ type: 'text', text }], isError: true };
-}
-
-/** What {@link createHandler} serves. */
-export interface HandlerOptions {
-  readonly tools: readonly Tool[];
-  /** The API's base URL. */
-  readonly baseUrl: string;
-  readonly serverInfo: Implementation;
-  readonly instructions?: string;
-  /**
-   * Called before each MCP request is served. Returns the headers its API
-   * requests send, such as the caller's `Authorization`, or a response that
-   * refuses it.
-   */
-  readonly authorize?: (
-    request: Request,
-  ) => HeadersInit | Response | undefined | Promise<HeadersInit | Response | undefined>;
-  readonly fetch?: (request: Request) => Promise<Response>;
-  readonly formatResult?: CallContext['formatResult'];
-}
-
-/**
- * Returns a `fetch` that serves `tools` over MCP's Streamable HTTP transport:
- * for a Worker, or any server with web-standard requests. Each request gets a
- * fresh, stateless server.
- */
-export function createHandler(options: HandlerOptions): { fetch(request: Request): Promise<Response> } {
-  return {
-    async fetch(request) {
-      const authorized = options.authorize ? await options.authorize(request) : undefined;
-      if (authorized instanceof Response) {
-        return authorized;
-      }
-      const context: CallContext = {
-        baseUrl: options.baseUrl,
-        ...(authorized && { headers: authorized }),
-        ...(options.fetch && { fetch: options.fetch }),
-        ...(options.formatResult && { formatResult: options.formatResult }),
-      };
-      const handler = createMcpHandler(() => {
-        const server = new McpServer(
-          options.serverInfo,
-          options.instructions ? { instructions: options.instructions } : {},
-        );
-        serveTools(server, options.tools, (tool, args) => callTool(tool, args, context));
-        return server;
-      });
-      return handler.fetch(request);
-    },
-  };
-}
diff --git a/src/generated/forge-mcp/_/tool.ts b/src/generated/forge-mcp/_/tool.ts
index 456eb7fc..3f0576ff 100644
--- a/src/generated/forge-mcp/_/tool.ts
+++ b/src/generated/forge-mcp/_/tool.ts
@@ -46,6 +46,17 @@ export type QueryParam = readonly [name: string, value: unknown, explode: boolea
 /** A header parameter: its name and its value. */
 export type HeaderParam = readonly [name: string, value: unknown];
 
+/**
+ * An HTTP request as plain data, so it crosses RPC or `postMessage` as it is.
+ * `fetch(request.url, request)` sends it. Header names are lower case.
+ */
+export interface HttpRequest {
+  readonly method: string;
+  readonly url: string;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body?: string;
+}
+
 /**
  * The request a tool call makes, relative to the API's base URL. The path has
  * its parameters substituted and encoded; query and header values are
@@ -112,8 +123,9 @@ export function pathParam(args: Args, key: string): string {
  * Returns the HTTP request that calling `tool` with `args` makes, at
  * `baseUrl`. Query parameters are serialized in OpenAPI's default `form`
  * style. Values are not validated against the schema; the API does that.
+ * Throws {@link InvalidArguments}.
  */
-export function buildRequest(tool: Tool, args: Args, baseUrl: string): Request {
+export function buildRequest(tool: Tool, args: Args, baseUrl: string): HttpRequest {
   const missing = (tool.inputSchema.required ?? []).filter((key) => args[key] === undefined);
   if (missing.length > 0) {
     throw new InvalidArguments(`Missing required arguments: ${missing.join(', ')}`);
@@ -129,12 +141,17 @@ export function buildRequest(tool: Tool, args: Args, baseUrl: string): Request {
       headers.set(name, Array.isArray(value) ? value.map((item) => scalar(name, item)).join(',') : scalar(name, value));
     }
   }
-  const init: RequestInit = { method: tool.method, headers };
+  let body: string | undefined;
   if (api.body && api.body.value !== undefined) {
     headers.set('Content-Type', api.body.mediaType);
-    init.body = JSON.stringify(api.body.value);
+    body = JSON.stringify(api.body.value);
   }
-  return new Request(url, init);
+  return {
+    method: tool.method,
+    url: url.href,
+    headers: Object.fromEntries(headers),
+    ...(body !== undefined && { body }),
+  };
 }
 
 /** Appends a query parameter in the `form` style: `a=1&a=2` exploded, `a=1,2` not. */
diff --git a/tests/forge-tools-plan.test.ts b/tests/forge-tools-plan.test.ts
index a4fb343b..aae0f7ca 100644
--- a/tests/forge-tools-plan.test.ts
+++ b/tests/forge-tools-plan.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { buildRequest, InvalidArguments, tools } from '../src/generated/forge-mcp'
+import { tools } from '../src/generated/forge-mcp'
 import { cloudflareTool } from '../src/forge-tools/cloudflare'
 import { planCall, type PlanOptions } from '../src/forge-tools/plan'
 
@@ -9,13 +9,7 @@ const ACCOUNT = '00000000000000000000000000000001'
 function plan(name: string, args: Record<string, unknown>, options: Partial<PlanOptions> = {}) {
   const tool = tools.find((t) => t.name === name)
   if (!tool) throw new Error(`no generated tool ${name}`)
-  return planCall(
-    cloudflareTool(tool),
-    args,
-    { baseUrl: BASE, ...options },
-    buildRequest,
-    (error) => error instanceof InvalidArguments
-  )
+  return planCall(cloudflareTool(tool), args, { baseUrl: BASE, ...options })
 }
 
 describe('planning a generated tool call', () => {

From a31b135cadb5ada259be68d2d4a6dba2bddcde75 Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Tue, 27 Oct 2026 19:10:50 +0000
Subject: [PATCH 2/4] chore(forge): pin the forge commit that trims base URLs
 without a regex

---
 forge.json                        |  2 +-
 src/generated/forge-mcp/_/tool.ts | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/forge.json b/forge.json
index 0798209d..f193541f 100644
--- a/forge.json
+++ b/forge.json
@@ -1,5 +1,5 @@
 {
   "$comment": "The forge that generates src/generated/forge-mcp: a commit of cloudflare/forge. Bump ref to pick up generator changes; CI builds it.",
   "repository": "cloudflare/forge",
-  "ref": "dc86ee0992faf9b83d0bfa7b49bf2c4a1595f87a"
+  "ref": "6de519b55a32581a7905dc358f4b256904c2d2c1"
 }
diff --git a/src/generated/forge-mcp/_/tool.ts b/src/generated/forge-mcp/_/tool.ts
index 3f0576ff..642759cc 100644
--- a/src/generated/forge-mcp/_/tool.ts
+++ b/src/generated/forge-mcp/_/tool.ts
@@ -131,7 +131,7 @@ export function buildRequest(tool: Tool, args: Args, baseUrl: string): HttpReque
     throw new InvalidArguments(`Missing required arguments: ${missing.join(', ')}`);
   }
   const api = tool.request(args);
-  const url = new URL(baseUrl.replace(/\/+$/, '') + api.path);
+  const url = new URL(withoutTrailingSlashes(baseUrl) + api.path);
   for (const [name, value, explode] of api.query ?? []) {
     appendQuery(url.searchParams, name, value, explode);
   }
@@ -154,6 +154,18 @@ export function buildRequest(tool: Tool, args: Args, baseUrl: string): HttpReque
   };
 }
 
+/**
+ * Returns `url` without the `/`s it ends with. A loop rather than a regular
+ * expression, which would take quadratic time on many `/`s.
+ */
+function withoutTrailingSlashes(url: string): string {
+  let end = url.length;
+  while (end > 0 && url[end - 1] === '/') {
+    end--;
+  }
+  return url.slice(0, end);
+}
+
 /** Appends a query parameter in the `form` style: `a=1&a=2` exploded, `a=1,2` not. */
 function appendQuery(query: URLSearchParams, name: string, value: unknown, explode: boolean): void {
   if (value === undefined || value === null) {

From 72198228826f7ce8803cea23f6ec699f176bf1ba Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Wed, 28 Oct 2026 09:55:38 +0000
Subject: [PATCH 3/4] chore(forge): regenerate from openapi@d35bb44

8 tools added, none removed; tools with permissions 2,366 -> 2,368.
---
 src/generated/forge-mcp/README.md             |   2 +-
 .../forge-mcp/abuseReports/appeals/outputs.ts |   8 +
 .../abuseReports/mitigations/schemas.ts       |   6 +-
 .../aiSecurity/customTopics/schemas.ts        |   2 +-
 .../aiSecurity/customTopics/tools.ts          |   2 +-
 src/generated/forge-mcp/basinCatalog/tools.ts |  12 +
 .../threatIntel/indicators/tools.ts           | 151 +++++++++
 .../threatSignals/articles/tools.ts           |  68 +++-
 .../account/nameserverSets/outputs.ts         |  15 +
 .../account/nameserverSets/schemas.ts         |  27 ++
 .../settings/account/nameserverSets/tools.ts  | 114 ++++++-
 .../firewall/payloadLogging/outputs.ts        |  19 ++
 .../firewall/payloadLogging/schemas.ts        |  20 ++
 .../firewall/payloadLogging/tools.ts          | 225 +++++++++++++
 src/generated/forge-mcp/index.ts              |   4 +
 src/generated/forge-mcp/logpush/outputs.ts    |   1 +
 src/generated/forge-mcp/logpush/schemas.ts    |   1 +
 src/generated/forge-mcp/outputs.ts            |   6 +
 .../forge-mcp/reporting/industry/outputs.ts   |  15 +-
 .../forge-mcp/reporting/industry/tools.ts     |   9 +-
 src/generated/forge-mcp/reporting/outputs.ts  |  34 +-
 .../forge-mcp/reporting/policies/tools.ts     |   3 +
 .../forge-mcp/reporting/reports/tools.ts      |   3 +
 src/generated/forge-mcp/schemas.ts            |  14 +
 src/generated/forge-mcp/source.json           |   2 +-
 src/generated/forge-mcp/workflows/tools.ts    |  60 ++++
 .../zeroTrust/access/applications/outputs.ts  |   3 +
 .../access/applications/policies/tools.ts     |   7 +
 .../access/applications/policyTests/tools.ts  |   2 +
 .../zeroTrust/access/applications/tools.ts    |  12 +
 .../forge-mcp/zeroTrust/access/outputs.ts     |   7 +
 .../zeroTrust/access/policies/tools.ts        |   3 +
 .../forge-mcp/zeroTrust/access/schemas.ts     |  12 +
 .../organization/trustSettings/outputs.ts     |  21 ++
 .../organization/trustSettings/schemas.ts     |  23 ++
 .../organization/trustSettings/tools.ts       | 302 ++++++++++++++++++
 36 files changed, 1196 insertions(+), 19 deletions(-)
 create mode 100644 src/generated/forge-mcp/firewall/payloadLogging/outputs.ts
 create mode 100644 src/generated/forge-mcp/firewall/payloadLogging/schemas.ts
 create mode 100644 src/generated/forge-mcp/firewall/payloadLogging/tools.ts
 create mode 100644 src/generated/forge-mcp/zeroTrust/organization/trustSettings/outputs.ts
 create mode 100644 src/generated/forge-mcp/zeroTrust/organization/trustSettings/schemas.ts
 create mode 100644 src/generated/forge-mcp/zeroTrust/organization/trustSettings/tools.ts

diff --git a/src/generated/forge-mcp/README.md b/src/generated/forge-mcp/README.md
index 3cf2a360..343228ba 100644
--- a/src/generated/forge-mcp/README.md
+++ b/src/generated/forge-mcp/README.md
@@ -2,7 +2,7 @@
 
 # MCP tools
 
-3033 tools in 1033 groups. `index.ts` exports them as `tools`, with the runtime in `_/tool.ts` that lists them and builds their requests.
+3041 tools in 1035 groups. `index.ts` exports them as `tools`, with the runtime in `_/tool.ts` that lists them and builds their requests.
 
 ## Methods without a tool
 
diff --git a/src/generated/forge-mcp/abuseReports/appeals/outputs.ts b/src/generated/forge-mcp/abuseReports/appeals/outputs.ts
index c06bf5f2..a36891e6 100644
--- a/src/generated/forge-mcp/abuseReports/appeals/outputs.ts
+++ b/src/generated/forge-mcp/abuseReports/appeals/outputs.ts
@@ -20,8 +20,15 @@ export const abuse_reports_AppealEligibility_output: JsonSchema = {
     "has_open_appeal": {
       "type": "boolean"
     },
+    "has_pending_notice": {
+      "type": "boolean"
+    },
     "max_appeals": {
       "type": "integer"
+    },
+    "notice_deadline": {
+      "format": "date-time",
+      "type": "string"
     }
   },
   "required": [
@@ -29,6 +36,7 @@ export const abuse_reports_AppealEligibility_output: JsonSchema = {
     "appealable",
     "has_appealable_mitigations",
     "has_open_appeal",
+    "has_pending_notice",
     "max_appeals"
   ],
   "type": "object"
diff --git a/src/generated/forge-mcp/abuseReports/mitigations/schemas.ts b/src/generated/forge-mcp/abuseReports/mitigations/schemas.ts
index 14192be4..be8f6a8a 100644
--- a/src/generated/forge-mcp/abuseReports/mitigations/schemas.ts
+++ b/src/generated/forge-mcp/abuseReports/mitigations/schemas.ts
@@ -135,7 +135,7 @@ export const abuse_reports_MitigationAppeal: JsonSchema = {
  * The schema of `abuse-reports_MitigationAppealRequest`.
  */
 export const abuse_reports_MitigationAppealRequest: JsonSchema = {
-  "description": "Submit an appeal for a report. Provide either a list of mitigations to appeal, or an appeal type with its supporting details, but not both. When type is \"counter_notice\", the counter-notice details are required.",
+  "description": "Submit an appeal for a report. Provide either a list of mitigations to appeal, or an appeal type with its supporting details, but not both. When type is \"counter_notice\", the counter-notice details are required. A \"content_removed\" appeal takes an optional explanation instead and is accepted only while the report is in its Notice and Takedown notice period (`has_pending_notice` on the eligibility response). Reports that allow a single appeal (`max_appeals` of 1) never have a notice period and accept it whenever `appealable` is true.",
   "properties": {
     "appeals": {
       "description": "List of mitigations to appeal.",
@@ -148,6 +148,10 @@ export const abuse_reports_MitigationAppealRequest: JsonSchema = {
       "$ref": "#/$defs/abuse-reports_DMCACounterNotice",
       "description": "Counter-notice details supporting an appeal."
     },
+    "explanation": {
+      "description": "Optional explanation for a \"content_removed\" appeal, such as how the content was removed. Not accepted for other appeal types.",
+      "type": "string"
+    },
     "type": {
       "$ref": "#/$defs/abuse-reports_AppealType",
       "description": "The type of appeal being submitted."
diff --git a/src/generated/forge-mcp/aiSecurity/customTopics/schemas.ts b/src/generated/forge-mcp/aiSecurity/customTopics/schemas.ts
index 206c9662..ed09215f 100644
--- a/src/generated/forge-mcp/aiSecurity/customTopics/schemas.ts
+++ b/src/generated/forge-mcp/aiSecurity/customTopics/schemas.ts
@@ -13,7 +13,7 @@ export const waf_product_api_bundle_custom_topic: JsonSchema = {
       "type": "string"
     },
     "topic": {
-      "description": "Description of the topic category. Must contain only printable ASCII characters.",
+      "description": "Description of the topic category. Must contain 2–50 UTF-8 bytes. Text in any language is supported, including spaces, numbers, punctuation, and symbols. Tabs, line breaks, invalid text, and invisible formatting characters are not allowed.",
       "type": "string"
     }
   },
diff --git a/src/generated/forge-mcp/aiSecurity/customTopics/tools.ts b/src/generated/forge-mcp/aiSecurity/customTopics/tools.ts
index 7a0c8ec9..2db8f674 100644
--- a/src/generated/forge-mcp/aiSecurity/customTopics/tools.ts
+++ b/src/generated/forge-mcp/aiSecurity/customTopics/tools.ts
@@ -81,7 +81,7 @@ export const tools: readonly Tool[] = [
   {
     name: "ai_security_custom_topics_update",
     title: "Update the AI Security for Apps custom topics of a zone.",
-    description: "Update the custom topic list of the zone, overwriting it entirely with the topics in the request, so include\nevery topic you want to keep. Changes can take up to a minute to propagate.\n\nEach entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic`\ndescription, which the classifier scores prompts against while AI Security for Apps is enabled. The following\nrules apply:\n\n- A zone can hold at most 20 topics.\n- `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens.\n- `topic` must be 2–50 printable ASCII characters.\n- Labels must be unique within the zone, and so must topic descriptions.\n\nConfirm with the user before calling this tool. This operation overwrites the AI Security for Apps custom topics for a zone.",
+    description: "Update the custom topic list of the zone, overwriting it entirely with the topics in the request, so include\nevery topic you want to keep. Changes can take up to a minute to propagate.\n\nEach entry has a `label`, used to reference the topic in rule expressions and analytics, and a `topic`\ndescription, which the classifier scores prompts against while AI Security for Apps is enabled. The following\nrules apply:\n\n- A zone can hold at most 20 topics.\n- `label` must be 2–20 characters, using only lowercase letters (a–z), digits (0–9), and hyphens.\n- `topic` must be 2–50 UTF-8 bytes. Text in any language is supported, including spaces, numbers,\n  punctuation, and symbols. Tabs, line breaks, invalid text, and invisible formatting characters are not allowed.\n- Labels must be unique within the zone, and so must topic descriptions.\n\nConfirm with the user before calling this tool. This operation overwrites the AI Security for Apps custom topics for a zone.",
     inputSchema: {
       type: "object",
       properties: {
diff --git a/src/generated/forge-mcp/basinCatalog/tools.ts b/src/generated/forge-mcp/basinCatalog/tools.ts
index da99a2cd..ab633594 100644
--- a/src/generated/forge-mcp/basinCatalog/tools.ts
+++ b/src/generated/forge-mcp/basinCatalog/tools.ts
@@ -17,6 +17,10 @@ import {
   r2_data_catalog_maintenance_interval_output,
   r2_data_catalog_snapshot_expiration_config_output,
 } from "../outputs.js";
+import {
+  r2_data_catalog_catalog_activation_request,
+  r2_data_catalog_catalog_credential_request,
+} from "../schemas.js";
 
 /**
  * The tools of `basin_catalog`.
@@ -161,6 +165,9 @@ export const tools: readonly Tool[] = [
           "description": "Identifies the account.",
           "type": "string"
         },
+        "body": {
+          "$ref": "#/$defs/r2-data-catalog_catalog-activation-request"
+        },
         "bucket_name": {
           "description": "Specifies the R2 bucket name to enable as catalog.",
           "type": "string"
@@ -170,6 +177,10 @@ export const tools: readonly Tool[] = [
         "account_id",
         "bucket_name"
       ],
+      $defs: {
+        "r2-data-catalog_catalog-activation-request": r2_data_catalog_catalog_activation_request,
+        "r2-data-catalog_catalog-credential-request": r2_data_catalog_catalog_credential_request,
+      },
     },
     outputSchema: {
       "$ref": "#/$defs/r2-data-catalog_catalog-activation-response",
@@ -223,6 +234,7 @@ export const tools: readonly Tool[] = [
     },
     request: (args) => ({
       path: `/accounts/${pathParam(args, "account_id")}/basin-catalog/${pathParam(args, "bucket_name")}/enable`,
+      body: { value: args["body"], mediaType: "application/json" },
     }),
   },
   {
diff --git a/src/generated/forge-mcp/cloudforceOne/threatIntel/indicators/tools.ts b/src/generated/forge-mcp/cloudforceOne/threatIntel/indicators/tools.ts
index f266ba6a..b7aba8d1 100644
--- a/src/generated/forge-mcp/cloudforceOne/threatIntel/indicators/tools.ts
+++ b/src/generated/forge-mcp/cloudforceOne/threatIntel/indicators/tools.ts
@@ -169,6 +169,157 @@ export const tools: readonly Tool[] = [
       body: { value: args["body"], mediaType: "application/json" },
     }),
   },
+  {
+    name: "cloudforce_one_threat_intel_indicators_bulk_delete",
+    title: "Delete indicators in bulk",
+    description: "Deletes up to 200 indicators from a dataset. Pass the indicator UUIDs in `indicatorIds`; UUIDs that are not found are returned in `missingUUIDs`.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_id": {
+          "description": "Account ID.",
+          "type": "string"
+        },
+        "dataset_id": {
+          "description": "Dataset ID.",
+          "type": "string"
+        },
+        "indicator_ids": {
+          "description": "Indicator UUIDs to delete, 1-200 per request.",
+          "items": {
+            "format": "uuid",
+            "type": "string"
+          },
+          "maxItems": 200,
+          "minItems": 1,
+          "type": "array"
+        }
+      },
+      required: [
+        "account_id",
+        "dataset_id",
+        "indicator_ids"
+      ],
+    },
+    outputSchema: {
+      "properties": {
+        "deletedCount": {
+          "type": "integer"
+        },
+        "missingUUIDs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "deletedCount"
+      ],
+      "type": "object",
+    },
+    annotations: {
+      "destructiveHint": true,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Delete indicators in bulk"
+    },
+    method: "DELETE",
+    path: "/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators",
+    extensions: {
+      "x-api-token-group": [
+        "Cloudforce One Write"
+      ]
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "properties": {
+            "deletedCount": {
+              "type": "integer"
+            },
+            "missingUUIDs": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "deletedCount"
+          ],
+          "type": "object"
+        },
+        "400": {
+          "properties": {
+            "errors": {
+              "items": {
+                "properties": {
+                  "message": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "message"
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            },
+            "result": {
+              "type": "object"
+            },
+            "success": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "errors",
+            "result",
+            "success"
+          ],
+          "type": "object"
+        },
+        "404": {
+          "properties": {
+            "errors": {
+              "items": {
+                "properties": {
+                  "message": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "message"
+                ],
+                "type": "object"
+              },
+              "type": "array"
+            },
+            "result": {
+              "type": "object"
+            },
+            "success": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "errors",
+            "result",
+            "success"
+          ],
+          "type": "object"
+        }
+      },
+    },
+    request: (args) => ({
+      path: `/accounts/${pathParam(args, "account_id")}/cloudforce-one/events/dataset/${pathParam(args, "dataset_id")}/indicators`,
+      query: [
+        ["indicatorIds", args["indicator_ids"], true],
+      ],
+    }),
+  },
   {
     name: "cloudforce_one_threat_intel_indicators_create",
     title: "Create an indicator",
diff --git a/src/generated/forge-mcp/cloudforceOne/threatSignals/articles/tools.ts b/src/generated/forge-mcp/cloudforceOne/threatSignals/articles/tools.ts
index 001de784..2c0c213c 100644
--- a/src/generated/forge-mcp/cloudforceOne/threatSignals/articles/tools.ts
+++ b/src/generated/forge-mcp/cloudforceOne/threatSignals/articles/tools.ts
@@ -10,7 +10,7 @@ export const tools: readonly Tool[] = [
   {
     name: "cloudforce_one_threat_signals_articles_aggregate_relevance",
     title: "Count Threat Signals articles by relevance band",
-    description: "Beta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. All counts are read together and are exact.",
+    description: "Beta. Counts the account's Threat Signals articles in each relevance band, for each active Priority Intelligence Requirement and across all of them. Uses the same PIRs as article relevance: active PIRs, including those the matcher paused; drafts and deleted PIRs are excluded. Articles not scored against a PIR are not counted for it. The combined counts place each article once, in the band of its best score, so they are not the sum of the per-PIR counts. read counts only read or only unread articles. All counts are read together and are exact.",
     inputSchema: {
       type: "object",
       properties: {
@@ -26,6 +26,10 @@ export const tools: readonly Tool[] = [
           "description": "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC.",
           "format": "date-time",
           "type": "string"
+        },
+        "read": {
+          "description": "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles.",
+          "type": "boolean"
         }
       },
       required: [
@@ -200,13 +204,14 @@ export const tools: readonly Tool[] = [
       query: [
         ["published_after", args["published_after"], true],
         ["published_before", args["published_before"], true],
+        ["read", args["read"], true],
       ],
     }),
   },
   {
     name: "cloudforce_one_threat_signals_articles_aggregate_severity",
     title: "Count Threat Signals articles by severity band",
-    description: "Beta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the severity level nearest its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact.",
+    description: "Beta. Counts the account's Threat Signals articles in each intrinsic severity band. An article's band is the one reported as its severity, from informational to critical. Articles without a severity are not counted. Also counts, for each active Priority Intelligence Requirement, the articles scored against it. min_relevance counts only articles at or above a relevance band: overall, for any active PIR; per PIR, for that PIR, the same rule as the per-PIR relevance counts. pir_id counts for one active PIR only. read counts only read or only unread articles, in both articles and priorities. Like the article severity field, severity is reported only while the account has an active Priority Intelligence Requirement, including one the matcher paused; otherwise every count is zero and priorities is empty. All counts are read together and are exact.",
     inputSchema: {
       type: "object",
       properties: {
@@ -236,6 +241,10 @@ export const tools: readonly Tool[] = [
           "description": "Include articles published at or before this ISO 8601 date-time with Z or a numeric UTC offset; normalized to UTC.",
           "format": "date-time",
           "type": "string"
+        },
+        "read": {
+          "description": "Filter by read state. Accepts true, false, 1, or 0; omit to include read and unread articles.",
+          "type": "boolean"
         }
       },
       required: [
@@ -426,6 +435,7 @@ export const tools: readonly Tool[] = [
       query: [
         ["published_after", args["published_after"], true],
         ["published_before", args["published_before"], true],
+        ["read", args["read"], true],
         ["pir_id", args["pir_id"], true],
         ["min_relevance", args["min_relevance"], true],
       ],
@@ -703,7 +713,14 @@ export const tools: readonly Tool[] = [
         "severity": {
           "oneOf": [
             {
-              "type": "number"
+              "enum": [
+                "informational",
+                "low",
+                "medium",
+                "high",
+                "critical"
+              ],
+              "type": "string"
             },
             {
               "type": "null"
@@ -1011,7 +1028,14 @@ export const tools: readonly Tool[] = [
             "severity": {
               "oneOf": [
                 {
-                  "type": "number"
+                  "enum": [
+                    "informational",
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                  ],
+                  "type": "string"
                 },
                 {
                   "type": "null"
@@ -1472,7 +1496,14 @@ export const tools: readonly Tool[] = [
               "severity": {
                 "oneOf": [
                   {
-                    "type": "number"
+                    "enum": [
+                      "informational",
+                      "low",
+                      "medium",
+                      "high",
+                      "critical"
+                    ],
+                    "type": "string"
                   },
                   {
                     "type": "null"
@@ -1749,7 +1780,14 @@ export const tools: readonly Tool[] = [
                   "severity": {
                     "oneOf": [
                       {
-                        "type": "number"
+                        "enum": [
+                          "informational",
+                          "low",
+                          "medium",
+                          "high",
+                          "critical"
+                        ],
+                        "type": "string"
                       },
                       {
                         "type": "null"
@@ -2051,7 +2089,14 @@ export const tools: readonly Tool[] = [
         "severity": {
           "oneOf": [
             {
-              "type": "number"
+              "enum": [
+                "informational",
+                "low",
+                "medium",
+                "high",
+                "critical"
+              ],
+              "type": "string"
             },
             {
               "type": "null"
@@ -2304,7 +2349,14 @@ export const tools: readonly Tool[] = [
             "severity": {
               "oneOf": [
                 {
-                  "type": "number"
+                  "enum": [
+                    "informational",
+                    "low",
+                    "medium",
+                    "high",
+                    "critical"
+                  ],
+                  "type": "string"
                 },
                 {
                   "type": "null"
diff --git a/src/generated/forge-mcp/dns/settings/account/nameserverSets/outputs.ts b/src/generated/forge-mcp/dns/settings/account/nameserverSets/outputs.ts
index 3d68bb0a..4960fb90 100644
--- a/src/generated/forge-mcp/dns/settings/account/nameserverSets/outputs.ts
+++ b/src/generated/forge-mcp/dns/settings/account/nameserverSets/outputs.ts
@@ -47,6 +47,9 @@ export const dns_settings_nameserver_set_advanced_response_output: JsonSchema =
     "ip_set": {
       "$ref": "#/$defs/dns-settings_nameserver-set-ip-set"
     },
+    "name": {
+      "$ref": "#/$defs/dns-settings_nameserver-set-name"
+    },
     "nameservers": {
       "items": {
         "$ref": "#/$defs/dns-settings_nameserver-set-advanced-response-member"
@@ -60,6 +63,7 @@ export const dns_settings_nameserver_set_advanced_response_output: JsonSchema =
     "created_on",
     "id",
     "ip_set",
+    "name",
     "advanced",
     "nameservers"
   ],
@@ -134,6 +138,13 @@ export const dns_settings_nameserver_set_ipv6_addresses_output: JsonSchema = {
   "type": "array"
 };
 
+/**
+ * The schema of `dns-settings_nameserver-set-name` in responses.
+ */
+export const dns_settings_nameserver_set_name_output: JsonSchema = {
+  "type": "string"
+};
+
 /**
  * The schema of `dns-settings_nameserver-set-response` in responses.
  */
@@ -192,6 +203,9 @@ export const dns_settings_nameserver_set_standard_response_output: JsonSchema =
     "ip_set": {
       "$ref": "#/$defs/dns-settings_nameserver-set-ip-set"
     },
+    "name": {
+      "$ref": "#/$defs/dns-settings_nameserver-set-name"
+    },
     "nameservers": {
       "items": {
         "$ref": "#/$defs/dns-settings_nameserver-set-response-member"
@@ -205,6 +219,7 @@ export const dns_settings_nameserver_set_standard_response_output: JsonSchema =
     "created_on",
     "id",
     "ip_set",
+    "name",
     "advanced",
     "nameservers"
   ],
diff --git a/src/generated/forge-mcp/dns/settings/account/nameserverSets/schemas.ts b/src/generated/forge-mcp/dns/settings/account/nameserverSets/schemas.ts
index 7e03a721..1711ff45 100644
--- a/src/generated/forge-mcp/dns/settings/account/nameserverSets/schemas.ts
+++ b/src/generated/forge-mcp/dns/settings/account/nameserverSets/schemas.ts
@@ -26,6 +26,10 @@ export const dns_settings_nameserver_set_create: JsonSchema = {
       "default": 1,
       "description": "Selects the account-specific IP set that supplies the nameserver addresses. Nameserver sets with the same `ip_set` and `advanced` value may reuse addresses; otherwise, they use disjoint address groups."
     },
+    "name": {
+      "$ref": "#/$defs/dns-settings_nameserver-set-name",
+      "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses."
+    },
     "nameservers": {
       "description": "Lists each nameserver and the number of addresses to allocate to it. Requires a unique name for each entry in the set.",
       "items": {
@@ -37,6 +41,7 @@ export const dns_settings_nameserver_set_create: JsonSchema = {
     }
   },
   "required": [
+    "name",
     "nameservers"
   ],
   "type": "object"
@@ -78,3 +83,25 @@ export const dns_settings_nameserver_set_ip_set: JsonSchema = {
   "description": "Selects the account-specific IP set that supplies the nameserver addresses. Nameserver sets with the same `ip_set` and `advanced` value may reuse addresses; otherwise, they use disjoint address groups.",
   "type": "integer"
 };
+
+/**
+ * The schema of `dns-settings_nameserver-set-name`.
+ */
+export const dns_settings_nameserver_set_name: JsonSchema = {
+  "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses.",
+  "type": "string"
+};
+
+/**
+ * The schema of `dns-settings_nameserver-set-patch`.
+ */
+export const dns_settings_nameserver_set_patch: JsonSchema = {
+  "description": "Updates only the customer-defined name. All other fields are rejected, even if unchanged. An empty object or the current name succeeds without changing the set. A null name is invalid. Requires the account-scoped creation entitlements, including eligibility for the set's current IP set and the Advanced entitlement for an Advanced set.",
+  "properties": {
+    "name": {
+      "$ref": "#/$defs/dns-settings_nameserver-set-name",
+      "description": "Customer-defined name, unique within the account by exact string equality (case-sensitive, with no Unicode normalization). Must be valid UTF-8 and at most 255 UTF-8 bytes, not 255 characters. Only graphical Unicode characters are allowed; leading or trailing whitespace is rejected. The name can be changed without changing the set's nameservers or addresses."
+    }
+  },
+  "type": "object"
+};
diff --git a/src/generated/forge-mcp/dns/settings/account/nameserverSets/tools.ts b/src/generated/forge-mcp/dns/settings/account/nameserverSets/tools.ts
index e65ab486..7c133448 100644
--- a/src/generated/forge-mcp/dns/settings/account/nameserverSets/tools.ts
+++ b/src/generated/forge-mcp/dns/settings/account/nameserverSets/tools.ts
@@ -16,6 +16,7 @@ import {
   dns_settings_nameserver_set_ip_set_output,
   dns_settings_nameserver_set_ipv4_addresses_output,
   dns_settings_nameserver_set_ipv6_addresses_output,
+  dns_settings_nameserver_set_name_output,
   dns_settings_nameserver_set_response_member_output,
   dns_settings_nameserver_set_response_output,
   dns_settings_nameserver_set_standard_response_output,
@@ -26,6 +27,8 @@ import {
   dns_settings_nameserver_set_create_member,
   dns_settings_nameserver_set_ip_count,
   dns_settings_nameserver_set_ip_set,
+  dns_settings_nameserver_set_name,
+  dns_settings_nameserver_set_patch,
 } from "./schemas.js";
 
 /**
@@ -35,7 +38,7 @@ export const tools: readonly Tool[] = [
   {
     name: "dns_settings_account_nameserver_sets_create",
     title: "Create Custom Nameserver Set",
-    description: "Creates an immutable Custom Nameserver Set. To change a set, create a new one, move any zone assignments, and delete the old set.\n\nThis method is beta.",
+    description: "Creates a named Custom Nameserver Set. Only the customer-defined name can be changed later. To change nameservers or addresses, create a new set, move any zone assignments, and delete the old set.\n\nThis method is beta.",
     inputSchema: {
       type: "object",
       properties: {
@@ -57,6 +60,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-create-member": dns_settings_nameserver_set_create_member,
         "dns-settings_nameserver-set-ip-count": dns_settings_nameserver_set_ip_count,
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name,
       },
     },
     outputSchema: {
@@ -70,6 +74,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
@@ -117,6 +122,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
@@ -211,6 +217,108 @@ export const tools: readonly Tool[] = [
       path: `/accounts/${pathParam(args, "account_id")}/dns_settings/nameserver_sets/${pathParam(args, "nameserver_set_id")}`,
     }),
   },
+  {
+    name: "dns_settings_account_nameserver_sets_edit",
+    title: "Update Custom Nameserver Set",
+    description: "Renames a Custom Nameserver Set owned by the account. Only name may be supplied; immutable and unknown fields are rejected even if unchanged. An empty object or the existing name is a successful no-op. Requires the account-scoped creation entitlements for the existing set.\n\nThis method is beta.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_id": {
+          "description": "Identifier.",
+          "type": "string"
+        },
+        "body": {
+          "$ref": "#/$defs/dns-settings_nameserver-set-patch"
+        },
+        "nameserver_set_id": {
+          "description": "Identifier for a nameserver set.",
+          "type": "string"
+        }
+      },
+      required: [
+        "account_id",
+        "nameserver_set_id",
+        "body"
+      ],
+      $defs: {
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name,
+        "dns-settings_nameserver-set-patch": dns_settings_nameserver_set_patch,
+      },
+    },
+    outputSchema: {
+      "$ref": "#/$defs/dns-settings_nameserver-set-response",
+      $defs: {
+        "dns-settings_nameserver-name": dns_settings_nameserver_name_output,
+        "dns-settings_nameserver-set-address-groups": dns_settings_nameserver_set_address_groups_output,
+        "dns-settings_nameserver-set-advanced-response": dns_settings_nameserver_set_advanced_response_output,
+        "dns-settings_nameserver-set-advanced-response-member": dns_settings_nameserver_set_advanced_response_member_output,
+        "dns-settings_nameserver-set-id": dns_settings_nameserver_set_id_output,
+        "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
+        "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
+        "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
+        "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
+        "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
+        "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Update Custom Nameserver Set"
+    },
+    method: "PATCH",
+    path: "/accounts/{account_id}/dns_settings/nameserver_sets/{nameserver_set_id}",
+    extensions: {
+      "x-api-token-group": [
+        "Account DNS Settings Write"
+      ],
+      "x-cfPermissionsRequired": {
+        "enum": [
+          "com.cloudflare.api.account.custom-ns-set.update"
+        ],
+        "x-fern-enum": {
+          "com.cloudflare.api.account.custom-ns-set.update": {
+            "name": "com_cloudflare_api_account_custom_ns_set_update"
+          }
+        }
+      },
+      "x-stability": "beta"
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "$ref": "#/$defs/dns-settings_nameserver-set-response"
+        },
+        "4XX": {
+          "$ref": "#/$defs/dns-settings_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "dns-settings_api-response-common-failure": dns_settings_api_response_common_failure_output,
+        "dns-settings_messages": dns_settings_messages_output,
+        "dns-settings_nameserver-name": dns_settings_nameserver_name_output,
+        "dns-settings_nameserver-set-address-groups": dns_settings_nameserver_set_address_groups_output,
+        "dns-settings_nameserver-set-advanced-response": dns_settings_nameserver_set_advanced_response_output,
+        "dns-settings_nameserver-set-advanced-response-member": dns_settings_nameserver_set_advanced_response_member_output,
+        "dns-settings_nameserver-set-id": dns_settings_nameserver_set_id_output,
+        "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
+        "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
+        "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
+        "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
+        "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
+        "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
+      },
+    },
+    request: (args) => ({
+      path: `/accounts/${pathParam(args, "account_id")}/dns_settings/nameserver_sets/${pathParam(args, "nameserver_set_id")}`,
+      body: { value: args["body"], mediaType: "application/json" },
+    }),
+  },
   {
     name: "dns_settings_account_nameserver_sets_get",
     title: "Get Custom Nameserver Set",
@@ -243,6 +351,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
@@ -294,6 +403,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
@@ -374,6 +484,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
@@ -456,6 +567,7 @@ export const tools: readonly Tool[] = [
         "dns-settings_nameserver-set-ip-set": dns_settings_nameserver_set_ip_set_output,
         "dns-settings_nameserver-set-ipv4-addresses": dns_settings_nameserver_set_ipv4_addresses_output,
         "dns-settings_nameserver-set-ipv6-addresses": dns_settings_nameserver_set_ipv6_addresses_output,
+        "dns-settings_nameserver-set-name": dns_settings_nameserver_set_name_output,
         "dns-settings_nameserver-set-response": dns_settings_nameserver_set_response_output,
         "dns-settings_nameserver-set-response-member": dns_settings_nameserver_set_response_member_output,
         "dns-settings_nameserver-set-standard-response": dns_settings_nameserver_set_standard_response_output,
diff --git a/src/generated/forge-mcp/firewall/payloadLogging/outputs.ts b/src/generated/forge-mcp/firewall/payloadLogging/outputs.ts
new file mode 100644
index 00000000..f6bf5386
--- /dev/null
+++ b/src/generated/forge-mcp/firewall/payloadLogging/outputs.ts
@@ -0,0 +1,19 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import type { JsonSchema } from "../../_/tool.js";
+
+/**
+ * The schema of `firewall_payload_logging_key` in responses.
+ */
+export const firewall_payload_logging_key_output: JsonSchema = {
+  "properties": {
+    "public_key": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "public_key"
+  ],
+  "type": "object"
+};
diff --git a/src/generated/forge-mcp/firewall/payloadLogging/schemas.ts b/src/generated/forge-mcp/firewall/payloadLogging/schemas.ts
new file mode 100644
index 00000000..ecec6523
--- /dev/null
+++ b/src/generated/forge-mcp/firewall/payloadLogging/schemas.ts
@@ -0,0 +1,20 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import type { JsonSchema } from "../../_/tool.js";
+
+/**
+ * The schema of `firewall_payload_logging_key`.
+ */
+export const firewall_payload_logging_key: JsonSchema = {
+  "properties": {
+    "public_key": {
+      "description": "Defines the X25519 public key, as standard base64 of exactly 32 bytes, that encrypts matched payloads. Cloudflare stores only the public key; keep the private key to decrypt logged payloads.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "public_key"
+  ],
+  "type": "object"
+};
diff --git a/src/generated/forge-mcp/firewall/payloadLogging/tools.ts b/src/generated/forge-mcp/firewall/payloadLogging/tools.ts
new file mode 100644
index 00000000..c8370e1c
--- /dev/null
+++ b/src/generated/forge-mcp/firewall/payloadLogging/tools.ts
@@ -0,0 +1,225 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import { type Tool, pathParam } from "../../_/tool.js";
+import {
+  firewall_api_response_common_failure_output,
+  firewall_messages_output,
+} from "../../outputs.js";
+import { firewall_payload_logging_key_output } from "./outputs.js";
+import { firewall_payload_logging_key } from "./schemas.js";
+
+/**
+ * The tools of `firewall.payload_logging`.
+ */
+export const tools: readonly Tool[] = [
+  {
+    name: "firewall_payload_logging_delete",
+    title: "Delete the payload logging key",
+    description: "Deletes the payload logging public key of the account or zone.\n\nThis method is beta.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_or_zone": {
+          "description": "Whether account_or_zone_id is an account ID (`accounts`) or a zone ID (`zones`).",
+          "enum": [
+            "accounts",
+            "zones"
+          ],
+          "type": "string"
+        },
+        "account_or_zone_id": {
+          "description": "The account ID or zone ID, as selected by account_or_zone.",
+          "type": "string"
+        }
+      },
+      required: [
+        "account_or_zone",
+        "account_or_zone_id"
+      ],
+    },
+    outputSchema: {
+      "$ref": "#/$defs/firewall_payload_logging_key",
+      $defs: {
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": true,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Delete the payload logging key"
+    },
+    method: "DELETE",
+    path: "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key",
+    extensions: {
+      "x-cfPlanAvailability": {
+        "business": false,
+        "enterprise": true,
+        "free": false,
+        "pro": false
+      }
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "$ref": "#/$defs/firewall_payload_logging_key"
+        },
+        "4XX": {
+          "$ref": "#/$defs/firewall_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "firewall_api-response-common-failure": firewall_api_response_common_failure_output,
+        "firewall_messages": firewall_messages_output,
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    request: (args) => ({
+      path: `/${pathParam(args, "account_or_zone")}/${pathParam(args, "account_or_zone_id")}/firewall/payload_logging/key`,
+    }),
+  },
+  {
+    name: "firewall_payload_logging_get",
+    title: "Get the payload logging key",
+    description: "Fetches the public key that payload logging uses to encrypt matched payloads for the account or zone.\n\nThis method is beta.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_or_zone": {
+          "description": "Whether account_or_zone_id is an account ID (`accounts`) or a zone ID (`zones`).",
+          "enum": [
+            "accounts",
+            "zones"
+          ],
+          "type": "string"
+        },
+        "account_or_zone_id": {
+          "description": "The account ID or zone ID, as selected by account_or_zone.",
+          "type": "string"
+        }
+      },
+      required: [
+        "account_or_zone",
+        "account_or_zone_id"
+      ],
+    },
+    outputSchema: {
+      "$ref": "#/$defs/firewall_payload_logging_key",
+      $defs: {
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": true,
+      "title": "Get the payload logging key"
+    },
+    method: "GET",
+    path: "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key",
+    extensions: {
+      "x-cfPlanAvailability": {
+        "business": false,
+        "enterprise": true,
+        "free": false,
+        "pro": false
+      }
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "$ref": "#/$defs/firewall_payload_logging_key"
+        },
+        "4XX": {
+          "$ref": "#/$defs/firewall_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "firewall_api-response-common-failure": firewall_api_response_common_failure_output,
+        "firewall_messages": firewall_messages_output,
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    request: (args) => ({
+      path: `/${pathParam(args, "account_or_zone")}/${pathParam(args, "account_or_zone_id")}/firewall/payload_logging/key`,
+    }),
+  },
+  {
+    name: "firewall_payload_logging_update",
+    title: "Set the payload logging key",
+    description: "Creates or replaces the public key that payload logging uses to encrypt matched payloads for the account or zone. It applies to every zone in the account or zone that has no zone key. Requires a plan that includes payload logging (Enterprise); otherwise it returns 403.\n\nThis method is beta.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_or_zone": {
+          "description": "Whether account_or_zone_id is an account ID (`accounts`) or a zone ID (`zones`).",
+          "enum": [
+            "accounts",
+            "zones"
+          ],
+          "type": "string"
+        },
+        "account_or_zone_id": {
+          "description": "The account ID or zone ID, as selected by account_or_zone.",
+          "type": "string"
+        },
+        "body": {
+          "$ref": "#/$defs/firewall_payload_logging_key"
+        }
+      },
+      required: [
+        "account_or_zone",
+        "account_or_zone_id",
+        "body"
+      ],
+      $defs: {
+        "firewall_payload_logging_key": firewall_payload_logging_key,
+      },
+    },
+    outputSchema: {
+      "$ref": "#/$defs/firewall_payload_logging_key",
+      $defs: {
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": true,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Set the payload logging key"
+    },
+    method: "PUT",
+    path: "/{account_or_zone}/{account_or_zone_id}/firewall/payload_logging/key",
+    extensions: {
+      "x-cfPlanAvailability": {
+        "business": false,
+        "enterprise": true,
+        "free": false,
+        "pro": false
+      }
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "$ref": "#/$defs/firewall_payload_logging_key"
+        },
+        "4XX": {
+          "$ref": "#/$defs/firewall_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "firewall_api-response-common-failure": firewall_api_response_common_failure_output,
+        "firewall_messages": firewall_messages_output,
+        "firewall_payload_logging_key": firewall_payload_logging_key_output,
+      },
+    },
+    request: (args) => ({
+      path: `/${pathParam(args, "account_or_zone")}/${pathParam(args, "account_or_zone_id")}/firewall/payload_logging/key`,
+      body: { value: args["body"], mediaType: "application/json" },
+    }),
+  },
+];
diff --git a/src/generated/forge-mcp/index.ts b/src/generated/forge-mcp/index.ts
index 5ea2d924..e8c638be 100644
--- a/src/generated/forge-mcp/index.ts
+++ b/src/generated/forge-mcp/index.ts
@@ -321,6 +321,7 @@ import { tools as emailSendingTools } from "./emailSending/tools.js";
 import { tools as fieldExtractorsTools } from "./fieldExtractors/tools.js";
 import { tools as firewall_accessRulesTools } from "./firewall/accessRules/tools.js";
 import { tools as firewall_lockdownsTools } from "./firewall/lockdowns/tools.js";
+import { tools as firewall_payloadLoggingTools } from "./firewall/payloadLogging/tools.js";
 import { tools as firewall_uaRulesTools } from "./firewall/uaRules/tools.js";
 import { tools as flagship_apps_definitionsTools } from "./flagship/apps/definitions/tools.js";
 import { tools as flagship_apps_evaluateTools } from "./flagship/apps/evaluate/tools.js";
@@ -1004,6 +1005,7 @@ import { tools as zeroTrust_identityProviders_scim_usersTools } from "./zeroTrus
 import { tools as zeroTrust_identityProvidersTools } from "./zeroTrust/identityProviders/tools.js";
 import { tools as zeroTrust_organization_dohTools } from "./zeroTrust/organization/doh/tools.js";
 import { tools as zeroTrust_organizationTools } from "./zeroTrust/organization/tools.js";
+import { tools as zeroTrust_organization_trustSettingsTools } from "./zeroTrust/organization/trustSettings/tools.js";
 import { tools as zeroTrust_riskScoring_behavioursTools } from "./zeroTrust/riskScoring/behaviours/tools.js";
 import { tools as zeroTrust_riskScoring_integrations_referencesTools } from "./zeroTrust/riskScoring/integrations/references/tools.js";
 import { tools as zeroTrust_riskScoring_integrationsTools } from "./zeroTrust/riskScoring/integrations/tools.js";
@@ -1370,6 +1372,7 @@ export const tools: readonly Tool[] = [
   ...fieldExtractorsTools,
   ...firewall_accessRulesTools,
   ...firewall_lockdownsTools,
+  ...firewall_payloadLoggingTools,
   ...firewall_uaRulesTools,
   ...flagship_appsTools,
   ...flagship_apps_definitionsTools,
@@ -2053,6 +2056,7 @@ export const tools: readonly Tool[] = [
   ...zeroTrust_identityProviders_scim_usersTools,
   ...zeroTrust_organizationTools,
   ...zeroTrust_organization_dohTools,
+  ...zeroTrust_organization_trustSettingsTools,
   ...zeroTrust_riskScoringTools,
   ...zeroTrust_riskScoring_behavioursTools,
   ...zeroTrust_riskScoring_integrationsTools,
diff --git a/src/generated/forge-mcp/logpush/outputs.ts b/src/generated/forge-mcp/logpush/outputs.ts
index 7e6a44be..36399b8a 100644
--- a/src/generated/forge-mcp/logpush/outputs.ts
+++ b/src/generated/forge-mcp/logpush/outputs.ts
@@ -42,6 +42,7 @@ export const logpush_dataset_output: JsonSchema = {
       "enum": [
         "access_requests",
         "account_abuse_protection_events",
+        "ai_gateway_events",
         "audit_logs",
         "audit_logs_v2",
         "biso_user_actions",
diff --git a/src/generated/forge-mcp/logpush/schemas.ts b/src/generated/forge-mcp/logpush/schemas.ts
index 21d03627..7eafa0b1 100644
--- a/src/generated/forge-mcp/logpush/schemas.ts
+++ b/src/generated/forge-mcp/logpush/schemas.ts
@@ -13,6 +13,7 @@ export const logpush_dataset: JsonSchema = {
       "enum": [
         "access_requests",
         "account_abuse_protection_events",
+        "ai_gateway_events",
         "audit_logs",
         "audit_logs_v2",
         "biso_user_actions",
diff --git a/src/generated/forge-mcp/outputs.ts b/src/generated/forge-mcp/outputs.ts
index 5c780fff..374ec0a1 100644
--- a/src/generated/forge-mcp/outputs.ts
+++ b/src/generated/forge-mcp/outputs.ts
@@ -5739,6 +5739,9 @@ export const r2_data_catalog_catalog_output: JsonSchema = {
       "format": "uuid",
       "type": "string"
     },
+    "jurisdiction": {
+      "type": "string"
+    },
     "maintenance_config": {
       "oneOf": [
         {
@@ -7816,6 +7819,9 @@ export const tunnel_messages_output: JsonSchema = {
       "code": {
         "type": "integer"
       },
+      "context": {
+        "type": "object"
+      },
       "message": {
         "type": "string"
       }
diff --git a/src/generated/forge-mcp/reporting/industry/outputs.ts b/src/generated/forge-mcp/reporting/industry/outputs.ts
index 01b3ae27..16805eb5 100644
--- a/src/generated/forge-mcp/reporting/industry/outputs.ts
+++ b/src/generated/forge-mcp/reporting/industry/outputs.ts
@@ -15,10 +15,21 @@ export const reports_AccountIndustryErrorResponse_output: JsonSchema = {
       "type": "array"
     },
     "messages": {
-      "items": {},
+      "items": {
+        "$ref": "#/$defs/reports_Message"
+      },
       "type": "array"
     },
-    "result": {},
+    "result": {
+      "oneOf": [
+        {
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
     "success": {
       "enum": [
         false
diff --git a/src/generated/forge-mcp/reporting/industry/tools.ts b/src/generated/forge-mcp/reporting/industry/tools.ts
index 0ca22412..e2ae1d49 100644
--- a/src/generated/forge-mcp/reporting/industry/tools.ts
+++ b/src/generated/forge-mcp/reporting/industry/tools.ts
@@ -2,7 +2,7 @@
 /* eslint-disable */
 
 import { type Tool, pathParam } from "../../_/tool.js";
-import { reports_Error_output } from "../outputs.js";
+import { reports_Error_output, reports_Message_output } from "../outputs.js";
 import {
   reports_AccountIndustryErrorResponse_output,
   reports_AccountIndustryPatchResponse_industry_output,
@@ -60,11 +60,17 @@ export const tools: readonly Tool[] = [
       schemas: {
         "200": {
           "$ref": "#/$defs/reports_AccountIndustrySingleResponse"
+        },
+        "400": {
+          "$ref": "#/$defs/reports_AccountIndustryErrorResponse"
         }
       },
       $defs: {
+        "reports_AccountIndustryErrorResponse": reports_AccountIndustryErrorResponse_output,
         "reports_AccountIndustrySingleResponse": reports_AccountIndustrySingleResponse_output,
         "reports_AccountIndustrySingleResponse_industry": reports_AccountIndustrySingleResponse_industry_output,
+        "reports_Error": reports_Error_output,
+        "reports_Message": reports_Message_output,
       },
     },
     request: (args) => ({
@@ -135,6 +141,7 @@ export const tools: readonly Tool[] = [
         "reports_AccountIndustryPatchResponse": reports_AccountIndustryPatchResponse_output,
         "reports_AccountIndustryPatchResponse_industry": reports_AccountIndustryPatchResponse_industry_output,
         "reports_Error": reports_Error_output,
+        "reports_Message": reports_Message_output,
       },
     },
     request: (args) => ({
diff --git a/src/generated/forge-mcp/reporting/outputs.ts b/src/generated/forge-mcp/reporting/outputs.ts
index 9e119157..4853ed15 100644
--- a/src/generated/forge-mcp/reporting/outputs.ts
+++ b/src/generated/forge-mcp/reporting/outputs.ts
@@ -22,6 +22,25 @@ export const reports_Error_output: JsonSchema = {
   "type": "object"
 };
 
+/**
+ * The schema of `reports_Message` in responses.
+ */
+export const reports_Message_output: JsonSchema = {
+  "properties": {
+    "code": {
+      "type": "number"
+    },
+    "message": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "code",
+    "message"
+  ],
+  "type": "object"
+};
+
 /**
  * The schema of `reports_PolicyErrorResponse` in responses.
  */
@@ -34,10 +53,21 @@ export const reports_PolicyErrorResponse_output: JsonSchema = {
       "type": "array"
     },
     "messages": {
-      "items": {},
+      "items": {
+        "$ref": "#/$defs/reports_Message"
+      },
       "type": "array"
     },
-    "result": {},
+    "result": {
+      "oneOf": [
+        {
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
     "success": {
       "enum": [
         false
diff --git a/src/generated/forge-mcp/reporting/policies/tools.ts b/src/generated/forge-mcp/reporting/policies/tools.ts
index 944c2e17..89114a54 100644
--- a/src/generated/forge-mcp/reporting/policies/tools.ts
+++ b/src/generated/forge-mcp/reporting/policies/tools.ts
@@ -4,6 +4,7 @@
 import { type Tool, pathParam } from "../../_/tool.js";
 import {
   reports_Error_output,
+  reports_Message_output,
   reports_PolicyErrorResponse_output,
 } from "../outputs.js";
 import {
@@ -68,6 +69,7 @@ export const tools: readonly Tool[] = [
       },
       $defs: {
         "reports_Error": reports_Error_output,
+        "reports_Message": reports_Message_output,
         "reports_PolicyErrorResponse": reports_PolicyErrorResponse_output,
         "reports_PolicySingleResponse_result": reports_PolicySingleResponse_result_output,
       },
@@ -165,6 +167,7 @@ export const tools: readonly Tool[] = [
       },
       $defs: {
         "reports_Error": reports_Error_output,
+        "reports_Message": reports_Message_output,
         "reports_PoliciesListResponse_resultItem": reports_PoliciesListResponse_resultItem_output,
         "reports_PolicyErrorResponse": reports_PolicyErrorResponse_output,
       },
diff --git a/src/generated/forge-mcp/reporting/reports/tools.ts b/src/generated/forge-mcp/reporting/reports/tools.ts
index b88189a5..68459750 100644
--- a/src/generated/forge-mcp/reporting/reports/tools.ts
+++ b/src/generated/forge-mcp/reporting/reports/tools.ts
@@ -4,6 +4,7 @@
 import { type Tool, pathParam } from "../../_/tool.js";
 import {
   reports_Error_output,
+  reports_Message_output,
   reports_PolicyErrorResponse_output,
 } from "../outputs.js";
 import {
@@ -129,6 +130,7 @@ export const tools: readonly Tool[] = [
         "reports_GetReportResponse_report": reports_GetReportResponse_report_output,
         "reports_GetReportResponse_report_settings": reports_GetReportResponse_report_settings_output,
         "reports_GetReportResponse_report_status": reports_GetReportResponse_report_status_output,
+        "reports_Message": reports_Message_output,
         "reports_PolicyErrorResponse": reports_PolicyErrorResponse_output,
       },
     },
@@ -228,6 +230,7 @@ export const tools: readonly Tool[] = [
       },
       $defs: {
         "reports_Error": reports_Error_output,
+        "reports_Message": reports_Message_output,
         "reports_PolicyErrorResponse": reports_PolicyErrorResponse_output,
         "reports_ReportsListResponse_resultItem": reports_ReportsListResponse_resultItem_output,
         "reports_ReportsListResponse_resultItem_reason": reports_ReportsListResponse_resultItem_reason_output,
diff --git a/src/generated/forge-mcp/schemas.ts b/src/generated/forge-mcp/schemas.ts
index 92e1fe07..141d948e 100644
--- a/src/generated/forge-mcp/schemas.ts
+++ b/src/generated/forge-mcp/schemas.ts
@@ -2185,6 +2185,20 @@ export const organizations_api_Profile: JsonSchema = {
   "type": "object"
 };
 
+/**
+ * The schema of `r2-data-catalog_catalog-activation-request`.
+ */
+export const r2_data_catalog_catalog_activation_request: JsonSchema = {
+  "description": "Contains the optional request to enable a catalog. Send an empty body\nto keep the defaults. If you include `credential`, the service checks\nthat the token can access the bucket, then stores it as the catalog's\nmaintenance credential, like the store credentials operation.\n",
+  "properties": {
+    "credential": {
+      "$ref": "#/$defs/r2-data-catalog_catalog-credential-request",
+      "description": "Contains request to store catalog credentials."
+    }
+  },
+  "type": "object"
+};
+
 /**
  * The schema of `r2-data-catalog_catalog-credential-request`.
  */
diff --git a/src/generated/forge-mcp/source.json b/src/generated/forge-mcp/source.json
index 05555d02..ab902f39 100644
--- a/src/generated/forge-mcp/source.json
+++ b/src/generated/forge-mcp/source.json
@@ -1,3 +1,3 @@
 {
-  "release": "openapi@8db8d036ebbf524dac40673a5f2585ac543ac8af"
+  "release": "openapi@d35bb4402f3864b83e802be14ca7f58eb920528b"
 }
diff --git a/src/generated/forge-mcp/workflows/tools.ts b/src/generated/forge-mcp/workflows/tools.ts
index 8ba7f33f..2ae4b2d8 100644
--- a/src/generated/forge-mcp/workflows/tools.ts
+++ b/src/generated/forge-mcp/workflows/tools.ts
@@ -244,6 +244,21 @@ export const tools: readonly Tool[] = [
           },
           "type": "object"
         },
+        "jurisdiction": {
+          "oneOf": [
+            {
+              "enum": [
+                "eu",
+                "fedramp",
+                "us"
+              ],
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "modified_on": {
           "format": "date-time",
           "type": "string"
@@ -356,6 +371,21 @@ export const tools: readonly Tool[] = [
               },
               "type": "object"
             },
+            "jurisdiction": {
+              "oneOf": [
+                {
+                  "enum": [
+                    "eu",
+                    "fedramp",
+                    "us"
+                  ],
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
             "modified_on": {
               "format": "date-time",
               "type": "string"
@@ -554,6 +584,21 @@ export const tools: readonly Tool[] = [
                 },
                 "type": "object"
               },
+              "jurisdiction": {
+                "oneOf": [
+                  {
+                    "enum": [
+                      "eu",
+                      "fedramp",
+                      "us"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
               "modified_on": {
                 "format": "date-time",
                 "type": "string"
@@ -705,6 +750,21 @@ export const tools: readonly Tool[] = [
                     },
                     "type": "object"
                   },
+                  "jurisdiction": {
+                    "oneOf": [
+                      {
+                        "enum": [
+                          "eu",
+                          "fedramp",
+                          "us"
+                        ],
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
                   "modified_on": {
                     "format": "date-time",
                     "type": "string"
diff --git a/src/generated/forge-mcp/zeroTrust/access/applications/outputs.ts b/src/generated/forge-mcp/zeroTrust/access/applications/outputs.ts
index 9570c45e..9316cf50 100644
--- a/src/generated/forge-mcp/zeroTrust/access/applications/outputs.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/applications/outputs.ts
@@ -1379,6 +1379,9 @@ export const access_base_policy_resp_output: JsonSchema = {
     "name": {
       "$ref": "#/$defs/access_name-9"
     },
+    "policy_resolution_account_id": {
+      "$ref": "#/$defs/access_policy_resolution_account_id"
+    },
     "require": {
       "$ref": "#/$defs/access_require-2"
     },
diff --git a/src/generated/forge-mcp/zeroTrust/access/applications/policies/tools.ts b/src/generated/forge-mcp/zeroTrust/access/applications/policies/tools.ts
index ff83c685..0594afc4 100644
--- a/src/generated/forge-mcp/zeroTrust/access/applications/policies/tools.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/applications/policies/tools.ts
@@ -65,6 +65,7 @@ import {
   access_oidc_claim_rule_output,
   access_okta_group_rule_okta_output,
   access_okta_group_rule_output,
+  access_policy_resolution_account_id_output,
   access_purpose_justification_prompt_output,
   access_purpose_justification_required_output,
   access_rdp_clipboard_format_output,
@@ -199,6 +200,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
@@ -309,6 +311,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
@@ -470,6 +473,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
@@ -611,6 +615,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
@@ -762,6 +767,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
@@ -902,6 +908,7 @@ export const tools: readonly Tool[] = [
         "access_oidc_claim_rule_oidc": access_oidc_claim_rule_oidc_output,
         "access_okta_group_rule": access_okta_group_rule_output,
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_purpose_justification_prompt": access_purpose_justification_prompt_output,
         "access_purpose_justification_required": access_purpose_justification_required_output,
diff --git a/src/generated/forge-mcp/zeroTrust/access/applications/policyTests/tools.ts b/src/generated/forge-mcp/zeroTrust/access/applications/policyTests/tools.ts
index d0542446..bc7d6c1c 100644
--- a/src/generated/forge-mcp/zeroTrust/access/applications/policyTests/tools.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/applications/policyTests/tools.ts
@@ -66,6 +66,7 @@ import {
   access_okta_group_rule,
   access_okta_group_rule_okta,
   access_policy_req,
+  access_policy_resolution_account_id,
   access_purpose_justification_prompt,
   access_purpose_justification_required,
   access_rdp_clipboard_format,
@@ -178,6 +179,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta,
         "access_policy_init_req": access_policy_init_req,
         "access_policy_req": access_policy_req,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id,
         "access_purpose_justification_prompt": access_purpose_justification_prompt,
         "access_purpose_justification_required": access_purpose_justification_required,
         "access_rdp_clipboard_format": access_rdp_clipboard_format,
diff --git a/src/generated/forge-mcp/zeroTrust/access/applications/tools.ts b/src/generated/forge-mcp/zeroTrust/access/applications/tools.ts
index d8221041..66c7e08d 100644
--- a/src/generated/forge-mcp/zeroTrust/access/applications/tools.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/applications/tools.ts
@@ -75,6 +75,7 @@ import {
   access_oidc_claim_rule_output,
   access_okta_group_rule_okta_output,
   access_okta_group_rule_output,
+  access_policy_resolution_account_id_output,
   access_purpose_justification_prompt_output,
   access_purpose_justification_required_output,
   access_rdp_clipboard_format_output,
@@ -148,6 +149,7 @@ import {
   access_okta_group_rule,
   access_okta_group_rule_okta,
   access_policy_req,
+  access_policy_resolution_account_id,
   access_purpose_justification_prompt,
   access_purpose_justification_required,
   access_rdp_clipboard_format,
@@ -505,6 +507,7 @@ export const tools: readonly Tool[] = [
         "access_options_preflight_bypass": access_options_preflight_bypass,
         "access_path_cookie_attribute": access_path_cookie_attribute,
         "access_policy_req": access_policy_req,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id,
         "access_precedence": access_precedence,
         "access_protocol_infra_app": access_protocol_infra_app,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app,
@@ -676,6 +679,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -871,6 +875,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -1154,6 +1159,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -1350,6 +1356,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -1615,6 +1622,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -1843,6 +1851,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -2139,6 +2148,7 @@ export const tools: readonly Tool[] = [
         "access_options_preflight_bypass": access_options_preflight_bypass,
         "access_path_cookie_attribute": access_path_cookie_attribute,
         "access_policy_req": access_policy_req,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id,
         "access_precedence": access_precedence,
         "access_protocol_infra_app": access_protocol_infra_app,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app,
@@ -2310,6 +2320,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
@@ -2505,6 +2516,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule_okta": access_okta_group_rule_okta_output,
         "access_options_preflight_bypass": access_options_preflight_bypass_output,
         "access_path_cookie_attribute": access_path_cookie_attribute_output,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id_output,
         "access_precedence": access_precedence_output,
         "access_protocol_infra_app": access_protocol_infra_app_output,
         "access_protocol_self_hosted_app": access_protocol_self_hosted_app_output,
diff --git a/src/generated/forge-mcp/zeroTrust/access/outputs.ts b/src/generated/forge-mcp/zeroTrust/access/outputs.ts
index 40761986..da9f723a 100644
--- a/src/generated/forge-mcp/zeroTrust/access/outputs.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/outputs.ts
@@ -868,6 +868,13 @@ export const access_okta_group_rule_okta_output: JsonSchema = {
   "type": "object"
 };
 
+/**
+ * The schema of `access_policy_resolution_account_id` in responses.
+ */
+export const access_policy_resolution_account_id_output: JsonSchema = {
+  "type": "string"
+};
+
 /**
  * The schema of `access_purpose_justification_prompt` in responses.
  */
diff --git a/src/generated/forge-mcp/zeroTrust/access/policies/tools.ts b/src/generated/forge-mcp/zeroTrust/access/policies/tools.ts
index 436135d2..0358fcc4 100644
--- a/src/generated/forge-mcp/zeroTrust/access/policies/tools.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/policies/tools.ts
@@ -83,6 +83,7 @@ import {
   access_okta_group_rule,
   access_okta_group_rule_okta,
   access_policy_req,
+  access_policy_resolution_account_id,
   access_purpose_justification_prompt,
   access_purpose_justification_required,
   access_rdp_clipboard_format,
@@ -184,6 +185,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule": access_okta_group_rule,
         "access_okta_group_rule_okta": access_okta_group_rule_okta,
         "access_policy_req": access_policy_req,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id,
         "access_purpose_justification_prompt": access_purpose_justification_prompt,
         "access_purpose_justification_required": access_purpose_justification_required,
         "access_rdp_clipboard_format": access_rdp_clipboard_format,
@@ -675,6 +677,7 @@ export const tools: readonly Tool[] = [
         "access_okta_group_rule": access_okta_group_rule,
         "access_okta_group_rule_okta": access_okta_group_rule_okta,
         "access_policy_req": access_policy_req,
+        "access_policy_resolution_account_id": access_policy_resolution_account_id,
         "access_purpose_justification_prompt": access_purpose_justification_prompt,
         "access_purpose_justification_required": access_purpose_justification_required,
         "access_rdp_clipboard_format": access_rdp_clipboard_format,
diff --git a/src/generated/forge-mcp/zeroTrust/access/schemas.ts b/src/generated/forge-mcp/zeroTrust/access/schemas.ts
index c262cc05..d9842705 100644
--- a/src/generated/forge-mcp/zeroTrust/access/schemas.ts
+++ b/src/generated/forge-mcp/zeroTrust/access/schemas.ts
@@ -255,6 +255,10 @@ export const access_base_policy_req: JsonSchema = {
       "$ref": "#/$defs/access_name-9",
       "description": "The name of the Access policy."
     },
+    "policy_resolution_account_id": {
+      "$ref": "#/$defs/access_policy_resolution_account_id",
+      "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy."
+    },
     "require": {
       "$ref": "#/$defs/access_require-2",
       "default": [],
@@ -1028,6 +1032,14 @@ export const access_policy_req: JsonSchema = {
   ]
 };
 
+/**
+ * The schema of `access_policy_resolution_account_id`.
+ */
+export const access_policy_resolution_account_id: JsonSchema = {
+  "description": "The account ID used to resolve policy resources and identity for cross-account WARP authentication. The account must be trusted by the account that owns this policy.",
+  "type": "string"
+};
+
 /**
  * The schema of `access_purpose_justification_prompt`.
  */
diff --git a/src/generated/forge-mcp/zeroTrust/organization/trustSettings/outputs.ts b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/outputs.ts
new file mode 100644
index 00000000..2a191103
--- /dev/null
+++ b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/outputs.ts
@@ -0,0 +1,21 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import type { JsonSchema } from "../../../_/tool.js";
+
+/**
+ * The schema of `access_grant_trust_to_all_accounts_in_org` in responses.
+ */
+export const access_grant_trust_to_all_accounts_in_org_output: JsonSchema = {
+  "type": "boolean"
+};
+
+/**
+ * The schema of `access_trusting_accounts` in responses.
+ */
+export const access_trusting_accounts_output: JsonSchema = {
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+};
diff --git a/src/generated/forge-mcp/zeroTrust/organization/trustSettings/schemas.ts b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/schemas.ts
new file mode 100644
index 00000000..d7bdd25c
--- /dev/null
+++ b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/schemas.ts
@@ -0,0 +1,23 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import type { JsonSchema } from "../../../_/tool.js";
+
+/**
+ * The schema of `access_grant_trust_to_all_accounts_in_org`.
+ */
+export const access_grant_trust_to_all_accounts_in_org: JsonSchema = {
+  "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources.",
+  "type": "boolean"
+};
+
+/**
+ * The schema of `access_trusting_accounts`.
+ */
+export const access_trusting_accounts: JsonSchema = {
+  "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty.",
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+};
diff --git a/src/generated/forge-mcp/zeroTrust/organization/trustSettings/tools.ts b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/tools.ts
new file mode 100644
index 00000000..981289dd
--- /dev/null
+++ b/src/generated/forge-mcp/zeroTrust/organization/trustSettings/tools.ts
@@ -0,0 +1,302 @@
+// Code generated by forge. DO NOT EDIT.
+/* eslint-disable */
+
+import { type Tool, pathParam } from "../../../_/tool.js";
+import {
+  access_api_response_common_failure_output,
+  access_messages_output,
+} from "../../outputs.js";
+import {
+  access_grant_trust_to_all_accounts_in_org_output,
+  access_trusting_accounts_output,
+} from "./outputs.js";
+import {
+  access_grant_trust_to_all_accounts_in_org,
+  access_trusting_accounts,
+} from "./schemas.js";
+
+/**
+ * The tools of `zero_trust.organization.trust_settings`.
+ */
+export const tools: readonly Tool[] = [
+  {
+    name: "zero_trust_organization_trust_settings_get",
+    title: "Get Zero Trust organization trust settings",
+    description: "Returns the trust settings for your Zero Trust organization.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_id": {
+          "description": "Identifier.",
+          "type": "string"
+        }
+      },
+      required: [
+        "account_id"
+      ],
+    },
+    outputSchema: {
+      "properties": {
+        "grant_trust_to_all_accounts_in_org": {
+          "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+        },
+        "trusting_accounts": {
+          "$ref": "#/$defs/access_trusting_accounts"
+        }
+      },
+      "required": [
+        "grant_trust_to_all_accounts_in_org"
+      ],
+      "type": "object",
+      $defs: {
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": true,
+      "title": "Get Zero Trust organization trust settings"
+    },
+    method: "GET",
+    path: "/accounts/{account_id}/access/organizations/trust_settings",
+    extensions: {
+      "x-api-token-group": [
+        "Access: Organizations, Identity Providers, and Groups Revoke",
+        "Access: Organizations, Identity Providers, and Groups Write",
+        "Access: Organizations, Identity Providers, and Groups Read"
+      ]
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "properties": {
+            "grant_trust_to_all_accounts_in_org": {
+              "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+            },
+            "trusting_accounts": {
+              "$ref": "#/$defs/access_trusting_accounts"
+            }
+          },
+          "required": [
+            "grant_trust_to_all_accounts_in_org"
+          ],
+          "type": "object"
+        },
+        "4XX": {
+          "$ref": "#/$defs/access_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "access_api-response-common-failure": access_api_response_common_failure_output,
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_messages": access_messages_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    request: (args) => ({
+      path: `/accounts/${pathParam(args, "account_id")}/access/organizations/trust_settings`,
+    }),
+  },
+  {
+    name: "zero_trust_organization_trust_settings_replace",
+    title: "Replace Zero Trust organization trust settings",
+    description: "Replaces the trust settings for your Zero Trust organization.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_id": {
+          "description": "Identifier.",
+          "type": "string"
+        },
+        "body": {
+          "properties": {
+            "grant_trust_to_all_accounts_in_org": {
+              "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org",
+              "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources."
+            },
+            "trusting_accounts": {
+              "$ref": "#/$defs/access_trusting_accounts",
+              "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty."
+            }
+          },
+          "required": [
+            "grant_trust_to_all_accounts_in_org"
+          ],
+          "type": "object"
+        }
+      },
+      required: [
+        "account_id",
+        "body"
+      ],
+      $defs: {
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org,
+        "access_trusting_accounts": access_trusting_accounts,
+      },
+    },
+    outputSchema: {
+      "properties": {
+        "grant_trust_to_all_accounts_in_org": {
+          "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+        },
+        "trusting_accounts": {
+          "$ref": "#/$defs/access_trusting_accounts"
+        }
+      },
+      "required": [
+        "grant_trust_to_all_accounts_in_org"
+      ],
+      "type": "object",
+      $defs: {
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": true,
+      "idempotentHint": true,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Replace Zero Trust organization trust settings"
+    },
+    method: "PUT",
+    path: "/accounts/{account_id}/access/organizations/trust_settings",
+    extensions: {
+      "x-api-token-group": [
+        "Access: Organizations, Identity Providers, and Groups Write"
+      ]
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "properties": {
+            "grant_trust_to_all_accounts_in_org": {
+              "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+            },
+            "trusting_accounts": {
+              "$ref": "#/$defs/access_trusting_accounts"
+            }
+          },
+          "required": [
+            "grant_trust_to_all_accounts_in_org"
+          ],
+          "type": "object"
+        },
+        "4XX": {
+          "$ref": "#/$defs/access_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "access_api-response-common-failure": access_api_response_common_failure_output,
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_messages": access_messages_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    request: (args) => ({
+      path: `/accounts/${pathParam(args, "account_id")}/access/organizations/trust_settings`,
+      body: { value: args["body"], mediaType: "application/json" },
+    }),
+  },
+  {
+    name: "zero_trust_organization_trust_settings_update",
+    title: "Update Zero Trust organization trust settings",
+    description: "Updates the trust settings for your Zero Trust organization.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        "account_id": {
+          "description": "Identifier.",
+          "type": "string"
+        },
+        "body": {
+          "properties": {
+            "grant_trust_to_all_accounts_in_org": {
+              "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org",
+              "description": "Whether all accounts in the organization are trusted to use this account's cross-account Access resources."
+            },
+            "trusting_accounts": {
+              "$ref": "#/$defs/access_trusting_accounts",
+              "description": "Explicit account IDs trusted to use this account's cross-account Access resources. At most 100 unique valid account IDs are accepted. Omitted from responses when empty."
+            }
+          },
+          "type": "object"
+        }
+      },
+      required: [
+        "account_id",
+        "body"
+      ],
+      $defs: {
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org,
+        "access_trusting_accounts": access_trusting_accounts,
+      },
+    },
+    outputSchema: {
+      "properties": {
+        "grant_trust_to_all_accounts_in_org": {
+          "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+        },
+        "trusting_accounts": {
+          "$ref": "#/$defs/access_trusting_accounts"
+        }
+      },
+      "required": [
+        "grant_trust_to_all_accounts_in_org"
+      ],
+      "type": "object",
+      $defs: {
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    annotations: {
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": true,
+      "readOnlyHint": false,
+      "title": "Update Zero Trust organization trust settings"
+    },
+    method: "PATCH",
+    path: "/accounts/{account_id}/access/organizations/trust_settings",
+    extensions: {
+      "x-api-token-group": [
+        "Access: Organizations, Identity Providers, and Groups Write"
+      ]
+    },
+    responses: {
+      schemas: {
+        "200": {
+          "properties": {
+            "grant_trust_to_all_accounts_in_org": {
+              "$ref": "#/$defs/access_grant_trust_to_all_accounts_in_org"
+            },
+            "trusting_accounts": {
+              "$ref": "#/$defs/access_trusting_accounts"
+            }
+          },
+          "required": [
+            "grant_trust_to_all_accounts_in_org"
+          ],
+          "type": "object"
+        },
+        "4XX": {
+          "$ref": "#/$defs/access_api-response-common-failure"
+        }
+      },
+      $defs: {
+        "access_api-response-common-failure": access_api_response_common_failure_output,
+        "access_grant_trust_to_all_accounts_in_org": access_grant_trust_to_all_accounts_in_org_output,
+        "access_messages": access_messages_output,
+        "access_trusting_accounts": access_trusting_accounts_output,
+      },
+    },
+    request: (args) => ({
+      path: `/accounts/${pathParam(args, "account_id")}/access/organizations/trust_settings`,
+      body: { value: args["body"], mediaType: "application/json" },
+    }),
+  },
+];

From 012bc7d550eff09faa43536e0ddd04a263a7dbe4 Mon Sep 17 00:00:00 2001
From: Matt Carey <mcarey@cloudflare.com>
Date: Wed, 28 Oct 2026 09:57:55 +0000
Subject: [PATCH 4/4] chore(forge): pin forge 580804f

---
 forge.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/forge.json b/forge.json
index f193541f..f8b797cb 100644
--- a/forge.json
+++ b/forge.json
@@ -1,5 +1,5 @@
 {
   "$comment": "The forge that generates src/generated/forge-mcp: a commit of cloudflare/forge. Bump ref to pick up generator changes; CI builds it.",
   "repository": "cloudflare/forge",
-  "ref": "6de519b55a32581a7905dc358f4b256904c2d2c1"
+  "ref": "580804fccf9c3f04d0449d2bc22506a2f2a8e419"
 }