cloudflare 6.4.0 → 6.5.0

package/resources/zero-trust/access/applications/applications.d.ts

@@ -9,7 +9,7 @@ import { AccessDevicePostureRule, AccessRule, AnyValidServiceTokenRule, Authenti
 import * as SettingsAPI from "./settings.js";
 import { SettingEditParams, SettingEditResponse, SettingUpdateParams, SettingUpdateResponse, Settings } from "./settings.js";
 import * as UserPolicyChecksAPI from "./user-policy-checks.js";
-import { UserPolicyCheckGeo, UserPolicyCheckListParams, UserPolicyCheckListResponse, UserPolicyChecks } from "./user-policy-checks.js";
+import { UserPolicyCheckListParams, UserPolicyCheckListResponse, UserPolicyChecks } from "./user-policy-checks.js";
 import * as PolicyTestsAPI from "./policy-tests/policy-tests.js";
 import { PolicyTestCreateParams, PolicyTestCreateResponse, PolicyTestGetParams, PolicyTestGetResponse, PolicyTests } from "./policy-tests/policy-tests.js";
 import { V4PagePaginationArray, type V4PagePaginationArrayParams } from "../../../../pagination.js";
@@ -181,6 +181,13 @@ export declare namespace Application {
          * application.
          */
         custom_deny_url?: string;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -213,7 +220,7 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: SelfHostedApplication.SCIMConfig;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -273,6 +280,111 @@ export declare namespace Application {
              */
             max_age?: number;
         }
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
     }
     interface SaaSApplication {
         /**
@@ -306,12 +418,12 @@ export declare namespace Application {
          * The name of the application.
          */
         name?: string;
-        saas_app?: SaaSApplication.AccessSchemasSAMLSaaSApp | SaaSApplication.AccessSchemasOIDCSaaSApp;
+        saas_app?: SaaSApplication.AccessSAMLSaaSApp2 | SaaSApplication.AccessOIDCSaaSApp2;
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: SaaSApplication.SCIMConfig;
         /**
          * The application type.
          */
@@ -319,7 +431,7 @@ export declare namespace Application {
         updated_at?: string;
     }
     namespace SaaSApplication {
-        interface AccessSchemasSAMLSaaSApp {
+        interface AccessSAMLSaaSApp2 {
             /**
              * Optional identifier indicating the authentication protocol used for the saas
              * app. Required for OIDC. Default if unset is "saml"
@@ -331,7 +443,7 @@ export declare namespace Application {
              */
             consumer_service_url?: string;
             created_at?: string;
-            custom_attributes?: Array<AccessSchemasSAMLSaaSApp.CustomAttribute>;
+            custom_attributes?: Array<AccessSAMLSaaSApp2.CustomAttribute>;
             /**
              * The unique identifier for your SaaS application.
              */
@@ -361,7 +473,7 @@ export declare namespace Application {
             sso_endpoint?: string;
             updated_at?: string;
         }
-        namespace AccessSchemasSAMLSaaSApp {
+        namespace AccessSAMLSaaSApp2 {
             interface CustomAttribute {
                 /**
                  * The SAML FriendlyName of the attribute.
@@ -396,7 +508,7 @@ export declare namespace Application {
                 }
             }
         }
-        interface AccessSchemasOIDCSaaSApp {
+        interface AccessOIDCSaaSApp2 {
             /**
              * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
              * be greater than or equal to 1m and less than or equal to 24h.
@@ -425,7 +537,7 @@ export declare namespace Application {
              */
             client_secret?: string;
             created_at?: string;
-            custom_claims?: Array<AccessSchemasOIDCSaaSApp.CustomClaim>;
+            custom_claims?: Array<AccessOIDCSaaSApp2.CustomClaim>;
             /**
              * The OIDC flows supported by this application
              */
@@ -434,7 +546,7 @@ export declare namespace Application {
              * A regex to filter Cloudflare groups returned in ID token and userinfo endpoint.
              */
             group_filter_regex?: string;
-            hybrid_and_implicit_options?: AccessSchemasOIDCSaaSApp.HybridAndImplicitOptions;
+            hybrid_and_implicit_options?: AccessOIDCSaaSApp2.HybridAndImplicitOptions;
             /**
              * The Access public certificate that will be used to verify your identity.
              */
@@ -444,7 +556,7 @@ export declare namespace Application {
              * tokens
              */
             redirect_uris?: Array<string>;
-            refresh_token_options?: AccessSchemasOIDCSaaSApp.RefreshTokenOptions;
+            refresh_token_options?: AccessOIDCSaaSApp2.RefreshTokenOptions;
             /**
              * Define the user information shared with access, "offline_access" scope will be
              * automatically enabled if refresh tokens are enabled
@@ -452,7 +564,7 @@ export declare namespace Application {
             scopes?: Array<'openid' | 'groups' | 'email' | 'profile'>;
             updated_at?: string;
         }
-        namespace AccessSchemasOIDCSaaSApp {
+        namespace AccessOIDCSaaSApp2 {
             interface CustomClaim {
                 /**
                  * The name of the claim.
@@ -510,6 +622,111 @@ export declare namespace Application {
                 lifetime?: string;
             }
         }
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
     }
     interface BrowserSSHApplication {
         /**
@@ -558,6 +775,13 @@ export declare namespace Application {
          * application.
          */
         custom_deny_url?: string;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -590,7 +814,7 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: BrowserSSHApplication.SCIMConfig;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -650,73 +874,185 @@ export declare namespace Application {
              */
             max_age?: number;
         }
-    }
-    interface BrowserVNCApplication {
-        /**
-         * The domain and path that Access will secure.
-         */
-        domain: string;
-        /**
-         * The application type.
-         */
-        type: string;
-        /**
-         * UUID.
-         */
-        id?: string;
-        /**
-         * Enables loading application content in an iFrame.
-         */
-        allow_iframe?: boolean;
-        /**
-         * The identity providers your users can select when connecting to this
-         * application. Defaults to all IdPs configured in your account.
-         */
-        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
-        /**
-         * Displays the application in the App Launcher.
-         */
-        app_launcher_visible?: boolean;
-        /**
-         * Audience tag.
-         */
-        aud?: string;
-        /**
-         * When set to `true`, users skip the identity provider selection step during
-         * login. You must specify only one identity provider in allowed_idps.
-         */
-        auto_redirect_to_identity?: boolean;
-        cors_headers?: BrowserVNCApplication.CORSHeaders;
-        created_at?: string;
-        /**
-         * The custom error message shown to a user when they are denied access to the
-         * application.
-         */
-        custom_deny_message?: string;
-        /**
-         * The custom URL a user is redirected to when they are denied access to the
-         * application.
-         */
-        custom_deny_url?: string;
-        /**
-         * Enables the binding cookie, which increases security against compromised
-         * authorization tokens and CSRF attacks.
-         */
-        enable_binding_cookie?: boolean;
-        /**
-         * Enables the HttpOnly cookie attribute, which increases security against XSS
-         * attacks.
-         */
-        http_only_cookie_attribute?: boolean;
-        /**
-         * The image URL for the logo shown in the App Launcher dashboard.
-         */
-        logo_url?: string;
         /**
-         * The name of the application.
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
          */
-        name?: string;
-        /**
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
+    interface BrowserVNCApplication {
+        /**
+         * The domain and path that Access will secure.
+         */
+        domain: string;
+        /**
+         * The application type.
+         */
+        type: string;
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * Enables loading application content in an iFrame.
+         */
+        allow_iframe?: boolean;
+        /**
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+        /**
+         * Displays the application in the App Launcher.
+         */
+        app_launcher_visible?: boolean;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        cors_headers?: BrowserVNCApplication.CORSHeaders;
+        created_at?: string;
+        /**
+         * The custom error message shown to a user when they are denied access to the
+         * application.
+         */
+        custom_deny_message?: string;
+        /**
+         * The custom URL a user is redirected to when they are denied access to the
+         * application.
+         */
+        custom_deny_url?: string;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
+        /**
+         * Enables the binding cookie, which increases security against compromised
+         * authorization tokens and CSRF attacks.
+         */
+        enable_binding_cookie?: boolean;
+        /**
+         * Enables the HttpOnly cookie attribute, which increases security against XSS
+         * attacks.
+         */
+        http_only_cookie_attribute?: boolean;
+        /**
+         * The image URL for the logo shown in the App Launcher dashboard.
+         */
+        logo_url?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
          * Allows options preflight requests to bypass Access authentication and go
          * directly to the origin. Cannot turn on if cors_headers is set.
          */
@@ -730,7 +1066,7 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: BrowserVNCApplication.SCIMConfig;
         /**
          * Returns a 401 status code when the request is blocked by a Service Auth policy.
          */
@@ -784,14 +1120,271 @@ export declare namespace Application {
             /**
              * Allowed origins.
              */
-            allowed_origins?: Array<unknown>;
+            allowed_origins?: Array<unknown>;
+            /**
+             * The maximum number of seconds the results of a preflight request can be cached.
+             */
+            max_age?: number;
+        }
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
+    interface AppLauncherApplication {
+        /**
+         * The application type.
+         */
+        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
+        /**
+         * UUID.
+         */
+        id?: string;
+        /**
+         * The identity providers your users can select when connecting to this
+         * application. Defaults to all IdPs configured in your account.
+         */
+        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+        /**
+         * Audience tag.
+         */
+        aud?: string;
+        /**
+         * When set to `true`, users skip the identity provider selection step during
+         * login. You must specify only one identity provider in allowed_idps.
+         */
+        auto_redirect_to_identity?: boolean;
+        created_at?: string;
+        /**
+         * The domain and path that Access will secure.
+         */
+        domain?: string;
+        /**
+         * The name of the application.
+         */
+        name?: string;
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        scim_config?: AppLauncherApplication.SCIMConfig;
+        /**
+         * The amount of time that tokens issued for this application will be valid. Must
+         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+         * s, m, h.
+         */
+        session_duration?: string;
+        updated_at?: string;
+    }
+    namespace AppLauncherApplication {
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
             /**
-             * The maximum number of seconds the results of a preflight request can be cached.
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
              */
-            max_age?: number;
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
         }
     }
-    interface AppLauncherApplication {
+    interface DeviceEnrollmentPermissionsApplication {
         /**
          * The application type.
          */
@@ -827,7 +1420,7 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: DeviceEnrollmentPermissionsApplication.SCIMConfig;
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
@@ -836,50 +1429,112 @@ export declare namespace Application {
         session_duration?: string;
         updated_at?: string;
     }
-    interface DeviceEnrollmentPermissionsApplication {
-        /**
-         * The application type.
-         */
-        type: 'self_hosted' | 'saas' | 'ssh' | 'vnc' | 'app_launcher' | 'warp' | 'biso' | 'bookmark' | 'dash_sso';
-        /**
-         * UUID.
-         */
-        id?: string;
-        /**
-         * The identity providers your users can select when connecting to this
-         * application. Defaults to all IdPs configured in your account.
-         */
-        allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
-        /**
-         * Audience tag.
-         */
-        aud?: string;
-        /**
-         * When set to `true`, users skip the identity provider selection step during
-         * login. You must specify only one identity provider in allowed_idps.
-         */
-        auto_redirect_to_identity?: boolean;
-        created_at?: string;
-        /**
-         * The domain and path that Access will secure.
-         */
-        domain?: string;
-        /**
-         * The name of the application.
-         */
-        name?: string;
+    namespace DeviceEnrollmentPermissionsApplication {
         /**
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
-        /**
-         * The amount of time that tokens issued for this application will be valid. Must
-         * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-         * s, m, h.
-         */
-        session_duration?: string;
-        updated_at?: string;
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
     }
     interface BrowserIsolationPermissionsApplication {
         /**
@@ -917,7 +1572,7 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: BrowserIsolationPermissionsApplication.SCIMConfig;
         /**
          * The amount of time that tokens issued for this application will be valid. Must
          * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
@@ -926,6 +1581,113 @@ export declare namespace Application {
         session_duration?: string;
         updated_at?: string;
     }
+    namespace BrowserIsolationPermissionsApplication {
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
     interface BookmarkApplication {
         /**
          * The URL or domain of the bookmark.
@@ -957,9 +1719,116 @@ export declare namespace Application {
          * Configuration for provisioning to this application via SCIM. This is currently
          * in closed beta.
          */
-        scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+        scim_config?: BookmarkApplication.SCIMConfig;
         updated_at?: string;
     }
+    namespace BookmarkApplication {
+        /**
+         * Configuration for provisioning to this application via SCIM. This is currently
+         * in closed beta.
+         */
+        interface SCIMConfig {
+            /**
+             * The UID of the IdP to use as the source for SCIM resources to provision to this
+             * application.
+             */
+            idp_uid: string;
+            /**
+             * The base URI for the application's SCIM-compatible API.
+             */
+            remote_uri: string;
+            /**
+             * Attributes for configuring HTTP Basic authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            authentication?: ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2 | ApplicationsAPI.SCIMConfigAuthenticationOauth2 | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
+            /**
+             * If false, we propagate DELETE requests to the target application for SCIM
+             * resources. If true, we only set `active` to false on the SCIM resource. This is
+             * useful because some targets do not support DELETE operations.
+             */
+            deactivate_on_delete?: boolean;
+            /**
+             * Whether SCIM provisioning is turned on for this application.
+             */
+            enabled?: boolean;
+            /**
+             * A list of mappings to apply to SCIM resources before provisioning them in this
+             * application. These can transform or filter the resources to be provisioned.
+             */
+            mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+        }
+        namespace SCIMConfig {
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+            /**
+             * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+                /**
+                 * Token used to authenticate with the remote SCIM service.
+                 */
+                token: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'oauthbearertoken';
+            }
+            /**
+             * Attributes for configuring Access Service Token authentication scheme for SCIM
+             * provisioning to an application.
+             */
+            interface AccessSCIMConfigAuthenticationAccessServiceToken {
+                /**
+                 * Client ID of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_id: string;
+                /**
+                 * Client secret of the Access service token used to authenticate with the remote
+                 * service.
+                 */
+                client_secret: string;
+                /**
+                 * The authentication scheme to use when making SCIM requests to this application.
+                 */
+                scheme: 'access_service_token';
+            }
+        }
+    }
 }
 export interface ApplicationPolicy {
     /**
@@ -1077,111 +1946,6 @@ export declare namespace ApplicationPolicy {
         session_duration?: string;
     }
 }
-/**
- * Configuration for provisioning to this application via SCIM. This is currently
- * in closed beta.
- */
-export interface ApplicationSCIMConfig {
-    /**
-     * The UID of the IdP to use as the source for SCIM resources to provision to this
-     * application.
-     */
-    idp_uid: string;
-    /**
-     * The base URI for the application's SCIM-compatible API.
-     */
-    remote_uri: string;
-    /**
-     * Attributes for configuring HTTP Basic authentication scheme for SCIM
-     * provisioning to an application.
-     */
-    authentication?: SCIMConfigAuthenticationHTTPBasic | ApplicationSCIMConfig.AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | ApplicationSCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken | Array<SCIMConfigAuthenticationHTTPBasic | ApplicationSCIMConfig.AccessSchemasSCIMConfigAuthenticationOAuthBearerToken | SCIMConfigAuthenticationOauth2 | ApplicationSCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken>;
-    /**
-     * If false, we propagate DELETE requests to the target application for SCIM
-     * resources. If true, we only set `active` to false on the SCIM resource. This is
-     * useful because some targets do not support DELETE operations.
-     */
-    deactivate_on_delete?: boolean;
-    /**
-     * Whether SCIM provisioning is turned on for this application.
-     */
-    enabled?: boolean;
-    /**
-     * A list of mappings to apply to SCIM resources before provisioning them in this
-     * application. These can transform or filter the resources to be provisioned.
-     */
-    mappings?: Array<SCIMConfigMapping>;
-}
-export declare namespace ApplicationSCIMConfig {
-    /**
-     * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
-     * provisioning to an application.
-     */
-    interface AccessSchemasSCIMConfigAuthenticationOAuthBearerToken {
-        /**
-         * Token used to authenticate with the remote SCIM service.
-         */
-        token: string;
-        /**
-         * The authentication scheme to use when making SCIM requests to this application.
-         */
-        scheme: 'oauthbearertoken';
-    }
-    /**
-     * Attributes for configuring Access Service Token authentication scheme for SCIM
-     * provisioning to an application.
-     */
-    interface AccessSCIMConfigAuthenticationAccessServiceToken {
-        /**
-         * Client ID of the Access service token used to authenticate with the remote
-         * service.
-         */
-        client_id: string;
-        /**
-         * Client secret of the Access service token used to authenticate with the remote
-         * service.
-         */
-        client_secret: string;
-        /**
-         * The authentication scheme to use when making SCIM requests to this application.
-         */
-        scheme: 'access_service_token';
-    }
-    /**
-     * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
-     * provisioning to an application.
-     */
-    interface AccessSchemasSCIMConfigAuthenticationOAuthBearerToken {
-        /**
-         * Token used to authenticate with the remote SCIM service.
-         */
-        token: string;
-        /**
-         * The authentication scheme to use when making SCIM requests to this application.
-         */
-        scheme: 'oauthbearertoken';
-    }
-    /**
-     * Attributes for configuring Access Service Token authentication scheme for SCIM
-     * provisioning to an application.
-     */
-    interface AccessSCIMConfigAuthenticationAccessServiceToken {
-        /**
-         * Client ID of the Access service token used to authenticate with the remote
-         * service.
-         */
-        client_id: string;
-        /**
-         * Client secret of the Access service token used to authenticate with the remote
-         * service.
-         */
-        client_secret: string;
-        /**
-         * The authentication scheme to use when making SCIM requests to this application.
-         */
-        scheme: 'access_service_token';
-    }
-}
 /**
  * The application type.
  */
@@ -1996,7 +2760,14 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2142,6 +2913,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -2742,7 +3561,14 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -2888,6 +3714,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -3236,7 +4110,14 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -3382,6 +4263,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -4703,9 +5632,9 @@ export declare namespace ApplicationCreateResponse {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -4788,7 +5717,14 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -4951,6 +5887,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -5285,7 +6269,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Enables the HttpOnly cookie attribute, which increases security against XSS
          * attacks.
@@ -5385,6 +6369,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -5700,7 +6732,7 @@ export declare namespace ApplicationCreateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * The primary hostname and path secured by Access. This domain will be displayed
          * if the app is visible in the App Launcher.
@@ -5805,6 +6837,54 @@ export declare namespace ApplicationCreateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -6137,7 +7217,14 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -6276,12 +7363,60 @@ export declare namespace ApplicationUpdateResponse {
          * A MCP server id configured in ai-controls. Access will secure the MCP server if
          * accessed through a MCP portal.
          */
-        interface ViaMcpServerPortalDestination {
+        interface ViaMcpServerPortalDestination {
+            /**
+             * The MCP server id configured in ai-controls.
+             */
+            mcp_server_id?: string;
+            type?: 'via_mcp_server_portal';
+        }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
             /**
-             * The MCP server id configured in ai-controls.
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
              */
-            mcp_server_id?: string;
-            type?: 'via_mcp_server_portal';
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
         }
         /**
          * Configures multi-factor authentication (MFA) settings.
@@ -6883,7 +8018,14 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -7029,6 +8171,54 @@ export declare namespace ApplicationUpdateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -7377,7 +8567,14 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -7523,6 +8720,54 @@ export declare namespace ApplicationUpdateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -8844,9 +10089,9 @@ export declare namespace ApplicationUpdateResponse {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -8929,7 +10174,14 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -9092,6 +10344,54 @@ export declare namespace ApplicationUpdateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -9426,7 +10726,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Enables the HttpOnly cookie attribute, which increases security against XSS
          * attacks.
@@ -9526,6 +10826,54 @@ export declare namespace ApplicationUpdateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -9841,7 +11189,7 @@ export declare namespace ApplicationUpdateResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * The primary hostname and path secured by Access. This domain will be displayed
          * if the app is visible in the App Launcher.
@@ -9946,6 +11294,54 @@ export declare namespace ApplicationUpdateResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -10278,7 +11674,14 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -10424,6 +11827,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -11024,7 +12475,14 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -11170,6 +12628,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -11518,7 +13024,14 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -11664,6 +13177,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -12985,9 +14546,9 @@ export declare namespace ApplicationListResponse {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -13070,7 +14631,14 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -13233,6 +14801,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -13567,7 +15183,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Enables the HttpOnly cookie attribute, which increases security against XSS
          * attacks.
@@ -13667,6 +15283,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -13982,7 +15646,7 @@ export declare namespace ApplicationListResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * The primary hostname and path secured by Access. This domain will be displayed
          * if the app is visible in the App Launcher.
@@ -14087,6 +15751,54 @@ export declare namespace ApplicationListResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -14425,7 +16137,14 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -14571,6 +16290,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -15171,7 +16938,14 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -15317,6 +17091,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -15665,7 +17487,14 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -15811,6 +17640,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -17132,9 +19009,9 @@ export declare namespace ApplicationGetResponse {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -17217,7 +19094,14 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Enables the binding cookie, which increases security against compromised
          * authorization tokens and CSRF attacks.
@@ -17380,6 +19264,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -17714,7 +19646,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Enables the HttpOnly cookie attribute, which increases security against XSS
          * attacks.
@@ -17814,6 +19746,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -18129,7 +20109,7 @@ export declare namespace ApplicationGetResponse {
          * allow for more flexibility in defining different types of domains. If
          * `destinations` are provided, then `self_hosted_domains` will be ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * The primary hostname and path secured by Access. This domain will be displayed
          * if the app is visible in the App Launcher.
@@ -18234,6 +20214,54 @@ export declare namespace ApplicationGetResponse {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -18574,7 +20602,14 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -18727,6 +20762,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -19322,7 +21405,14 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -19475,6 +21565,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -19818,7 +21956,14 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -19971,6 +22116,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -21240,9 +23433,9 @@ export declare namespace ApplicationCreateParams {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -21335,7 +23528,14 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -21505,6 +23705,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -21831,7 +24079,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Body param: Enables the HttpOnly cookie attribute, which increases security
          * against XSS attacks.
@@ -21937,6 +24185,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -22244,7 +24540,7 @@ export declare namespace ApplicationCreateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * Body param: The primary hostname and path secured by Access. This domain will be
          * displayed if the app is visible in the App Launcher.
@@ -22355,6 +24651,54 @@ export declare namespace ApplicationCreateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -22682,7 +25026,14 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<SelfHostedApplication.PublicDestination | SelfHostedApplication.PrivateDestination | SelfHostedApplication.ViaMcpServerPortalDestination | SelfHostedApplication.WorkerDestination | SelfHostedApplication.PreviewWorkerDestination | SelfHostedApplication.AllWorkersDestination | SelfHostedApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -22835,6 +25186,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -23430,7 +25829,14 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserSSHApplication.PublicDestination | BrowserSSHApplication.PrivateDestination | BrowserSSHApplication.ViaMcpServerPortalDestination | BrowserSSHApplication.WorkerDestination | BrowserSSHApplication.PreviewWorkerDestination | BrowserSSHApplication.AllWorkersDestination | BrowserSSHApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -23583,6 +25989,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -23926,7 +26380,14 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserVNCApplication.PublicDestination | BrowserVNCApplication.PrivateDestination | BrowserVNCApplication.ViaMcpServerPortalDestination | BrowserVNCApplication.WorkerDestination | BrowserVNCApplication.PreviewWorkerDestination | BrowserVNCApplication.AllWorkersDestination | BrowserVNCApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -24079,6 +26540,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -25348,9 +27857,9 @@ export declare namespace ApplicationUpdateParams {
             interface MfaConfig {
                 /**
                  * Lists the MFA methods that users can authenticate with. For infrastructure
-                 * applications, only `ssh_piv_key` is supported.
+                 * applications, only `piv_key` is supported.
                  */
-                allowed_authenticators?: Array<'ssh_piv_key'>;
+                allowed_authenticators?: Array<'piv_key'>;
                 /**
                  * Indicates whether to disable MFA for this resource. This option is available at
                  * the application and policy level.
@@ -25443,7 +27952,14 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<BrowserRDPApplication.PublicDestination | BrowserRDPApplication.PrivateDestination | BrowserRDPApplication.ViaMcpServerPortalDestination | BrowserRDPApplication.WorkerDestination | BrowserRDPApplication.PreviewWorkerDestination | BrowserRDPApplication.AllWorkersDestination | BrowserRDPApplication.AllPreviewWorkersDestination>;
+        /**
+         * Body param: Preemptively sets the Access session cookie on every hostname in a
+         * multi-hostname self-hosted application during the initial redirect chain, rather
+         * than setting it lazily on first visit. Defaults to true. Set to false to disable
+         * the eager redirect cookie behavior.
+         */
+        eager_redirect_cookie_setting?: boolean;
         /**
          * Body param: Enables the binding cookie, which increases security against
          * compromised authorization tokens and CSRF attacks.
@@ -25613,6 +28129,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * Configures multi-factor authentication (MFA) settings.
          */
@@ -25939,7 +28503,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerApplication.PublicDestination | McpServerApplication.PrivateDestination | McpServerApplication.ViaMcpServerPortalDestination | McpServerApplication.WorkerDestination | McpServerApplication.PreviewWorkerDestination | McpServerApplication.AllWorkersDestination | McpServerApplication.AllPreviewWorkersDestination>;
         /**
          * Body param: Enables the HttpOnly cookie attribute, which increases security
          * against XSS attacks.
@@ -26045,6 +28609,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -26352,7 +28964,7 @@ export declare namespace ApplicationUpdateParams {
          * of domains. If `destinations` are provided, then `self_hosted_domains` will be
          * ignored.
          */
-        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination>;
+        destinations?: Array<McpServerPortalApplication.PublicDestination | McpServerPortalApplication.PrivateDestination | McpServerPortalApplication.ViaMcpServerPortalDestination | McpServerPortalApplication.WorkerDestination | McpServerPortalApplication.PreviewWorkerDestination | McpServerPortalApplication.AllWorkersDestination | McpServerPortalApplication.AllPreviewWorkersDestination>;
         /**
          * Body param: The primary hostname and path secured by Access. This domain will be
          * displayed if the app is visible in the App Launcher.
@@ -26463,6 +29075,54 @@ export declare namespace ApplicationUpdateParams {
             mcp_server_id?: string;
             type?: 'via_mcp_server_portal';
         }
+        /**
+         * A specific Cloudflare Worker that Access will secure. All requests routed to the
+         * specified Worker, including its preview deployments, will be protected. The
+         * `preview_worker` and `public` destination types takes precedence, so you can
+         * create separate applications to override the policies for the Worker's previews
+         * or specific paths.
+         */
+        interface WorkerDestination {
+            type: 'worker';
+            /**
+             * The ID of the Cloudflare Worker to protect with Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+         * requests routed to the preview deployments of the specified Worker will be
+         * protected. The `public` destination type takes precedence, so you can create
+         * separate applications to override the policies for specific paths.
+         */
+        interface PreviewWorkerDestination {
+            type: 'preview_worker';
+            /**
+             * The ID of the Cloudflare Worker whose preview deployments to protect with
+             * Access.
+             */
+            worker_id: string;
+        }
+        /**
+         * Protects all Cloudflare Workers on the account with Access, including their
+         * preview deployments. At most one destination of this type can exist per account.
+         * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+         * types take precedence, so you can create separate applications to override the
+         * policies for specific Workers, their previews, or specific paths.
+         */
+        interface AllWorkersDestination {
+            type: 'all_workers';
+        }
+        /**
+         * Protects the preview deployments of all Cloudflare Workers on the account with
+         * Access. At most one destination of this type can exist per account. The
+         * `worker`, `preview_worker`, and `public` destination types take precedence, so
+         * you can create separate applications to override the policies for specific
+         * Workers, their previews, or specific paths.
+         */
+        interface AllPreviewWorkersDestination {
+            type: 'all_preview_workers';
+        }
         /**
          * **Beta:** Optional configuration for managing an OAuth authorization flow
          * controlled by Access. When set, Access will act as the OAuth authorization
@@ -26781,9 +29441,9 @@ export interface ApplicationRevokeTokensParams {
     zone_id?: string;
 }
 export declare namespace Applications {
-    export { type AllowedHeaders as AllowedHeaders, type AllowedIdPs as AllowedIdPs, type AllowedMethods as AllowedMethods, type AllowedOrigins as AllowedOrigins, type AppID as AppID, type Application as Application, type ApplicationPolicy as ApplicationPolicy, type ApplicationSCIMConfig as ApplicationSCIMConfig, type ApplicationType as ApplicationType, type CORSHeaders as CORSHeaders, type Decision as Decision, type OIDCSaaSApp as OIDCSaaSApp, type SaaSAppNameIDFormat as SaaSAppNameIDFormat, type SAMLSaaSApp as SAMLSaaSApp, type SCIMConfigAuthenticationHTTPBasic as SCIMConfigAuthenticationHTTPBasic, type SCIMConfigAuthenticationOAuthBearerToken as SCIMConfigAuthenticationOAuthBearerToken, type SCIMConfigAuthenticationOauth2 as SCIMConfigAuthenticationOauth2, type SCIMConfigMapping as SCIMConfigMapping, type SelfHostedDomains as SelfHostedDomains, type ApplicationCreateResponse as ApplicationCreateResponse, type ApplicationUpdateResponse as ApplicationUpdateResponse, type ApplicationListResponse as ApplicationListResponse, type ApplicationDeleteResponse as ApplicationDeleteResponse, type ApplicationGetResponse as ApplicationGetResponse, type ApplicationRevokeTokensResponse as ApplicationRevokeTokensResponse, ApplicationListResponsesV4PagePaginationArray as ApplicationListResponsesV4PagePaginationArray, type ApplicationCreateParams as ApplicationCreateParams, type ApplicationUpdateParams as ApplicationUpdateParams, type ApplicationListParams as ApplicationListParams, type ApplicationDeleteParams as ApplicationDeleteParams, type ApplicationGetParams as ApplicationGetParams, type ApplicationRevokeTokensParams as ApplicationRevokeTokensParams, };
+    export { type AllowedHeaders as AllowedHeaders, type AllowedIdPs as AllowedIdPs, type AllowedMethods as AllowedMethods, type AllowedOrigins as AllowedOrigins, type AppID as AppID, type Application as Application, type ApplicationPolicy as ApplicationPolicy, type ApplicationType as ApplicationType, type CORSHeaders as CORSHeaders, type Decision as Decision, type OIDCSaaSApp as OIDCSaaSApp, type SaaSAppNameIDFormat as SaaSAppNameIDFormat, type SAMLSaaSApp as SAMLSaaSApp, type SCIMConfigAuthenticationHTTPBasic as SCIMConfigAuthenticationHTTPBasic, type SCIMConfigAuthenticationOAuthBearerToken as SCIMConfigAuthenticationOAuthBearerToken, type SCIMConfigAuthenticationOauth2 as SCIMConfigAuthenticationOauth2, type SCIMConfigMapping as SCIMConfigMapping, type SelfHostedDomains as SelfHostedDomains, type ApplicationCreateResponse as ApplicationCreateResponse, type ApplicationUpdateResponse as ApplicationUpdateResponse, type ApplicationListResponse as ApplicationListResponse, type ApplicationDeleteResponse as ApplicationDeleteResponse, type ApplicationGetResponse as ApplicationGetResponse, type ApplicationRevokeTokensResponse as ApplicationRevokeTokensResponse, ApplicationListResponsesV4PagePaginationArray as ApplicationListResponsesV4PagePaginationArray, type ApplicationCreateParams as ApplicationCreateParams, type ApplicationUpdateParams as ApplicationUpdateParams, type ApplicationListParams as ApplicationListParams, type ApplicationDeleteParams as ApplicationDeleteParams, type ApplicationGetParams as ApplicationGetParams, type ApplicationRevokeTokensParams as ApplicationRevokeTokensParams, };
     export { CAs as CAs, type CA as CA, type CADeleteResponse as CADeleteResponse, CAsV4PagePaginationArray as CAsV4PagePaginationArray, type CACreateParams as CACreateParams, type CAListParams as CAListParams, type CADeleteParams as CADeleteParams, type CAGetParams as CAGetParams, };
-    export { UserPolicyChecks as UserPolicyChecks, type UserPolicyCheckGeo as UserPolicyCheckGeo, type UserPolicyCheckListResponse as UserPolicyCheckListResponse, type UserPolicyCheckListParams as UserPolicyCheckListParams, };
+    export { UserPolicyChecks as UserPolicyChecks, type UserPolicyCheckListResponse as UserPolicyCheckListResponse, type UserPolicyCheckListParams as UserPolicyCheckListParams, };
     export { Policies as Policies, type AccessDevicePostureRule as AccessDevicePostureRule, type AccessRule as AccessRule, type AnyValidServiceTokenRule as AnyValidServiceTokenRule, type AuthenticationMethodRule as AuthenticationMethodRule, type AzureGroupRule as AzureGroupRule, type CertificateRule as CertificateRule, type CountryRule as CountryRule, type DomainRule as DomainRule, type EmailListRule as EmailListRule, type EmailRule as EmailRule, type EveryoneRule as EveryoneRule, type ExternalEvaluationRule as ExternalEvaluationRule, type GitHubOrganizationRule as GitHubOrganizationRule, type GroupRule as GroupRule, type GSuiteGroupRule as GSuiteGroupRule, type IPListRule as IPListRule, type IPRule as IPRule, type OktaGroupRule as OktaGroupRule, type SAMLGroupRule as SAMLGroupRule, type ServiceTokenRule as ServiceTokenRule, type PolicyCreateResponse as PolicyCreateResponse, type PolicyUpdateResponse as PolicyUpdateResponse, type PolicyListResponse as PolicyListResponse, type PolicyDeleteResponse as PolicyDeleteResponse, type PolicyGetResponse as PolicyGetResponse, PolicyListResponsesV4PagePaginationArray as PolicyListResponsesV4PagePaginationArray, type PolicyCreateParams as PolicyCreateParams, type PolicyUpdateParams as PolicyUpdateParams, type PolicyListParams as PolicyListParams, type PolicyDeleteParams as PolicyDeleteParams, type PolicyGetParams as PolicyGetParams, };
     export { PolicyTests as PolicyTests, type PolicyTestCreateResponse as PolicyTestCreateResponse, type PolicyTestGetResponse as PolicyTestGetResponse, type PolicyTestCreateParams as PolicyTestCreateParams, type PolicyTestGetParams as PolicyTestGetParams, };
     export { Settings as Settings, type SettingUpdateResponse as SettingUpdateResponse, type SettingEditResponse as SettingEditResponse, type SettingUpdateParams as SettingUpdateParams, type SettingEditParams as SettingEditParams, };