cloudflare 6.4.0 → 6.5.0

package/src/resources/zero-trust/access/applications/applications.ts

@@ -61,7 +61,6 @@ import {
 } from './settings';
 import * as UserPolicyChecksAPI from './user-policy-checks';
 import {
-  UserPolicyCheckGeo,
   UserPolicyCheckListParams,
   UserPolicyCheckListResponse,
   UserPolicyChecks,
@@ -504,6 +503,14 @@ export namespace Application {
      */
     custom_deny_url?: string;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -542,7 +549,7 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: SelfHostedApplication.SCIMConfig;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -615,6 +622,137 @@ export namespace Application {
        */
       max_age?: number;
     }
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
   }
 
   export interface SaaSApplication {
@@ -657,13 +795,13 @@ export namespace Application {
      */
     name?: string;
 
-    saas_app?: SaaSApplication.AccessSchemasSAMLSaaSApp | SaaSApplication.AccessSchemasOIDCSaaSApp;
+    saas_app?: SaaSApplication.AccessSAMLSaaSApp2 | SaaSApplication.AccessOIDCSaaSApp2;
 
     /**
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: SaaSApplication.SCIMConfig;
 
     /**
      * The application type.
@@ -674,7 +812,7 @@ export namespace Application {
   }
 
   export namespace SaaSApplication {
-    export interface AccessSchemasSAMLSaaSApp {
+    export interface AccessSAMLSaaSApp2 {
       /**
        * Optional identifier indicating the authentication protocol used for the saas
        * app. Required for OIDC. Default if unset is "saml"
@@ -689,7 +827,7 @@ export namespace Application {
 
       created_at?: string;
 
-      custom_attributes?: Array<AccessSchemasSAMLSaaSApp.CustomAttribute>;
+      custom_attributes?: Array<AccessSAMLSaaSApp2.CustomAttribute>;
 
       /**
        * The unique identifier for your SaaS application.
@@ -727,7 +865,7 @@ export namespace Application {
       updated_at?: string;
     }
 
-    export namespace AccessSchemasSAMLSaaSApp {
+    export namespace AccessSAMLSaaSApp2 {
       export interface CustomAttribute {
         /**
          * The SAML FriendlyName of the attribute.
@@ -770,7 +908,7 @@ export namespace Application {
       }
     }
 
-    export interface AccessSchemasOIDCSaaSApp {
+    export interface AccessOIDCSaaSApp2 {
       /**
        * The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must
        * be greater than or equal to 1m and less than or equal to 24h.
@@ -806,7 +944,7 @@ export namespace Application {
 
       created_at?: string;
 
-      custom_claims?: Array<AccessSchemasOIDCSaaSApp.CustomClaim>;
+      custom_claims?: Array<AccessOIDCSaaSApp2.CustomClaim>;
 
       /**
        * The OIDC flows supported by this application
@@ -820,7 +958,7 @@ export namespace Application {
        */
       group_filter_regex?: string;
 
-      hybrid_and_implicit_options?: AccessSchemasOIDCSaaSApp.HybridAndImplicitOptions;
+      hybrid_and_implicit_options?: AccessOIDCSaaSApp2.HybridAndImplicitOptions;
 
       /**
        * The Access public certificate that will be used to verify your identity.
@@ -833,7 +971,7 @@ export namespace Application {
        */
       redirect_uris?: Array<string>;
 
-      refresh_token_options?: AccessSchemasOIDCSaaSApp.RefreshTokenOptions;
+      refresh_token_options?: AccessOIDCSaaSApp2.RefreshTokenOptions;
 
       /**
        * Define the user information shared with access, "offline_access" scope will be
@@ -844,7 +982,7 @@ export namespace Application {
       updated_at?: string;
     }
 
-    export namespace AccessSchemasOIDCSaaSApp {
+    export namespace AccessOIDCSaaSApp2 {
       export interface CustomClaim {
         /**
          * The name of the claim.
@@ -912,181 +1050,140 @@ export namespace Application {
         lifetime?: string;
       }
     }
-  }
-
-  export interface BrowserSSHApplication {
-    /**
-     * The domain and path that Access will secure.
-     */
-    domain: string;
-
-    /**
-     * The application type.
-     */
-    type: string;
-
-    /**
-     * UUID.
-     */
-    id?: string;
-
-    /**
-     * Enables loading application content in an iFrame.
-     */
-    allow_iframe?: boolean;
-
-    /**
-     * The identity providers your users can select when connecting to this
-     * application. Defaults to all IdPs configured in your account.
-     */
-    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
-
-    /**
-     * Displays the application in the App Launcher.
-     */
-    app_launcher_visible?: boolean;
-
-    /**
-     * Audience tag.
-     */
-    aud?: string;
-
-    /**
-     * When set to `true`, users skip the identity provider selection step during
-     * login. You must specify only one identity provider in allowed_idps.
-     */
-    auto_redirect_to_identity?: boolean;
-
-    cors_headers?: BrowserSSHApplication.CORSHeaders;
-
-    created_at?: string;
-
-    /**
-     * The custom error message shown to a user when they are denied access to the
-     * application.
-     */
-    custom_deny_message?: string;
-
-    /**
-     * The custom URL a user is redirected to when they are denied access to the
-     * application.
-     */
-    custom_deny_url?: string;
-
-    /**
-     * Enables the binding cookie, which increases security against compromised
-     * authorization tokens and CSRF attacks.
-     */
-    enable_binding_cookie?: boolean;
-
-    /**
-     * Enables the HttpOnly cookie attribute, which increases security against XSS
-     * attacks.
-     */
-    http_only_cookie_attribute?: boolean;
-
-    /**
-     * The image URL for the logo shown in the App Launcher dashboard.
-     */
-    logo_url?: string;
-
-    /**
-     * The name of the application.
-     */
-    name?: string;
-
-    /**
-     * Allows options preflight requests to bypass Access authentication and go
-     * directly to the origin. Cannot turn on if cors_headers is set.
-     */
-    options_preflight_bypass?: boolean;
-
-    /**
-     * Sets the SameSite cookie setting, which provides increased security against CSRF
-     * attacks.
-     */
-    same_site_cookie_attribute?: string;
 
     /**
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
-
-    /**
-     * Returns a 401 status code when the request is blocked by a Service Auth policy.
-     */
-    service_auth_401_redirect?: boolean;
-
-    /**
-     * The amount of time that tokens issued for this application will be valid. Must
-     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
-     * s, m, h.
-     */
-    session_duration?: string;
-
-    /**
-     * Enables automatic authentication through cloudflared.
-     */
-    skip_interstitial?: boolean;
-
-    updated_at?: string;
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
 
-    /**
-     * Determines if users can access this application via a clientless browser
-     * isolation URL. This allows users to access private domains without connecting to
-     * Gateway. The option requires Clientless Browser Isolation to be set up with
-     * policies that allow users of this application.
-     */
-    use_clientless_isolation_app_launcher_url?: boolean;
-  }
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
 
-  export namespace BrowserSSHApplication {
-    export interface CORSHeaders {
       /**
-       * Allows all HTTP request headers.
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
        */
-      allow_all_headers?: boolean;
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
 
       /**
-       * Allows all HTTP request methods.
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
        */
-      allow_all_methods?: boolean;
+      deactivate_on_delete?: boolean;
 
       /**
-       * Allows all origins.
+       * Whether SCIM provisioning is turned on for this application.
        */
-      allow_all_origins?: boolean;
+      enabled?: boolean;
 
       /**
-       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
-       * client certificates) with requests.
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
        */
-      allow_credentials?: boolean;
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
 
+    export namespace SCIMConfig {
       /**
-       * Allowed HTTP request headers.
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
        */
-      allowed_headers?: Array<unknown>;
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
 
       /**
-       * Allowed HTTP request methods.
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
        */
-      allowed_methods?: Array<ApplicationsAPI.AllowedMethods>;
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
 
       /**
-       * Allowed origins.
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
        */
-      allowed_origins?: Array<unknown>;
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
 
       /**
-       * The maximum number of seconds the results of a preflight request can be cached.
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
        */
-      max_age?: number;
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
     }
   }
 
-  export interface BrowserVNCApplication {
+  export interface BrowserSSHApplication {
     /**
      * The domain and path that Access will secure.
      */
@@ -1129,7 +1226,7 @@ export namespace Application {
      */
     auto_redirect_to_identity?: boolean;
 
-    cors_headers?: BrowserVNCApplication.CORSHeaders;
+    cors_headers?: BrowserSSHApplication.CORSHeaders;
 
     created_at?: string;
 
@@ -1145,6 +1242,14 @@ export namespace Application {
      */
     custom_deny_url?: string;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -1183,7 +1288,7 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: BrowserSSHApplication.SCIMConfig;
 
     /**
      * Returns a 401 status code when the request is blocked by a Service Auth policy.
@@ -1213,7 +1318,7 @@ export namespace Application {
     use_clientless_isolation_app_launcher_url?: boolean;
   }
 
-  export namespace BrowserVNCApplication {
+  export namespace BrowserSSHApplication {
     export interface CORSHeaders {
       /**
        * Allows all HTTP request headers.
@@ -1256,6 +1361,448 @@ export namespace Application {
        */
       max_age?: number;
     }
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
+  }
+
+  export interface BrowserVNCApplication {
+    /**
+     * The domain and path that Access will secure.
+     */
+    domain: string;
+
+    /**
+     * The application type.
+     */
+    type: string;
+
+    /**
+     * UUID.
+     */
+    id?: string;
+
+    /**
+     * Enables loading application content in an iFrame.
+     */
+    allow_iframe?: boolean;
+
+    /**
+     * The identity providers your users can select when connecting to this
+     * application. Defaults to all IdPs configured in your account.
+     */
+    allowed_idps?: Array<ApplicationsAPI.AllowedIdPs>;
+
+    /**
+     * Displays the application in the App Launcher.
+     */
+    app_launcher_visible?: boolean;
+
+    /**
+     * Audience tag.
+     */
+    aud?: string;
+
+    /**
+     * When set to `true`, users skip the identity provider selection step during
+     * login. You must specify only one identity provider in allowed_idps.
+     */
+    auto_redirect_to_identity?: boolean;
+
+    cors_headers?: BrowserVNCApplication.CORSHeaders;
+
+    created_at?: string;
+
+    /**
+     * The custom error message shown to a user when they are denied access to the
+     * application.
+     */
+    custom_deny_message?: string;
+
+    /**
+     * The custom URL a user is redirected to when they are denied access to the
+     * application.
+     */
+    custom_deny_url?: string;
+
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
+    /**
+     * Enables the binding cookie, which increases security against compromised
+     * authorization tokens and CSRF attacks.
+     */
+    enable_binding_cookie?: boolean;
+
+    /**
+     * Enables the HttpOnly cookie attribute, which increases security against XSS
+     * attacks.
+     */
+    http_only_cookie_attribute?: boolean;
+
+    /**
+     * The image URL for the logo shown in the App Launcher dashboard.
+     */
+    logo_url?: string;
+
+    /**
+     * The name of the application.
+     */
+    name?: string;
+
+    /**
+     * Allows options preflight requests to bypass Access authentication and go
+     * directly to the origin. Cannot turn on if cors_headers is set.
+     */
+    options_preflight_bypass?: boolean;
+
+    /**
+     * Sets the SameSite cookie setting, which provides increased security against CSRF
+     * attacks.
+     */
+    same_site_cookie_attribute?: string;
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    scim_config?: BrowserVNCApplication.SCIMConfig;
+
+    /**
+     * Returns a 401 status code when the request is blocked by a Service Auth policy.
+     */
+    service_auth_401_redirect?: boolean;
+
+    /**
+     * The amount of time that tokens issued for this application will be valid. Must
+     * be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms,
+     * s, m, h.
+     */
+    session_duration?: string;
+
+    /**
+     * Enables automatic authentication through cloudflared.
+     */
+    skip_interstitial?: boolean;
+
+    updated_at?: string;
+
+    /**
+     * Determines if users can access this application via a clientless browser
+     * isolation URL. This allows users to access private domains without connecting to
+     * Gateway. The option requires Clientless Browser Isolation to be set up with
+     * policies that allow users of this application.
+     */
+    use_clientless_isolation_app_launcher_url?: boolean;
+  }
+
+  export namespace BrowserVNCApplication {
+    export interface CORSHeaders {
+      /**
+       * Allows all HTTP request headers.
+       */
+      allow_all_headers?: boolean;
+
+      /**
+       * Allows all HTTP request methods.
+       */
+      allow_all_methods?: boolean;
+
+      /**
+       * Allows all origins.
+       */
+      allow_all_origins?: boolean;
+
+      /**
+       * When set to `true`, includes credentials (cookies, authorization headers, or TLS
+       * client certificates) with requests.
+       */
+      allow_credentials?: boolean;
+
+      /**
+       * Allowed HTTP request headers.
+       */
+      allowed_headers?: Array<unknown>;
+
+      /**
+       * Allowed HTTP request methods.
+       */
+      allowed_methods?: Array<ApplicationsAPI.AllowedMethods>;
+
+      /**
+       * Allowed origins.
+       */
+      allowed_origins?: Array<unknown>;
+
+      /**
+       * The maximum number of seconds the results of a preflight request can be cached.
+       */
+      max_age?: number;
+    }
+
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
   }
 
   export interface AppLauncherApplication {
@@ -1302,7 +1849,7 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: AppLauncherApplication.SCIMConfig;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -1314,6 +1861,139 @@ export namespace Application {
     updated_at?: string;
   }
 
+  export namespace AppLauncherApplication {
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
+  }
+
   export interface DeviceEnrollmentPermissionsApplication {
     /**
      * The application type.
@@ -1358,7 +2038,7 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: DeviceEnrollmentPermissionsApplication.SCIMConfig;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -1370,6 +2050,139 @@ export namespace Application {
     updated_at?: string;
   }
 
+  export namespace DeviceEnrollmentPermissionsApplication {
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
+  }
+
   export interface BrowserIsolationPermissionsApplication {
     /**
      * The application type.
@@ -1414,7 +2227,7 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: BrowserIsolationPermissionsApplication.SCIMConfig;
 
     /**
      * The amount of time that tokens issued for this application will be valid. Must
@@ -1426,6 +2239,139 @@ export namespace Application {
     updated_at?: string;
   }
 
+  export namespace BrowserIsolationPermissionsApplication {
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
+  }
+
   export interface BookmarkApplication {
     /**
      * The URL or domain of the bookmark.
@@ -1465,10 +2411,143 @@ export namespace Application {
      * Configuration for provisioning to this application via SCIM. This is currently
      * in closed beta.
      */
-    scim_config?: ApplicationsAPI.ApplicationSCIMConfig;
+    scim_config?: BookmarkApplication.SCIMConfig;
 
     updated_at?: string;
   }
+
+  export namespace BookmarkApplication {
+    /**
+     * Configuration for provisioning to this application via SCIM. This is currently
+     * in closed beta.
+     */
+    export interface SCIMConfig {
+      /**
+       * The UID of the IdP to use as the source for SCIM resources to provision to this
+       * application.
+       */
+      idp_uid: string;
+
+      /**
+       * The base URI for the application's SCIM-compatible API.
+       */
+      remote_uri: string;
+
+      /**
+       * Attributes for configuring HTTP Basic authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      authentication?:
+        | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+        | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+        | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+        | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+        | Array<
+            | ApplicationsAPI.SCIMConfigAuthenticationHTTPBasic
+            | SCIMConfig.AccessSCIMConfigAuthenticationOAuthBearerToken2
+            | ApplicationsAPI.SCIMConfigAuthenticationOauth2
+            | SCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
+          >;
+
+      /**
+       * If false, we propagate DELETE requests to the target application for SCIM
+       * resources. If true, we only set `active` to false on the SCIM resource. This is
+       * useful because some targets do not support DELETE operations.
+       */
+      deactivate_on_delete?: boolean;
+
+      /**
+       * Whether SCIM provisioning is turned on for this application.
+       */
+      enabled?: boolean;
+
+      /**
+       * A list of mappings to apply to SCIM resources before provisioning them in this
+       * application. These can transform or filter the resources to be provisioned.
+       */
+      mappings?: Array<ApplicationsAPI.SCIMConfigMapping>;
+    }
+
+    export namespace SCIMConfig {
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+
+      /**
+       * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationOAuthBearerToken2 {
+        /**
+         * Token used to authenticate with the remote SCIM service.
+         */
+        token: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'oauthbearertoken';
+      }
+
+      /**
+       * Attributes for configuring Access Service Token authentication scheme for SCIM
+       * provisioning to an application.
+       */
+      export interface AccessSCIMConfigAuthenticationAccessServiceToken {
+        /**
+         * Client ID of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_id: string;
+
+        /**
+         * Client secret of the Access service token used to authenticate with the remote
+         * service.
+         */
+        client_secret: string;
+
+        /**
+         * The authentication scheme to use when making SCIM requests to this application.
+         */
+        scheme: 'access_service_token';
+      }
+    }
+  }
 }
 
 export interface ApplicationPolicy {
@@ -1609,137 +2688,6 @@ export namespace ApplicationPolicy {
   }
 }
 
-/**
- * Configuration for provisioning to this application via SCIM. This is currently
- * in closed beta.
- */
-export interface ApplicationSCIMConfig {
-  /**
-   * The UID of the IdP to use as the source for SCIM resources to provision to this
-   * application.
-   */
-  idp_uid: string;
-
-  /**
-   * The base URI for the application's SCIM-compatible API.
-   */
-  remote_uri: string;
-
-  /**
-   * Attributes for configuring HTTP Basic authentication scheme for SCIM
-   * provisioning to an application.
-   */
-  authentication?:
-    | SCIMConfigAuthenticationHTTPBasic
-    | ApplicationSCIMConfig.AccessSchemasSCIMConfigAuthenticationOAuthBearerToken
-    | SCIMConfigAuthenticationOauth2
-    | ApplicationSCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
-    | Array<
-        | SCIMConfigAuthenticationHTTPBasic
-        | ApplicationSCIMConfig.AccessSchemasSCIMConfigAuthenticationOAuthBearerToken
-        | SCIMConfigAuthenticationOauth2
-        | ApplicationSCIMConfig.AccessSCIMConfigAuthenticationAccessServiceToken
-      >;
-
-  /**
-   * If false, we propagate DELETE requests to the target application for SCIM
-   * resources. If true, we only set `active` to false on the SCIM resource. This is
-   * useful because some targets do not support DELETE operations.
-   */
-  deactivate_on_delete?: boolean;
-
-  /**
-   * Whether SCIM provisioning is turned on for this application.
-   */
-  enabled?: boolean;
-
-  /**
-   * A list of mappings to apply to SCIM resources before provisioning them in this
-   * application. These can transform or filter the resources to be provisioned.
-   */
-  mappings?: Array<SCIMConfigMapping>;
-}
-
-export namespace ApplicationSCIMConfig {
-  /**
-   * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
-   * provisioning to an application.
-   */
-  export interface AccessSchemasSCIMConfigAuthenticationOAuthBearerToken {
-    /**
-     * Token used to authenticate with the remote SCIM service.
-     */
-    token: string;
-
-    /**
-     * The authentication scheme to use when making SCIM requests to this application.
-     */
-    scheme: 'oauthbearertoken';
-  }
-
-  /**
-   * Attributes for configuring Access Service Token authentication scheme for SCIM
-   * provisioning to an application.
-   */
-  export interface AccessSCIMConfigAuthenticationAccessServiceToken {
-    /**
-     * Client ID of the Access service token used to authenticate with the remote
-     * service.
-     */
-    client_id: string;
-
-    /**
-     * Client secret of the Access service token used to authenticate with the remote
-     * service.
-     */
-    client_secret: string;
-
-    /**
-     * The authentication scheme to use when making SCIM requests to this application.
-     */
-    scheme: 'access_service_token';
-  }
-
-  /**
-   * Attributes for configuring OAuth Bearer Token authentication scheme for SCIM
-   * provisioning to an application.
-   */
-  export interface AccessSchemasSCIMConfigAuthenticationOAuthBearerToken {
-    /**
-     * Token used to authenticate with the remote SCIM service.
-     */
-    token: string;
-
-    /**
-     * The authentication scheme to use when making SCIM requests to this application.
-     */
-    scheme: 'oauthbearertoken';
-  }
-
-  /**
-   * Attributes for configuring Access Service Token authentication scheme for SCIM
-   * provisioning to an application.
-   */
-  export interface AccessSCIMConfigAuthenticationAccessServiceToken {
-    /**
-     * Client ID of the Access service token used to authenticate with the remote
-     * service.
-     */
-    client_id: string;
-
-    /**
-     * Client secret of the Access service token used to authenticate with the remote
-     * service.
-     */
-    client_secret: string;
-
-    /**
-     * The authentication scheme to use when making SCIM requests to this application.
-     */
-    scheme: 'access_service_token';
-  }
-}
-
 /**
  * The application type.
  */
@@ -2770,8 +3718,20 @@ export namespace ApplicationCreateResponse {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -2945,6 +3905,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -3692,8 +4706,20 @@ export namespace ApplicationCreateResponse {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -3867,6 +4893,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -4304,8 +5384,20 @@ export namespace ApplicationCreateResponse {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -4479,6 +5571,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -6076,9 +7222,9 @@ export namespace ApplicationCreateResponse {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -6183,8 +7329,20 @@ export namespace ApplicationCreateResponse {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -6376,6 +7534,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -6781,6 +7993,10 @@ export namespace ApplicationCreateResponse {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -6902,6 +8118,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -7285,6 +8555,10 @@ export namespace ApplicationCreateResponse {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -7412,6 +8686,60 @@ export namespace ApplicationCreateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -7830,8 +9158,20 @@ export namespace ApplicationUpdateResponse {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -8005,6 +9345,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -8752,8 +10146,20 @@ export namespace ApplicationUpdateResponse {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -8927,6 +10333,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -9364,8 +10824,20 @@ export namespace ApplicationUpdateResponse {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -9539,6 +11011,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -11136,9 +12662,9 @@ export namespace ApplicationUpdateResponse {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -11243,8 +12769,20 @@ export namespace ApplicationUpdateResponse {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -11436,6 +12974,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -11841,6 +13433,10 @@ export namespace ApplicationUpdateResponse {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -11962,6 +13558,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -12345,6 +13995,10 @@ export namespace ApplicationUpdateResponse {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -12472,6 +14126,60 @@ export namespace ApplicationUpdateResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -12890,8 +14598,20 @@ export namespace ApplicationListResponse {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -13065,6 +14785,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -13812,8 +15586,20 @@ export namespace ApplicationListResponse {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -13987,6 +15773,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -14424,8 +16264,20 @@ export namespace ApplicationListResponse {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -14599,6 +16451,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -16196,9 +18102,9 @@ export namespace ApplicationListResponse {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -16303,8 +18209,20 @@ export namespace ApplicationListResponse {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -16496,6 +18414,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -16901,6 +18873,10 @@ export namespace ApplicationListResponse {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -17022,6 +18998,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -17405,6 +19435,10 @@ export namespace ApplicationListResponse {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -17532,6 +19566,60 @@ export namespace ApplicationListResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -17957,8 +20045,20 @@ export namespace ApplicationGetResponse {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -18132,6 +20232,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -18879,8 +21033,20 @@ export namespace ApplicationGetResponse {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -19054,6 +21220,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -19491,8 +21711,20 @@ export namespace ApplicationGetResponse {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -19666,6 +21898,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -21263,9 +23549,9 @@ export namespace ApplicationGetResponse {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -21370,8 +23656,20 @@ export namespace ApplicationGetResponse {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Enables the binding cookie, which increases security against compromised
      * authorization tokens and CSRF attacks.
@@ -21563,6 +23861,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -21968,6 +24320,10 @@ export namespace ApplicationGetResponse {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -22089,6 +24445,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -22472,6 +24882,10 @@ export namespace ApplicationGetResponse {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -22599,6 +25013,60 @@ export namespace ApplicationGetResponse {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -23026,8 +25494,20 @@ export declare namespace ApplicationCreateParams {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -23208,6 +25688,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -23940,8 +26474,20 @@ export declare namespace ApplicationCreateParams {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -24122,6 +26668,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -24549,8 +27149,20 @@ export declare namespace ApplicationCreateParams {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -24731,6 +27343,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -26251,9 +28917,9 @@ export declare namespace ApplicationCreateParams {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -26368,8 +29034,20 @@ export declare namespace ApplicationCreateParams {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -26568,6 +29246,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -26960,6 +29692,10 @@ export declare namespace ApplicationCreateParams {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -27087,6 +29823,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -27457,6 +30247,10 @@ export declare namespace ApplicationCreateParams {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -27592,6 +30386,60 @@ export declare namespace ApplicationCreateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -28000,8 +30848,20 @@ export declare namespace ApplicationUpdateParams {
       | SelfHostedApplication.PublicDestination
       | SelfHostedApplication.PrivateDestination
       | SelfHostedApplication.ViaMcpServerPortalDestination
+      | SelfHostedApplication.WorkerDestination
+      | SelfHostedApplication.PreviewWorkerDestination
+      | SelfHostedApplication.AllWorkersDestination
+      | SelfHostedApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -28182,6 +31042,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -28914,8 +31828,20 @@ export declare namespace ApplicationUpdateParams {
       | BrowserSSHApplication.PublicDestination
       | BrowserSSHApplication.PrivateDestination
       | BrowserSSHApplication.ViaMcpServerPortalDestination
+      | BrowserSSHApplication.WorkerDestination
+      | BrowserSSHApplication.PreviewWorkerDestination
+      | BrowserSSHApplication.AllWorkersDestination
+      | BrowserSSHApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -29096,6 +32022,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -29523,8 +32503,20 @@ export declare namespace ApplicationUpdateParams {
       | BrowserVNCApplication.PublicDestination
       | BrowserVNCApplication.PrivateDestination
       | BrowserVNCApplication.ViaMcpServerPortalDestination
+      | BrowserVNCApplication.WorkerDestination
+      | BrowserVNCApplication.PreviewWorkerDestination
+      | BrowserVNCApplication.AllWorkersDestination
+      | BrowserVNCApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -29705,6 +32697,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -31225,9 +34271,9 @@ export declare namespace ApplicationUpdateParams {
       export interface MfaConfig {
         /**
          * Lists the MFA methods that users can authenticate with. For infrastructure
-         * applications, only `ssh_piv_key` is supported.
+         * applications, only `piv_key` is supported.
          */
-        allowed_authenticators?: Array<'ssh_piv_key'>;
+        allowed_authenticators?: Array<'piv_key'>;
 
         /**
          * Indicates whether to disable MFA for this resource. This option is available at
@@ -31342,8 +34388,20 @@ export declare namespace ApplicationUpdateParams {
       | BrowserRDPApplication.PublicDestination
       | BrowserRDPApplication.PrivateDestination
       | BrowserRDPApplication.ViaMcpServerPortalDestination
+      | BrowserRDPApplication.WorkerDestination
+      | BrowserRDPApplication.PreviewWorkerDestination
+      | BrowserRDPApplication.AllWorkersDestination
+      | BrowserRDPApplication.AllPreviewWorkersDestination
     >;
 
+    /**
+     * Body param: Preemptively sets the Access session cookie on every hostname in a
+     * multi-hostname self-hosted application during the initial redirect chain, rather
+     * than setting it lazily on first visit. Defaults to true. Set to false to disable
+     * the eager redirect cookie behavior.
+     */
+    eager_redirect_cookie_setting?: boolean;
+
     /**
      * Body param: Enables the binding cookie, which increases security against
      * compromised authorization tokens and CSRF attacks.
@@ -31542,6 +34600,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * Configures multi-factor authentication (MFA) settings.
      */
@@ -31934,6 +35046,10 @@ export declare namespace ApplicationUpdateParams {
       | McpServerApplication.PublicDestination
       | McpServerApplication.PrivateDestination
       | McpServerApplication.ViaMcpServerPortalDestination
+      | McpServerApplication.WorkerDestination
+      | McpServerApplication.PreviewWorkerDestination
+      | McpServerApplication.AllWorkersDestination
+      | McpServerApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -32061,6 +35177,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -32431,6 +35601,10 @@ export declare namespace ApplicationUpdateParams {
       | McpServerPortalApplication.PublicDestination
       | McpServerPortalApplication.PrivateDestination
       | McpServerPortalApplication.ViaMcpServerPortalDestination
+      | McpServerPortalApplication.WorkerDestination
+      | McpServerPortalApplication.PreviewWorkerDestination
+      | McpServerPortalApplication.AllWorkersDestination
+      | McpServerPortalApplication.AllPreviewWorkersDestination
     >;
 
     /**
@@ -32566,6 +35740,60 @@ export declare namespace ApplicationUpdateParams {
       type?: 'via_mcp_server_portal';
     }
 
+    /**
+     * A specific Cloudflare Worker that Access will secure. All requests routed to the
+     * specified Worker, including its preview deployments, will be protected. The
+     * `preview_worker` and `public` destination types takes precedence, so you can
+     * create separate applications to override the policies for the Worker's previews
+     * or specific paths.
+     */
+    export interface WorkerDestination {
+      type: 'worker';
+
+      /**
+       * The ID of the Cloudflare Worker to protect with Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * A specific Cloudflare Worker whose preview deployments Access will secure. Only
+     * requests routed to the preview deployments of the specified Worker will be
+     * protected. The `public` destination type takes precedence, so you can create
+     * separate applications to override the policies for specific paths.
+     */
+    export interface PreviewWorkerDestination {
+      type: 'preview_worker';
+
+      /**
+       * The ID of the Cloudflare Worker whose preview deployments to protect with
+       * Access.
+       */
+      worker_id: string;
+    }
+
+    /**
+     * Protects all Cloudflare Workers on the account with Access, including their
+     * preview deployments. At most one destination of this type can exist per account.
+     * The `worker`, `preview_worker`, `all_preview_workers`, and `public` destination
+     * types take precedence, so you can create separate applications to override the
+     * policies for specific Workers, their previews, or specific paths.
+     */
+    export interface AllWorkersDestination {
+      type: 'all_workers';
+    }
+
+    /**
+     * Protects the preview deployments of all Cloudflare Workers on the account with
+     * Access. At most one destination of this type can exist per account. The
+     * `worker`, `preview_worker`, and `public` destination types take precedence, so
+     * you can create separate applications to override the policies for specific
+     * Workers, their previews, or specific paths.
+     */
+    export interface AllPreviewWorkersDestination {
+      type: 'all_preview_workers';
+    }
+
     /**
      * **Beta:** Optional configuration for managing an OAuth authorization flow
      * controlled by Access. When set, Access will act as the OAuth authorization
@@ -32964,7 +36192,6 @@ export declare namespace Applications {
     type AppID as AppID,
     type Application as Application,
     type ApplicationPolicy as ApplicationPolicy,
-    type ApplicationSCIMConfig as ApplicationSCIMConfig,
     type ApplicationType as ApplicationType,
     type CORSHeaders as CORSHeaders,
     type Decision as Decision,
@@ -33004,7 +36231,6 @@ export declare namespace Applications {
 
   export {
     UserPolicyChecks as UserPolicyChecks,
-    type UserPolicyCheckGeo as UserPolicyCheckGeo,
     type UserPolicyCheckListResponse as UserPolicyCheckListResponse,
     type UserPolicyCheckListParams as UserPolicyCheckListParams,
   };