Telegram webhook blocked by Cloudflare Access despite Bypass Application (401 Missing JWT)

Problem Description
After deploying moltworker, the Telegram webhook endpoint (POST /telegram) is blocked by Cloudflare Zero Trust with a 401 Missing Cloudflare Access JWT error, even though a Bypass Application is configured for the root domain with "Everyone" policy.
The request never reaches the Worker (no logs in Workers → Logs), and the response is the standard Cloudflare Access unauthorized JSON:
`{"error":"Unauthorized","hint":"Missing Cloudflare Access JWT. Ensure this route is protected by Cloudflare Access."}`
Reproduction Steps

Deploy moltworker (default public.ts with POST /telegram route).
In Zero Trust → Access → Applications, create/edit an Application:
Type: Self-hosted
Domain: custom domain
Path: left empty (root domain)
Policy: Action = Bypass, Include = Everyone
No other Applications are visible in the list (only this one).

Test with curl:
```
curl -i https://[your-domain]/telegram
curl -i -X POST https://[your-domain]/telegram -d '{}'Result: Always HTTP/2 401 with the Missing JWT error above (cf-ray example: 9c7a7909ee2f03ad-HKG).
```

Expected Behavior
Bypass should take effect → request reaches Worker → returns 405 Method Not Allowed, 404, or Worker processing result (no Cloudflare 401).
Actual Behavior
Access layer fallback to requiring JWT; Bypass rule not triggered.
What I've Tried

Changed Path to /telegram*, /telegram, or exact /telegram
Deleted and recreated the Application multiple times
Waited 10+ minutes for propagation + used no-cache headers in curl
Confirmed Worker Routes include the custom domain/*
No global JWT validation in code (default moltworker)
Temporarily removed other Applications (only one left)

Environment

moltworker: latest version
Cloudflare Plan: [Paid]
Domain: custom domain (not *.workers.dev)
Zero Trust enabled, custom domain added and verified

Related Discussions / References

moltworker issue #101 (similar LINE webhook Bypass problem)
Cloudflare Community threads about webhook Bypass still returning 401 (n8n, Stripe, etc.)
Suggestion from community: use path-specific Bypass Application instead of root domain

Request / Questions

Is there a known issue with root-domain Bypass falling back to require JWT?
Recommended configuration: path-specific Bypass (/telegram) + Tunnel Public Hostname?
How to debug which internal rule is matching the request? (Support can check?)
Workaround: temporarily disable Access for the domain to confirm Worker responds directly?

Review the default public.ts POST /telegram route and the configured Worker route, then reproduce the root-domain and path-specific Access configurations with curl. Check whether requests reach Workers → Logs and document the configuration or matching rule that prevents the 401 Cloudflare Access response; completion means the webhook reaches the Worker or the external limitation is clearly identified.

Written by the indexing model from the issue text.