@memberjunction/server 5.43.0 → 5.45.0

package/dist/config.d.ts

@@ -103,55 +103,6 @@ declare const restApiOptionsSchema: z.ZodObject<{
     includeSchemas?: string[];
     excludeSchemas?: string[];
 }>;
-declare const askSkipInfoSchema: z.ZodObject<{
-    url: z.ZodOptional<z.ZodString>;
-    apiKey: z.ZodOptional<z.ZodString>;
-    orgID: z.ZodOptional<z.ZodString>;
-    organizationInfo: z.ZodOptional<z.ZodString>;
-    entitiesToSend: z.ZodOptional<z.ZodObject<{
-        excludeSchemas: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        includeEntitiesFromExcludedSchemas: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        excludeSchemas?: string[];
-        includeEntitiesFromExcludedSchemas?: string[];
-    }, {
-        excludeSchemas?: string[];
-        includeEntitiesFromExcludedSchemas?: string[];
-    }>>;
-    chatURL: z.ZodOptional<z.ZodString>;
-    learningCycleRunUponStartup: z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>;
-    learningCycleEnabled: z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>;
-    learningCycleURL: z.ZodOptional<z.ZodString>;
-    learningCycleIntervalInMinutes: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    url?: string;
-    apiKey?: string;
-    orgID?: string;
-    organizationInfo?: string;
-    entitiesToSend?: {
-        excludeSchemas?: string[];
-        includeEntitiesFromExcludedSchemas?: string[];
-    };
-    chatURL?: string;
-    learningCycleRunUponStartup?: boolean;
-    learningCycleEnabled?: boolean;
-    learningCycleURL?: string;
-    learningCycleIntervalInMinutes?: number;
-}, {
-    url?: string;
-    apiKey?: string;
-    orgID?: string;
-    organizationInfo?: string;
-    entitiesToSend?: {
-        excludeSchemas?: string[];
-        includeEntitiesFromExcludedSchemas?: string[];
-    };
-    chatURL?: string;
-    learningCycleRunUponStartup?: string | number | boolean;
-    learningCycleEnabled?: string | number | boolean;
-    learningCycleURL?: string;
-    learningCycleIntervalInMinutes?: number;
-}>;
 declare const sqlLoggingOptionsSchema: z.ZodObject<{
     formatAsMigration: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     statementTypes: z.ZodDefault<z.ZodOptional<z.ZodEnum<["queries", "mutations", "both"]>>>;
@@ -847,6 +798,954 @@ declare const magicLinkSchema: z.ZodObject<{
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * Public web widget config (plans/realtime/bridges-and-widget/public-web-widget.md).
+ * The widget REUSES the magic-link RS256 key + `anonymous-embed` synthesis, so it
+ * shares the magic-link `audience`/issuer/JWKS by default — the same auth provider
+ * validates both. When `enabled`, the server ensures the magic-link key manager is
+ * initialized and the provider registered even if `magicLink.enabled` is false.
+ */
+declare const widgetSchema: z.ZodObject<{
+    /** Master switch. When false, the /widget routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+     * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+     * dedicated widget key is a config flip, not a code change.
+     */
+    signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+    /**
+     * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+     * auto-registered `magic-link` auth provider validates widget tokens.
+     */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+    anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+    defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+    defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+    voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+    contextUserForLookup: z.ZodOptional<z.ZodString>;
+    /**
+     * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+     * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+     * the key here. INTERIM location — production should store the host key per widget instance
+     * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+     * HostIdentity and no key is configured here, host mints fail closed.
+     */
+    hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    /**
+     * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+     * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+     * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+     * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+     * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+     */
+    identityResolution: z.ZodOptional<z.ZodObject<{
+        entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        entityName?: string;
+        emailField?: string;
+    }, {
+        entityName?: string;
+        emailField?: string;
+    }>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false, the /widget routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+     * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+     * dedicated widget key is a config flip, not a code change.
+     */
+    signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+    /**
+     * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+     * auto-registered `magic-link` auth provider validates widget tokens.
+     */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+    anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+    defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+    defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+    voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+    contextUserForLookup: z.ZodOptional<z.ZodString>;
+    /**
+     * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+     * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+     * the key here. INTERIM location — production should store the host key per widget instance
+     * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+     * HostIdentity and no key is configured here, host mints fail closed.
+     */
+    hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    /**
+     * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+     * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+     * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+     * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+     * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+     */
+    identityResolution: z.ZodOptional<z.ZodObject<{
+        entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        entityName?: string;
+        emailField?: string;
+    }, {
+        entityName?: string;
+        emailField?: string;
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false, the /widget routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+     * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+     * dedicated widget key is a config flip, not a code change.
+     */
+    signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+    /**
+     * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+     * auto-registered `magic-link` auth provider validates widget tokens.
+     */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+    anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+    defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+    defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+    voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+    contextUserForLookup: z.ZodOptional<z.ZodString>;
+    /**
+     * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+     * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+     * the key here. INTERIM location — production should store the host key per widget instance
+     * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+     * HostIdentity and no key is configured here, host mints fail closed.
+     */
+    hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    /**
+     * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+     * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+     * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+     * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+     * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+     */
+    identityResolution: z.ZodOptional<z.ZodObject<{
+        entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        entityName?: string;
+        emailField?: string;
+    }, {
+        entityName?: string;
+        emailField?: string;
+    }>>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * Telephony bridge config (plans/realtime/bridges-and-widget/telephony-vendor-bindings.md).
+ * Holds the per-vendor credentials + public stream URL the MJAPI telephony ingress wires onto
+ * the already-stubbed native SDK seams. Credentials resolve here from `mj.config.cjs` / env —
+ * never inlined in code. When `twilio` is omitted, the Twilio telephony routes are not mounted.
+ */
+declare const twilioTelephonySchema: z.ZodObject<{
+    /** Twilio Account SID (`AC…`). */
+    accountSid: z.ZodString;
+    /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+    authToken: z.ZodOptional<z.ZodString>;
+    /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+    apiKeySid: z.ZodOptional<z.ZodString>;
+    /** API Key secret — paired with apiKeySid. */
+    apiKeySecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+    streamPublicUrl: z.ZodString;
+    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    webhookSigningSecret: z.ZodOptional<z.ZodString>;
+    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    statusCallbackUrl: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Twilio Account SID (`AC…`). */
+    accountSid: z.ZodString;
+    /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+    authToken: z.ZodOptional<z.ZodString>;
+    /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+    apiKeySid: z.ZodOptional<z.ZodString>;
+    /** API Key secret — paired with apiKeySid. */
+    apiKeySecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+    streamPublicUrl: z.ZodString;
+    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    webhookSigningSecret: z.ZodOptional<z.ZodString>;
+    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    statusCallbackUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Twilio Account SID (`AC…`). */
+    accountSid: z.ZodString;
+    /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+    authToken: z.ZodOptional<z.ZodString>;
+    /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+    apiKeySid: z.ZodOptional<z.ZodString>;
+    /** API Key secret — paired with apiKeySid. */
+    apiKeySecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+    streamPublicUrl: z.ZodString;
+    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    webhookSigningSecret: z.ZodOptional<z.ZodString>;
+    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    statusCallbackUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * Vonage Voice + WebSocket-media telephony binding. Voice-API auth is application-scoped
+ * (application id + RSA private key) with an optional account API key pair for key-scoped ops;
+ * signatureSecret is the HMAC key for signed-request `sig` AND HS256 webhook-JWT verification.
+ * When `vonage` is omitted, the Vonage telephony routes are not mounted.
+ */
+declare const vonageTelephonySchema: z.ZodObject<{
+    /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+    applicationId: z.ZodOptional<z.ZodString>;
+    /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+    privateKey: z.ZodOptional<z.ZodString>;
+    /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** Account API secret — paired with apiKey. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+    mediaPublicUrl: z.ZodString;
+    /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+    signatureSecret: z.ZodOptional<z.ZodString>;
+    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    eventUrl: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+    applicationId: z.ZodOptional<z.ZodString>;
+    /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+    privateKey: z.ZodOptional<z.ZodString>;
+    /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** Account API secret — paired with apiKey. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+    mediaPublicUrl: z.ZodString;
+    /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+    signatureSecret: z.ZodOptional<z.ZodString>;
+    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    eventUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+    applicationId: z.ZodOptional<z.ZodString>;
+    /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+    privateKey: z.ZodOptional<z.ZodString>;
+    /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** Account API secret — paired with apiKey. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+    mediaPublicUrl: z.ZodString;
+    /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+    signatureSecret: z.ZodOptional<z.ZodString>;
+    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    eventUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * RingCentral telephony binding: **SIP device credentials** for the headless softphone (the
+ * `ringcentral-softphone` SIP/RTP path — the only RingCentral product that carries bidirectional call
+ * audio; the WebSocket "Call Streaming" product is receive-only). These come from a RingCentral
+ * "Other Phone" (BYO-device) registration's SIP info, resolved here from `mj.config.cjs` / env — never
+ * inlined. When `ringcentral` is omitted, the RingCentral softphone is not started.
+ *
+ * Unlike Twilio/Vonage, there is NO public HTTP webhook or media WSS: the softphone is an outbound SIP
+ * registration that receives inbound INVITEs directly over its own SIP/TLS connection. So this block has
+ * no signing secret or public URL — just the SIP device creds + codec.
+ */
+declare const ringcentralTelephonySchema: z.ZodObject<{
+    /** SIP domain (e.g. `sip.ringcentral.com`). */
+    sipDomain: z.ZodString;
+    /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+    sipOutboundProxy: z.ZodString;
+    /** SIP auth username (the device's phone number / extension). */
+    sipUsername: z.ZodString;
+    /** SIP auth password (resolved upstream — never inlined). */
+    sipPassword: z.ZodString;
+    /** SIP authorization id (the device's RingCentral authorization id). */
+    sipAuthorizationId: z.ZodString;
+    /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+    codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+    /** Skip TLS cert validation (sandbox/test only — never in production). */
+    ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** SIP domain (e.g. `sip.ringcentral.com`). */
+    sipDomain: z.ZodString;
+    /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+    sipOutboundProxy: z.ZodString;
+    /** SIP auth username (the device's phone number / extension). */
+    sipUsername: z.ZodString;
+    /** SIP auth password (resolved upstream — never inlined). */
+    sipPassword: z.ZodString;
+    /** SIP authorization id (the device's RingCentral authorization id). */
+    sipAuthorizationId: z.ZodString;
+    /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+    codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+    /** Skip TLS cert validation (sandbox/test only — never in production). */
+    ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** SIP domain (e.g. `sip.ringcentral.com`). */
+    sipDomain: z.ZodString;
+    /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+    sipOutboundProxy: z.ZodString;
+    /** SIP auth username (the device's phone number / extension). */
+    sipUsername: z.ZodString;
+    /** SIP auth password (resolved upstream — never inlined). */
+    sipPassword: z.ZodString;
+    /** SIP authorization id (the device's RingCentral authorization id). */
+    sipAuthorizationId: z.ZodString;
+    /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+    codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+    /** Skip TLS cert validation (sandbox/test only — never in production). */
+    ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * Teams meetings bridge config (plans/realtime/bridges-and-widget/meeting-vendor-bindings-teams-slack.md M1).
+ * Holds the bot credentials + Graph webhook shared secret + ACS audio rate the MJAPI meetings ingress wires
+ * onto the Teams binding seams. Credentials resolve here from `mj.config.cjs` / env — never inlined in code.
+ * When `teams` is omitted (or disabled), the Teams meetings routes are not mounted.
+ */
+declare const teamsMeetingsSchema: z.ZodObject<{
+    /** Master switch for the Teams meetings ingress. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+    appId: z.ZodOptional<z.ZodString>;
+    /** The Azure tenant id the bot operates in. */
+    tenantId: z.ZodOptional<z.ZodString>;
+    /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+    botAccessToken: z.ZodOptional<z.ZodString>;
+    /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+    notificationClientState: z.ZodOptional<z.ZodString>;
+    /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+    acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+    modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch for the Teams meetings ingress. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+    appId: z.ZodOptional<z.ZodString>;
+    /** The Azure tenant id the bot operates in. */
+    tenantId: z.ZodOptional<z.ZodString>;
+    /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+    botAccessToken: z.ZodOptional<z.ZodString>;
+    /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+    notificationClientState: z.ZodOptional<z.ZodString>;
+    /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+    acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+    modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch for the Teams meetings ingress. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+    appId: z.ZodOptional<z.ZodString>;
+    /** The Azure tenant id the bot operates in. */
+    tenantId: z.ZodOptional<z.ZodString>;
+    /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+    botAccessToken: z.ZodOptional<z.ZodString>;
+    /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+    notificationClientState: z.ZodOptional<z.ZodString>;
+    /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+    acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+    modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+}, z.ZodTypeAny, "passthrough">>;
+declare const telephonySchema: z.ZodObject<{
+    /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Twilio Programmable Voice + Media Streams binding. */
+    twilio: z.ZodOptional<z.ZodObject<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Vonage Voice + WebSocket-media binding. */
+    vonage: z.ZodOptional<z.ZodObject<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** RingCentral Call Control + media-stream binding. */
+    ringcentral: z.ZodOptional<z.ZodObject<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+    teams: z.ZodOptional<z.ZodObject<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Twilio Programmable Voice + Media Streams binding. */
+    twilio: z.ZodOptional<z.ZodObject<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Vonage Voice + WebSocket-media binding. */
+    vonage: z.ZodOptional<z.ZodObject<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** RingCentral Call Control + media-stream binding. */
+    ringcentral: z.ZodOptional<z.ZodObject<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+    teams: z.ZodOptional<z.ZodObject<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Twilio Programmable Voice + Media Streams binding. */
+    twilio: z.ZodOptional<z.ZodObject<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Twilio Account SID (`AC…`). */
+        accountSid: z.ZodString;
+        /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+        authToken: z.ZodOptional<z.ZodString>;
+        /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+        apiKeySid: z.ZodOptional<z.ZodString>;
+        /** API Key secret — paired with apiKeySid. */
+        apiKeySecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+        streamPublicUrl: z.ZodString;
+        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        webhookSigningSecret: z.ZodOptional<z.ZodString>;
+        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Vonage Voice + WebSocket-media binding. */
+    vonage: z.ZodOptional<z.ZodObject<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+        applicationId: z.ZodOptional<z.ZodString>;
+        /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+        privateKey: z.ZodOptional<z.ZodString>;
+        /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** Account API secret — paired with apiKey. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+        mediaPublicUrl: z.ZodString;
+        /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+        signatureSecret: z.ZodOptional<z.ZodString>;
+        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        eventUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** RingCentral Call Control + media-stream binding. */
+    ringcentral: z.ZodOptional<z.ZodObject<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** SIP domain (e.g. `sip.ringcentral.com`). */
+        sipDomain: z.ZodString;
+        /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+        sipOutboundProxy: z.ZodString;
+        /** SIP auth username (the device's phone number / extension). */
+        sipUsername: z.ZodString;
+        /** SIP auth password (resolved upstream — never inlined). */
+        sipPassword: z.ZodString;
+        /** SIP authorization id (the device's RingCentral authorization id). */
+        sipAuthorizationId: z.ZodString;
+        /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+        codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+        /** Skip TLS cert validation (sandbox/test only — never in production). */
+        ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+    /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+    teams: z.ZodOptional<z.ZodObject<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch for the Teams meetings ingress. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+        appId: z.ZodOptional<z.ZodString>;
+        /** The Azure tenant id the bot operates in. */
+        tenantId: z.ZodOptional<z.ZodString>;
+        /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+        botAccessToken: z.ZodOptional<z.ZodString>;
+        /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+        notificationClientState: z.ZodOptional<z.ZodString>;
+        /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+        acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+        modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
         autoCreateNewUsers: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -1054,6 +1953,734 @@ declare const configInfoSchema: z.ZodObject<{
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>>;
+    widget: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, the /widget routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+         * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+         * dedicated widget key is a config flip, not a code change.
+         */
+        signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+        /**
+         * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+         * auto-registered `magic-link` auth provider validates widget tokens.
+         */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+        anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+        defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+        defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+        voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+        contextUserForLookup: z.ZodOptional<z.ZodString>;
+        /**
+         * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+         * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+         * the key here. INTERIM location — production should store the host key per widget instance
+         * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+         * HostIdentity and no key is configured here, host mints fail closed.
+         */
+        hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        /**
+         * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+         * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+         * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+         * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+         * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+         */
+        identityResolution: z.ZodOptional<z.ZodObject<{
+            entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            entityName?: string;
+            emailField?: string;
+        }, {
+            entityName?: string;
+            emailField?: string;
+        }>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, the /widget routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+         * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+         * dedicated widget key is a config flip, not a code change.
+         */
+        signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+        /**
+         * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+         * auto-registered `magic-link` auth provider validates widget tokens.
+         */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+        anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+        defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+        defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+        voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+        contextUserForLookup: z.ZodOptional<z.ZodString>;
+        /**
+         * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+         * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+         * the key here. INTERIM location — production should store the host key per widget instance
+         * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+         * HostIdentity and no key is configured here, host mints fail closed.
+         */
+        hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        /**
+         * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+         * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+         * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+         * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+         * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+         */
+        identityResolution: z.ZodOptional<z.ZodObject<{
+            entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            entityName?: string;
+            emailField?: string;
+        }, {
+            entityName?: string;
+            emailField?: string;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, the /widget routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Which signing mechanism the widget reuses. Only `magic-link` is supported today
+         * (shares MagicLinkKeyManager + the magic-link auth provider). Recorded so a future
+         * dedicated widget key is a config flip, not a code change.
+         */
+        signingReuse: z.ZodDefault<z.ZodOptional<z.ZodEnum<["magic-link"]>>>;
+        /**
+         * Audience claim for minted guest JWTs. MUST equal the magic-link audience so the
+         * auto-registered `magic-link` auth provider validates widget tokens.
+         */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Email of the shared Anonymous principal used in guest claims (resolves the synthesized guest user). */
+        anonymousEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Fallback session-token TTL (minutes) when a widget instance does not set its own. */
+        defaultSessionTtlMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Fallback mint rate-limit (per IP per window) when a widget instance does not set its own. */
+        defaultRateLimitPerMinute: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Rate-limit window (ms) for the public /widget/session endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Server-wide default hard ceiling (minutes) on a voice session when an instance omits one (W4). */
+        voiceDefaultMaxSessionMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Email/name of the internal user whose context READS widget config at mint time (falls back to system/Owner). */
+        contextUserForLookup: z.ZodOptional<z.ZodString>;
+        /**
+         * Host-identity public keys (PEM), keyed by widget PublicKey, for the `host-identity` auth
+         * strategy (D1). The host signs a short-lived RS256 assertion; the mint verifies it against
+         * the key here. INTERIM location — production should store the host key per widget instance
+         * (a HostPublicKey column on WidgetInstance, pending a migration). When a widget's strategy is
+         * HostIdentity and no key is configured here, host mints fail closed.
+         */
+        hostPublicKeys: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        /**
+         * Returning-visitor identity-resolution target (RV4). When a visitor verifies (magic-link upgrade)
+         * or a host asserts their identity, their email is resolved to a record `(entityName, recordId)`
+         * and prior anonymous memory is merged onto that polymorphic pair. Deployment-configurable so the
+         * resolved record need NOT be an MJ User — point it at any entity that carries the visitor's email
+         * (e.g. a CRM `Persons` table). Defaults to the core `Users` entity keyed by `Email`.
+         */
+        identityResolution: z.ZodOptional<z.ZodObject<{
+            entityName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            emailField: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            entityName?: string;
+            emailField?: string;
+        }, {
+            entityName?: string;
+            emailField?: string;
+        }>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    telephony: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Twilio Programmable Voice + Media Streams binding. */
+        twilio: z.ZodOptional<z.ZodObject<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Vonage Voice + WebSocket-media binding. */
+        vonage: z.ZodOptional<z.ZodObject<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** RingCentral Call Control + media-stream binding. */
+        ringcentral: z.ZodOptional<z.ZodObject<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+        teams: z.ZodOptional<z.ZodObject<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Twilio Programmable Voice + Media Streams binding. */
+        twilio: z.ZodOptional<z.ZodObject<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Vonage Voice + WebSocket-media binding. */
+        vonage: z.ZodOptional<z.ZodObject<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** RingCentral Call Control + media-stream binding. */
+        ringcentral: z.ZodOptional<z.ZodObject<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+        teams: z.ZodOptional<z.ZodObject<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Twilio Programmable Voice + Media Streams binding. */
+        twilio: z.ZodOptional<z.ZodObject<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Twilio Account SID (`AC…`). */
+            accountSid: z.ZodString;
+            /** Account auth token — REST auth (when no API key pair) AND the HMAC key for X-Twilio-Signature verification. */
+            authToken: z.ZodOptional<z.ZodString>;
+            /** API Key SID (`SK…`) — preferred over the auth token for REST auth when paired with apiKeySecret. */
+            apiKeySid: z.ZodOptional<z.ZodString>;
+            /** API Key secret — paired with apiKeySid. */
+            apiKeySecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
+            streamPublicUrl: z.ZodString;
+            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            webhookSigningSecret: z.ZodOptional<z.ZodString>;
+            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Vonage Voice + WebSocket-media binding. */
+        vonage: z.ZodOptional<z.ZodObject<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
+            applicationId: z.ZodOptional<z.ZodString>;
+            /** The application's RSA private key (PEM) used to sign Voice-API JWTs. */
+            privateKey: z.ZodOptional<z.ZodString>;
+            /** Account API key — used for key-scoped operations when no application credential pair is supplied. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** Account API secret — paired with apiKey. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** The publicly reachable `wss://…/telephony/vonage/media` URL the call's connect NCCO opens. */
+            mediaPublicUrl: z.ZodString;
+            /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
+            signatureSecret: z.ZodOptional<z.ZodString>;
+            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            eventUrl: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** RingCentral Call Control + media-stream binding. */
+        ringcentral: z.ZodOptional<z.ZodObject<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** SIP domain (e.g. `sip.ringcentral.com`). */
+            sipDomain: z.ZodString;
+            /** SIP outbound proxy (`host:port`, e.g. `sip10.ringcentral.com:5096`). */
+            sipOutboundProxy: z.ZodString;
+            /** SIP auth username (the device's phone number / extension). */
+            sipUsername: z.ZodString;
+            /** SIP auth password (resolved upstream — never inlined). */
+            sipPassword: z.ZodString;
+            /** SIP authorization id (the device's RingCentral authorization id). */
+            sipAuthorizationId: z.ZodString;
+            /** Codec to negotiate. Defaults to `OPUS/16000` (clean wideband PCM16 — the least-friction realtime path). */
+            codec: z.ZodOptional<z.ZodEnum<["OPUS/16000", "OPUS/48000/2", "PCMU/8000"]>>;
+            /** Skip TLS cert validation (sandbox/test only — never in production). */
+            ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+        /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
+        teams: z.ZodOptional<z.ZodObject<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch for the Teams meetings ingress. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** The bot's Azure AD application (client) id (resolved upstream; carried for diagnostics). */
+            appId: z.ZodOptional<z.ZodString>;
+            /** The Azure tenant id the bot operates in. */
+            tenantId: z.ZodOptional<z.ZodString>;
+            /** A pre-resolved OAuth bearer / application token for the bot's Graph calls (resolved upstream — never inline). */
+            botAccessToken: z.ZodOptional<z.ZodString>;
+            /** The shared secret set as `clientState` on the Graph subscription; gates the change-notification webhook. */
+            notificationClientState: z.ZodOptional<z.ZodString>;
+            /** The ACS application-hosted-media PCM sample rate (Hz) the audio plane negotiates. Defaults to 16000. */
+            acsSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
+            modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
         requestTimeout: z.ZodNumber;
@@ -1127,55 +2754,6 @@ declare const configInfoSchema: z.ZodObject<{
         includeSchemas?: string[];
         excludeSchemas?: string[];
     }>>>;
-    askSkip: z.ZodOptional<z.ZodObject<{
-        url: z.ZodOptional<z.ZodString>;
-        apiKey: z.ZodOptional<z.ZodString>;
-        orgID: z.ZodOptional<z.ZodString>;
-        organizationInfo: z.ZodOptional<z.ZodString>;
-        entitiesToSend: z.ZodOptional<z.ZodObject<{
-            excludeSchemas: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            includeEntitiesFromExcludedSchemas: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        }, {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        }>>;
-        chatURL: z.ZodOptional<z.ZodString>;
-        learningCycleRunUponStartup: z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>;
-        learningCycleEnabled: z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>;
-        learningCycleURL: z.ZodOptional<z.ZodString>;
-        learningCycleIntervalInMinutes: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        url?: string;
-        apiKey?: string;
-        orgID?: string;
-        organizationInfo?: string;
-        entitiesToSend?: {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        };
-        chatURL?: string;
-        learningCycleRunUponStartup?: boolean;
-        learningCycleEnabled?: boolean;
-        learningCycleURL?: string;
-        learningCycleIntervalInMinutes?: number;
-    }, {
-        url?: string;
-        apiKey?: string;
-        orgID?: string;
-        organizationInfo?: string;
-        entitiesToSend?: {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        };
-        chatURL?: string;
-        learningCycleRunUponStartup?: string | number | boolean;
-        learningCycleEnabled?: string | number | boolean;
-        learningCycleURL?: string;
-        learningCycleIntervalInMinutes?: number;
-    }>>;
     sqlLogging: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         defaultOptions: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -1695,6 +3273,73 @@ declare const configInfoSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
+    widget?: {
+        enabled?: boolean;
+        audience?: string;
+        rateLimitWindowMs?: number;
+        signingReuse?: "magic-link";
+        anonymousEmail?: string;
+        defaultSessionTtlMinutes?: number;
+        defaultRateLimitPerMinute?: number;
+        voiceDefaultMaxSessionMinutes?: number;
+        contextUserForLookup?: string;
+        hostPublicKeys?: Record<string, string>;
+        identityResolution?: {
+            entityName?: string;
+            emailField?: string;
+        };
+    } & {
+        [k: string]: unknown;
+    };
+    telephony?: {
+        enabled?: boolean;
+        twilio?: {
+            accountSid?: string;
+            authToken?: string;
+            apiKeySid?: string;
+            apiKeySecret?: string;
+            streamPublicUrl?: string;
+            webhookSigningSecret?: string;
+            statusCallbackUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        vonage?: {
+            apiKey?: string;
+            applicationId?: string;
+            privateKey?: string;
+            apiSecret?: string;
+            mediaPublicUrl?: string;
+            signatureSecret?: string;
+            eventUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        ringcentral?: {
+            sipDomain?: string;
+            sipOutboundProxy?: string;
+            sipUsername?: string;
+            sipPassword?: string;
+            sipAuthorizationId?: string;
+            codec?: "OPUS/16000" | "OPUS/48000/2" | "PCMU/8000";
+            ignoreTlsCertErrors?: boolean;
+        } & {
+            [k: string]: unknown;
+        };
+        teams?: {
+            enabled?: boolean;
+            tenantId?: string;
+            appId?: string;
+            botAccessToken?: string;
+            notificationClientState?: string;
+            acsSampleRate?: number;
+            modelSampleRate?: number;
+        } & {
+            [k: string]: unknown;
+        };
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -1718,21 +3363,6 @@ declare const configInfoSchema: z.ZodObject<{
         includeSchemas?: string[];
         excludeSchemas?: string[];
     };
-    askSkip?: {
-        url?: string;
-        apiKey?: string;
-        orgID?: string;
-        organizationInfo?: string;
-        entitiesToSend?: {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        };
-        chatURL?: string;
-        learningCycleRunUponStartup?: boolean;
-        learningCycleEnabled?: boolean;
-        learningCycleURL?: string;
-        learningCycleIntervalInMinutes?: number;
-    };
     sqlLogging?: {
         enabled?: boolean;
         defaultOptions?: {
@@ -1915,6 +3545,73 @@ declare const configInfoSchema: z.ZodObject<{
     } & {
         [k: string]: unknown;
     };
+    widget?: {
+        enabled?: string | number | boolean;
+        audience?: string;
+        rateLimitWindowMs?: number;
+        signingReuse?: "magic-link";
+        anonymousEmail?: string;
+        defaultSessionTtlMinutes?: number;
+        defaultRateLimitPerMinute?: number;
+        voiceDefaultMaxSessionMinutes?: number;
+        contextUserForLookup?: string;
+        hostPublicKeys?: Record<string, string>;
+        identityResolution?: {
+            entityName?: string;
+            emailField?: string;
+        };
+    } & {
+        [k: string]: unknown;
+    };
+    telephony?: {
+        enabled?: string | number | boolean;
+        twilio?: {
+            accountSid?: string;
+            authToken?: string;
+            apiKeySid?: string;
+            apiKeySecret?: string;
+            streamPublicUrl?: string;
+            webhookSigningSecret?: string;
+            statusCallbackUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        vonage?: {
+            apiKey?: string;
+            applicationId?: string;
+            privateKey?: string;
+            apiSecret?: string;
+            mediaPublicUrl?: string;
+            signatureSecret?: string;
+            eventUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        ringcentral?: {
+            sipDomain?: string;
+            sipOutboundProxy?: string;
+            sipUsername?: string;
+            sipPassword?: string;
+            sipAuthorizationId?: string;
+            codec?: "OPUS/16000" | "OPUS/48000/2" | "PCMU/8000";
+            ignoreTlsCertErrors?: string | number | boolean;
+        } & {
+            [k: string]: unknown;
+        };
+        teams?: {
+            enabled?: string | number | boolean;
+            tenantId?: string;
+            appId?: string;
+            botAccessToken?: string;
+            notificationClientState?: string;
+            acsSampleRate?: number;
+            modelSampleRate?: number;
+        } & {
+            [k: string]: unknown;
+        };
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -1938,21 +3635,6 @@ declare const configInfoSchema: z.ZodObject<{
         includeSchemas?: string[];
         excludeSchemas?: string[];
     };
-    askSkip?: {
-        url?: string;
-        apiKey?: string;
-        orgID?: string;
-        organizationInfo?: string;
-        entitiesToSend?: {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        };
-        chatURL?: string;
-        learningCycleRunUponStartup?: string | number | boolean;
-        learningCycleEnabled?: string | number | boolean;
-        learningCycleURL?: string;
-        learningCycleIntervalInMinutes?: number;
-    };
     sqlLogging?: {
         enabled?: boolean;
         defaultOptions?: {
@@ -2103,10 +3785,15 @@ declare const configInfoSchema: z.ZodObject<{
 }>;
 export type UserHandlingInfo = z.infer<typeof userHandlingInfoSchema>;
 export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
+export type WidgetConfig = z.infer<typeof widgetSchema>;
+export type TelephonyConfig = z.infer<typeof telephonySchema>;
+export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
+export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
+export type RingCentralTelephonyConfig = z.infer<typeof ringcentralTelephonySchema>;
+export type TeamsMeetingsConfig = z.infer<typeof teamsMeetingsSchema>;
 export type DatabaseSettingsInfo = z.infer<typeof databaseSettingsInfoSchema>;
 export type ViewingSystemSettingsInfo = z.infer<typeof viewingSystemInfoSchema>;
 export type RESTApiOptions = z.infer<typeof restApiOptionsSchema>;
-export type AskSkipInfo = z.infer<typeof askSkipInfoSchema>;
 export type SqlLoggingOptions = z.infer<typeof sqlLoggingOptionsSchema>;
 export type SqlLoggingInfo = z.infer<typeof sqlLoggingSchema>;
 export type AuthProviderConfig = z.infer<typeof authProviderSchema>;
@@ -2186,6 +3873,73 @@ export declare function loadConfig(): {
     } & {
         [k: string]: unknown;
     };
+    widget?: {
+        enabled?: boolean;
+        audience?: string;
+        rateLimitWindowMs?: number;
+        signingReuse?: "magic-link";
+        anonymousEmail?: string;
+        defaultSessionTtlMinutes?: number;
+        defaultRateLimitPerMinute?: number;
+        voiceDefaultMaxSessionMinutes?: number;
+        contextUserForLookup?: string;
+        hostPublicKeys?: Record<string, string>;
+        identityResolution?: {
+            entityName?: string;
+            emailField?: string;
+        };
+    } & {
+        [k: string]: unknown;
+    };
+    telephony?: {
+        enabled?: boolean;
+        twilio?: {
+            accountSid?: string;
+            authToken?: string;
+            apiKeySid?: string;
+            apiKeySecret?: string;
+            streamPublicUrl?: string;
+            webhookSigningSecret?: string;
+            statusCallbackUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        vonage?: {
+            apiKey?: string;
+            applicationId?: string;
+            privateKey?: string;
+            apiSecret?: string;
+            mediaPublicUrl?: string;
+            signatureSecret?: string;
+            eventUrl?: string;
+        } & {
+            [k: string]: unknown;
+        };
+        ringcentral?: {
+            sipDomain?: string;
+            sipOutboundProxy?: string;
+            sipUsername?: string;
+            sipPassword?: string;
+            sipAuthorizationId?: string;
+            codec?: "OPUS/16000" | "OPUS/48000/2" | "PCMU/8000";
+            ignoreTlsCertErrors?: boolean;
+        } & {
+            [k: string]: unknown;
+        };
+        teams?: {
+            enabled?: boolean;
+            tenantId?: string;
+            appId?: string;
+            botAccessToken?: string;
+            notificationClientState?: string;
+            acsSampleRate?: number;
+            modelSampleRate?: number;
+        } & {
+            [k: string]: unknown;
+        };
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -2209,21 +3963,6 @@ export declare function loadConfig(): {
         includeSchemas?: string[];
         excludeSchemas?: string[];
     };
-    askSkip?: {
-        url?: string;
-        apiKey?: string;
-        orgID?: string;
-        organizationInfo?: string;
-        entitiesToSend?: {
-            excludeSchemas?: string[];
-            includeEntitiesFromExcludedSchemas?: string[];
-        };
-        chatURL?: string;
-        learningCycleRunUponStartup?: boolean;
-        learningCycleEnabled?: boolean;
-        learningCycleURL?: string;
-        learningCycleIntervalInMinutes?: number;
-    };
     sqlLogging?: {
         enabled?: boolean;
         defaultOptions?: {