@memberjunction/server 6.2.0-edge.1 → 6.2.0-edge.3

package/dist/config.d.ts

@@ -610,12 +610,12 @@ declare const rateLimitSchema: z.ZodObject<{
         maxRequests?: number;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
     global?: {
         message?: string;
         windowMs?: number;
         maxRequests?: number;
     };
-    enabled?: boolean;
     graphql?: {
         windowMs?: number;
         maxRequests?: number;
@@ -625,12 +625,12 @@ declare const rateLimitSchema: z.ZodObject<{
         maxAttempts?: number;
     };
 }, {
+    enabled?: boolean;
     global?: {
         message?: string;
         windowMs?: number;
         maxRequests?: number;
     };
-    enabled?: boolean;
     graphql?: {
         windowMs?: number;
         maxRequests?: number;
@@ -1083,10 +1083,20 @@ declare const twilioTelephonySchema: z.ZodObject<{
     apiKeySecret: z.ZodOptional<z.ZodString>;
     /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
     streamPublicUrl: z.ZodString;
-    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    /**
+     * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+     * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+     */
     webhookSigningSecret: z.ZodOptional<z.ZodString>;
-    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    /**
+     * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+     * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+     */
     statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+    amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Twilio Account SID (`AC…`). */
     accountSid: z.ZodString;
@@ -1098,10 +1108,20 @@ declare const twilioTelephonySchema: z.ZodObject<{
     apiKeySecret: z.ZodOptional<z.ZodString>;
     /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
     streamPublicUrl: z.ZodString;
-    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    /**
+     * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+     * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+     */
     webhookSigningSecret: z.ZodOptional<z.ZodString>;
-    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    /**
+     * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+     * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+     */
     statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+    amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Twilio Account SID (`AC…`). */
     accountSid: z.ZodString;
@@ -1113,10 +1133,20 @@ declare const twilioTelephonySchema: z.ZodObject<{
     apiKeySecret: z.ZodOptional<z.ZodString>;
     /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
     streamPublicUrl: z.ZodString;
-    /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+    /**
+     * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+     * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+     */
     webhookSigningSecret: z.ZodOptional<z.ZodString>;
-    /** Optional status-callback URL Twilio posts call lifecycle events to. */
+    /**
+     * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+     * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+     */
     statusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+    amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, z.ZodTypeAny, "passthrough">>;
 /**
  * Vonage Voice + WebSocket-media telephony binding. Voice-API auth is application-scoped
@@ -1137,8 +1167,14 @@ declare const vonageTelephonySchema: z.ZodObject<{
     mediaPublicUrl: z.ZodString;
     /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
     signatureSecret: z.ZodOptional<z.ZodString>;
-    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    /**
+     * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+     * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+     * unanswered / failed / completed.
+     */
     eventUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
     applicationId: z.ZodOptional<z.ZodString>;
@@ -1152,8 +1188,14 @@ declare const vonageTelephonySchema: z.ZodObject<{
     mediaPublicUrl: z.ZodString;
     /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
     signatureSecret: z.ZodOptional<z.ZodString>;
-    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    /**
+     * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+     * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+     * unanswered / failed / completed.
+     */
     eventUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
     applicationId: z.ZodOptional<z.ZodString>;
@@ -1167,8 +1209,14 @@ declare const vonageTelephonySchema: z.ZodObject<{
     mediaPublicUrl: z.ZodString;
     /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
     signatureSecret: z.ZodOptional<z.ZodString>;
-    /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+    /**
+     * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+     * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+     * unanswered / failed / completed.
+     */
     eventUrl: z.ZodOptional<z.ZodString>;
+    /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+    onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
 }, z.ZodTypeAny, "passthrough">>;
 /**
  * RingCentral telephony binding: **SIP device credentials** for the headless softphone (the
@@ -1279,9 +1327,237 @@ declare const teamsMeetingsSchema: z.ZodObject<{
     /** The realtime model's PCM16 sample rate (Hz) the binding resamples to/from. Defaults to 16000. */
     modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * LiveKit SIP binding: phone calls carried by a SIP trunk and landed in a LiveKit room (every conversation lives in a room;
+ * the carrier is only the pipe). LiveKit credentials default to the `LIVEKIT_URL` / `LIVEKIT_API_KEY` /
+ * `LIVEKIT_API_SECRET` env vars the Meet room already uses. When `livekitSip` is omitted, the LiveKit SIP webhook is not mounted.
+ * Point a LiveKit project webhook at `<public URL>/telephony/livekit-sip/webhook` (the signature is verified with the API secret).
+ */
+declare const livekitSipTelephonySchema: z.ZodObject<{
+    /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+    serverUrl: z.ZodOptional<z.ZodString>;
+    /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+    roomPrefix: z.ZodOptional<z.ZodString>;
+    /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+    numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The LiveKit inbound trunk id, when created by hand. */
+    inboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+    outboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The caller ID presented on calls dialed out through the outbound trunk. */
+    outboundFromNumber: z.ZodOptional<z.ZodString>;
+    /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+    autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+    allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+    carrier: z.ZodOptional<z.ZodObject<{
+        type: z.ZodLiteral<"twilio-elastic-sip">;
+        /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+        originationUri: z.ZodOptional<z.ZodString>;
+        /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+        terminationUri: z.ZodOptional<z.ZodString>;
+        /** How Twilio authenticates LiveKit's outbound requests. */
+        terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+        /** The Twilio numbers associated with the trunk (E.164). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+    serverUrl: z.ZodOptional<z.ZodString>;
+    /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+    roomPrefix: z.ZodOptional<z.ZodString>;
+    /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+    numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The LiveKit inbound trunk id, when created by hand. */
+    inboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+    outboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The caller ID presented on calls dialed out through the outbound trunk. */
+    outboundFromNumber: z.ZodOptional<z.ZodString>;
+    /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+    autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+    allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+    carrier: z.ZodOptional<z.ZodObject<{
+        type: z.ZodLiteral<"twilio-elastic-sip">;
+        /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+        originationUri: z.ZodOptional<z.ZodString>;
+        /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+        terminationUri: z.ZodOptional<z.ZodString>;
+        /** How Twilio authenticates LiveKit's outbound requests. */
+        terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+        /** The Twilio numbers associated with the trunk (E.164). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+    serverUrl: z.ZodOptional<z.ZodString>;
+    /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+    apiKey: z.ZodOptional<z.ZodString>;
+    /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+    apiSecret: z.ZodOptional<z.ZodString>;
+    /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+    roomPrefix: z.ZodOptional<z.ZodString>;
+    /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+    numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The LiveKit inbound trunk id, when created by hand. */
+    inboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+    outboundTrunkId: z.ZodOptional<z.ZodString>;
+    /** The caller ID presented on calls dialed out through the outbound trunk. */
+    outboundFromNumber: z.ZodOptional<z.ZodString>;
+    /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+    autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+    /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+    allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+    carrier: z.ZodOptional<z.ZodObject<{
+        type: z.ZodLiteral<"twilio-elastic-sip">;
+        /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+        originationUri: z.ZodOptional<z.ZodString>;
+        /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+        terminationUri: z.ZodOptional<z.ZodString>;
+        /** How Twilio authenticates LiveKit's outbound requests. */
+        terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+        /** The Twilio numbers associated with the trunk (E.164). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }, {
+        type?: "twilio-elastic-sip";
+        numbers?: string[];
+        originationUri?: string;
+        terminationUri?: string;
+        terminationAuth?: "credential-list" | "ip-acl";
+    }>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const telephonySchema: z.ZodObject<{
     /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+     * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+     * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+     * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+     */
+    inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+    /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+    maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+     * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+     * model plan's concurrent-session limit. Defaults to 25.
+     */
+    maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+    outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+     * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+     * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+     * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+     * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+     * and logged. Empty (the default) means the agent cannot hand calls over at all.
+     */
+    transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+        number: z.ZodOptional<z.ZodString>;
+        userEmail: z.ZodOptional<z.ZodString>;
+        fallbackNumber: z.ZodOptional<z.ZodString>;
+        agentName: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }>, "many">>>;
     /** Twilio Programmable Voice + Media Streams binding. */
     twilio: z.ZodOptional<z.ZodObject<{
         /** Twilio Account SID (`AC…`). */
@@ -1294,10 +1570,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1309,10 +1595,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1324,10 +1620,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** Vonage Voice + WebSocket-media binding. */
     vonage: z.ZodOptional<z.ZodObject<{
@@ -1343,8 +1649,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1358,8 +1670,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1373,8 +1691,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** RingCentral Call Control + media-stream binding. */
     ringcentral: z.ZodOptional<z.ZodObject<{
@@ -1423,6 +1747,143 @@ declare const telephonySchema: z.ZodObject<{
         /** Skip TLS cert validation (sandbox/test only — never in production). */
         ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
     }, z.ZodTypeAny, "passthrough">>>;
+    /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+    livekitSip: z.ZodOptional<z.ZodObject<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">>>;
     /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
     teams: z.ZodOptional<z.ZodObject<{
         /** Master switch for the Teams meetings ingress. */
@@ -1473,6 +1934,92 @@ declare const telephonySchema: z.ZodObject<{
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+     * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+     * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+     * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+     */
+    inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+    /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+    maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+     * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+     * model plan's concurrent-session limit. Defaults to 25.
+     */
+    maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+    outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+     * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+     * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+     * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+     * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+     * and logged. Empty (the default) means the agent cannot hand calls over at all.
+     */
+    transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+        number: z.ZodOptional<z.ZodString>;
+        userEmail: z.ZodOptional<z.ZodString>;
+        fallbackNumber: z.ZodOptional<z.ZodString>;
+        agentName: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }>, "many">>>;
     /** Twilio Programmable Voice + Media Streams binding. */
     twilio: z.ZodOptional<z.ZodObject<{
         /** Twilio Account SID (`AC…`). */
@@ -1485,10 +2032,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1500,10 +2057,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1515,10 +2082,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** Vonage Voice + WebSocket-media binding. */
     vonage: z.ZodOptional<z.ZodObject<{
@@ -1534,8 +2111,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1549,8 +2132,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1564,8 +2153,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** RingCentral Call Control + media-stream binding. */
     ringcentral: z.ZodOptional<z.ZodObject<{
@@ -1614,6 +2209,143 @@ declare const telephonySchema: z.ZodObject<{
         /** Skip TLS cert validation (sandbox/test only — never in production). */
         ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
     }, z.ZodTypeAny, "passthrough">>>;
+    /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+    livekitSip: z.ZodOptional<z.ZodObject<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">>>;
     /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
     teams: z.ZodOptional<z.ZodObject<{
         /** Master switch for the Teams meetings ingress. */
@@ -1664,6 +2396,92 @@ declare const telephonySchema: z.ZodObject<{
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+     * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+     * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+     * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+     */
+    inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+    /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+    maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+     * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+     * model plan's concurrent-session limit. Defaults to 25.
+     */
+    maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+    outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+        allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+         * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+         * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+         * Setting this REPLACES that list.
+         */
+        blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+        maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+     * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+     * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+     * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+     * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+     * and logged. Empty (the default) means the agent cannot hand calls over at all.
+     */
+    transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+        number: z.ZodOptional<z.ZodString>;
+        userEmail: z.ZodOptional<z.ZodString>;
+        fallbackNumber: z.ZodOptional<z.ZodString>;
+        agentName: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }, {
+        number?: string;
+        name?: string;
+        kind?: "number" | "user" | "agent";
+        userEmail?: string;
+        fallbackNumber?: string;
+        agentName?: string;
+        description?: string;
+    }>, "many">>>;
     /** Twilio Programmable Voice + Media Streams binding. */
     twilio: z.ZodOptional<z.ZodObject<{
         /** Twilio Account SID (`AC…`). */
@@ -1676,10 +2494,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1691,10 +2519,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Twilio Account SID (`AC…`). */
         accountSid: z.ZodString;
@@ -1706,10 +2544,20 @@ declare const telephonySchema: z.ZodObject<{
         apiKeySecret: z.ZodOptional<z.ZodString>;
         /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
         streamPublicUrl: z.ZodString;
-        /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+        /**
+         * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+         * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+         */
         webhookSigningSecret: z.ZodOptional<z.ZodString>;
-        /** Optional status-callback URL Twilio posts call lifecycle events to. */
+        /**
+         * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+         * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+         */
         statusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+        amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** Vonage Voice + WebSocket-media binding. */
     vonage: z.ZodOptional<z.ZodObject<{
@@ -1725,8 +2573,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1740,8 +2594,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
         applicationId: z.ZodOptional<z.ZodString>;
@@ -1755,8 +2615,14 @@ declare const telephonySchema: z.ZodObject<{
         mediaPublicUrl: z.ZodString;
         /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
         signatureSecret: z.ZodOptional<z.ZodString>;
-        /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+        /**
+         * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+         * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+         * unanswered / failed / completed.
+         */
         eventUrl: z.ZodOptional<z.ZodString>;
+        /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+        onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
     }, z.ZodTypeAny, "passthrough">>>;
     /** RingCentral Call Control + media-stream binding. */
     ringcentral: z.ZodOptional<z.ZodObject<{
@@ -1805,6 +2671,143 @@ declare const telephonySchema: z.ZodObject<{
         /** Skip TLS cert validation (sandbox/test only — never in production). */
         ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
     }, z.ZodTypeAny, "passthrough">>>;
+    /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+    livekitSip: z.ZodOptional<z.ZodObject<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+        serverUrl: z.ZodOptional<z.ZodString>;
+        /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+        apiKey: z.ZodOptional<z.ZodString>;
+        /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+        apiSecret: z.ZodOptional<z.ZodString>;
+        /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+        roomPrefix: z.ZodOptional<z.ZodString>;
+        /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+        numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The LiveKit inbound trunk id, when created by hand. */
+        inboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+        outboundTrunkId: z.ZodOptional<z.ZodString>;
+        /** The caller ID presented on calls dialed out through the outbound trunk. */
+        outboundFromNumber: z.ZodOptional<z.ZodString>;
+        /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+        autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+        /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+        allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+        carrier: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"twilio-elastic-sip">;
+            /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+            originationUri: z.ZodOptional<z.ZodString>;
+            /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+            terminationUri: z.ZodOptional<z.ZodString>;
+            /** How Twilio authenticates LiveKit's outbound requests. */
+            terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+            /** The Twilio numbers associated with the trunk (E.164). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }, {
+            type?: "twilio-elastic-sip";
+            numbers?: string[];
+            originationUri?: string;
+            terminationUri?: string;
+            terminationAuth?: "credential-list" | "ip-acl";
+        }>>;
+    }, z.ZodTypeAny, "passthrough">>>;
     /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
     teams: z.ZodOptional<z.ZodObject<{
         /** Master switch for the Teams meetings ingress. */
@@ -2268,6 +3271,92 @@ declare const configInfoSchema: z.ZodObject<{
     telephony: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+         * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+         * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+         * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+         */
+        inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+        /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+        maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+         * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+         * model plan's concurrent-session limit. Defaults to 25.
+         */
+        maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+        outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+         * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+         * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+         * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+         * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+         * and logged. Empty (the default) means the agent cannot hand calls over at all.
+         */
+        transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+            number: z.ZodOptional<z.ZodString>;
+            userEmail: z.ZodOptional<z.ZodString>;
+            fallbackNumber: z.ZodOptional<z.ZodString>;
+            agentName: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }>, "many">>>;
         /** Twilio Programmable Voice + Media Streams binding. */
         twilio: z.ZodOptional<z.ZodObject<{
             /** Twilio Account SID (`AC…`). */
@@ -2280,10 +3369,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2295,10 +3394,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2310,10 +3419,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** Vonage Voice + WebSocket-media binding. */
         vonage: z.ZodOptional<z.ZodObject<{
@@ -2329,8 +3448,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2344,8 +3469,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2359,8 +3490,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** RingCentral Call Control + media-stream binding. */
         ringcentral: z.ZodOptional<z.ZodObject<{
@@ -2409,6 +3546,143 @@ declare const configInfoSchema: z.ZodObject<{
             /** Skip TLS cert validation (sandbox/test only — never in production). */
             ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
         }, z.ZodTypeAny, "passthrough">>>;
+        /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+        livekitSip: z.ZodOptional<z.ZodObject<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">>>;
         /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
         teams: z.ZodOptional<z.ZodObject<{
             /** Master switch for the Teams meetings ingress. */
@@ -2459,6 +3733,92 @@ declare const configInfoSchema: z.ZodObject<{
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+         * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+         * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+         * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+         */
+        inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+        /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+        maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+         * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+         * model plan's concurrent-session limit. Defaults to 25.
+         */
+        maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+        outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+         * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+         * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+         * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+         * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+         * and logged. Empty (the default) means the agent cannot hand calls over at all.
+         */
+        transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+            number: z.ZodOptional<z.ZodString>;
+            userEmail: z.ZodOptional<z.ZodString>;
+            fallbackNumber: z.ZodOptional<z.ZodString>;
+            agentName: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }>, "many">>>;
         /** Twilio Programmable Voice + Media Streams binding. */
         twilio: z.ZodOptional<z.ZodObject<{
             /** Twilio Account SID (`AC…`). */
@@ -2471,10 +3831,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2486,10 +3856,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2501,10 +3881,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** Vonage Voice + WebSocket-media binding. */
         vonage: z.ZodOptional<z.ZodObject<{
@@ -2520,8 +3910,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2535,8 +3931,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2550,8 +3952,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** RingCentral Call Control + media-stream binding. */
         ringcentral: z.ZodOptional<z.ZodObject<{
@@ -2600,6 +4008,143 @@ declare const configInfoSchema: z.ZodObject<{
             /** Skip TLS cert validation (sandbox/test only — never in production). */
             ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
         }, z.ZodTypeAny, "passthrough">>>;
+        /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+        livekitSip: z.ZodOptional<z.ZodObject<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">>>;
         /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
         teams: z.ZodOptional<z.ZodObject<{
             /** Master switch for the Teams meetings ingress. */
@@ -2650,6 +4195,92 @@ declare const configInfoSchema: z.ZodObject<{
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch. When false (or when no vendor block is present), telephony routes are not mounted. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * Email of the user INBOUND calls run as. A caller is an anonymous member of the public, so the call needs a
+         * principal to create its agent session and run the agent. Point this at a DEDICATED LEAST-PRIVILEGE user.
+         * There is deliberately no fallback: if unset, unknown, inactive, or the system user, inbound calls are
+         * rejected with a polite message and the rejection is logged. Applies to Twilio, Vonage and RingCentral.
+         */
+        inboundRunAsUserEmail: z.ZodOptional<z.ZodString>;
+        /** Maximum length of one phone call, in seconds. The bridge session is stopped (and the call hung up) at the cap. Defaults to 1800. */
+        maxCallSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most phone calls (every carrier together, both directions) the server carries at once. Past it an inbound
+         * caller hears "all agents are busy" and an outbound request is refused. Keep it at or below the realtime
+         * model plan's concurrent-session limit. Defaults to 25.
+         */
+        maxConcurrentCalls: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Outbound destination policy + per-user rate limit (see {@link outboundTelephonySchema}). */
+        outbound: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Destination prefixes a call may go to (E.164, e.g. `+1`). An empty list refuses every destination. Defaults to `['+1']`. */
+            allowedPrefixes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            /**
+             * Destination prefixes that are always refused, even when an allowed prefix matches. Deliberately has NO default
+             * here: when omitted, `@memberjunction/telephony-adapters` applies its own `DEFAULT_BLOCKED_PREFIXES` (NANP
+             * premium-rate plus the Caribbean +1 countries abused for toll fraud), so the list lives in exactly one place.
+             * Setting this REPLACES that list.
+             */
+            blockedPrefixes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Max outbound calls one user may place per rolling hour (per process). Defaults to 20. */
+            maxCallsPerUserPerHour: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * The places the agent may hand a live call to, by name (the agent names a target, never a number, an email or an agent
+         * id). `kind` is `number` (the default; a phone number), `user` (a person at an Explorer console, who may accept or
+         * decline; `userEmail`, optional `fallbackNumber` the room dials if they do not take it) or `agent` (another MJ AI agent,
+         * by `agentName`). `user` and `agent` targets work on calls that live in a LiveKit room; a carrier call can only transfer to
+         * a `number`. Every number is validated at startup against the outbound allow/block lists; an invalid entry is dropped
+         * and logged. Empty (the default) means the agent cannot hand calls over at all.
+         */
+        transferTargets: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<["number", "user", "agent"]>>;
+            number: z.ZodOptional<z.ZodString>;
+            userEmail: z.ZodOptional<z.ZodString>;
+            fallbackNumber: z.ZodOptional<z.ZodString>;
+            agentName: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }, {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }>, "many">>>;
         /** Twilio Programmable Voice + Media Streams binding. */
         twilio: z.ZodOptional<z.ZodObject<{
             /** Twilio Account SID (`AC…`). */
@@ -2662,10 +4293,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2677,10 +4318,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Twilio Account SID (`AC…`). */
             accountSid: z.ZodString;
@@ -2692,10 +4343,20 @@ declare const configInfoSchema: z.ZodObject<{
             apiKeySecret: z.ZodOptional<z.ZodString>;
             /** The publicly reachable `wss://…/telephony/twilio/media` URL Twilio's <Connect><Stream> connects to. */
             streamPublicUrl: z.ZodString;
-            /** Optional shared secret gating the public webhook/WSS endpoints (defense-in-depth beyond signature verification). */
+            /**
+             * Reserved; currently unused. The Media-Streams websocket is authenticated by a per-call token MJ mints and
+             * embeds in the TwiML (`<Parameter name="mjToken">`), and webhooks by `X-Twilio-Signature`.
+             */
             webhookSigningSecret: z.ZodOptional<z.ZodString>;
-            /** Optional status-callback URL Twilio posts call lifecycle events to. */
+            /**
+             * URL Twilio posts outbound-call lifecycle events to. Defaults to `<public URL>/telephony/twilio/status`, the
+             * route that ends the bridge session when a call is busy / unanswered / failed / completed.
+             */
             statusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** URL Twilio posts the async answering-machine verdict to. Defaults to `<public URL>/telephony/twilio/amd`. */
+            amdStatusCallbackUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine or fax answers an outbound call: `hangup` (default) ends it, `continue` only logs the verdict. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** Vonage Voice + WebSocket-media binding. */
         vonage: z.ZodOptional<z.ZodObject<{
@@ -2711,8 +4372,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2726,8 +4393,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
             /** Vonage Application ID (UUID) — the JWT-auth identity for the Voice API. */
             applicationId: z.ZodOptional<z.ZodString>;
@@ -2741,8 +4414,14 @@ declare const configInfoSchema: z.ZodObject<{
             mediaPublicUrl: z.ZodString;
             /** Vonage account signature secret — HMAC key for signed-request `sig` AND HS256 webhook-JWT verification. */
             signatureSecret: z.ZodOptional<z.ZodString>;
-            /** Optional event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). */
+            /**
+             * Event-webhook URL Vonage posts call lifecycle events to (passed on outbound createCall). Defaults to
+             * `<public URL>/telephony/vonage/event`, the route that ends the bridge session when a call is busy /
+             * unanswered / failed / completed.
+             */
             eventUrl: z.ZodOptional<z.ZodString>;
+            /** What to do when a machine answers an outbound call — Vonage's `machine_detection`: `hangup` (default) or `continue`. */
+            onMachine: z.ZodOptional<z.ZodEnum<["hangup", "continue"]>>;
         }, z.ZodTypeAny, "passthrough">>>;
         /** RingCentral Call Control + media-stream binding. */
         ringcentral: z.ZodOptional<z.ZodObject<{
@@ -2791,6 +4470,143 @@ declare const configInfoSchema: z.ZodObject<{
             /** Skip TLS cert validation (sandbox/test only — never in production). */
             ignoreTlsCertErrors: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
         }, z.ZodTypeAny, "passthrough">>>;
+        /** LiveKit SIP binding: phone calls carried by a SIP trunk, landed in a LiveKit room. */
+        livekitSip: z.ZodOptional<z.ZodObject<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** LiveKit server URL (`wss://…`). Defaults to `LIVEKIT_URL`. */
+            serverUrl: z.ZodOptional<z.ZodString>;
+            /** LiveKit API key. Defaults to `LIVEKIT_API_KEY`. */
+            apiKey: z.ZodOptional<z.ZodString>;
+            /** LiveKit API secret (resolved upstream — never inlined). Defaults to `LIVEKIT_API_SECRET`. */
+            apiSecret: z.ZodOptional<z.ZodString>;
+            /** Inbound calls land in a room whose name starts with this. Defaults to `call-`. */
+            roomPrefix: z.ZodOptional<z.ZodString>;
+            /** The numbers (E.164) this deployment answers. Each routes to the agent identity registered for it (on the LiveKit provider). */
+            numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The LiveKit inbound trunk id, when created by hand. */
+            inboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The LiveKit OUTBOUND trunk used to dial out (outbound calls, fallback legs, transfers to a number). Dialing out is off without it. */
+            outboundTrunkId: z.ZodOptional<z.ZodString>;
+            /** The caller ID presented on calls dialed out through the outbound trunk. */
+            outboundFromNumber: z.ZodOptional<z.ZodString>;
+            /** Create the inbound trunk and dispatch rule at startup when missing (idempotent). Defaults to false. */
+            autoProvision: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>>;
+            /** Source addresses the inbound trunk accepts calls from (the carrier's SIP signalling addresses). Used when provisioning. */
+            allowedAddresses: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** The carrier behind the trunk, for configuration checks only (no carrier API is called). */
+            carrier: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"twilio-elastic-sip">;
+                /** The LiveKit SIP URI the Twilio trunk's origination URI points at, e.g. `sip:<project>.sip.livekit.cloud`. */
+                originationUri: z.ZodOptional<z.ZodString>;
+                /** The trunk's Termination SIP URI on Twilio (`<name>.pstn.twilio.com`). Needed only when dialing out. */
+                terminationUri: z.ZodOptional<z.ZodString>;
+                /** How Twilio authenticates LiveKit's outbound requests. */
+                terminationAuth: z.ZodOptional<z.ZodEnum<["credential-list", "ip-acl"]>>;
+                /** The Twilio numbers associated with the trunk (E.164). */
+                numbers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }, {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            }>>;
+        }, z.ZodTypeAny, "passthrough">>>;
         /** Microsoft Teams meetings (Graph cloud-communications + ACS application-hosted media) binding. */
         teams: z.ZodOptional<z.ZodObject<{
             /** Master switch for the Teams meetings ingress. */
@@ -3136,6 +4952,78 @@ declare const configInfoSchema: z.ZodObject<{
         pollingIntervalMs?: number;
         maxConcurrentRuns?: number;
     }>>>;
+    workQueue: z.ZodDefault<z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        systemUserEmail: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        subscriptions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            concurrency: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string;
+            concurrency?: number;
+        }, {
+            name?: string;
+            concurrency?: number;
+        }>, "many">>>;
+        idlePollMinMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        idlePollMaxMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        shutdownDrainMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        sweeperEnabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        sweeperIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        reconcileIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    }, {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    }>, {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    }, {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    }>>>;
     telemetry: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
         level: z.ZodDefault<z.ZodOptional<z.ZodEnum<["minimal", "standard", "verbose", "debug"]>>>;
@@ -3400,12 +5288,12 @@ declare const configInfoSchema: z.ZodObject<{
             maxRequests?: number;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;
@@ -3415,12 +5303,12 @@ declare const configInfoSchema: z.ZodObject<{
             maxAttempts?: number;
         };
     }, {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;
@@ -3521,6 +5409,25 @@ declare const configInfoSchema: z.ZodObject<{
     };
     telephony?: {
         enabled?: boolean;
+        inboundRunAsUserEmail?: string;
+        maxCallSeconds?: number;
+        maxConcurrentCalls?: number;
+        outbound?: {
+            allowedPrefixes?: string[];
+            blockedPrefixes?: string[];
+            maxCallsPerUserPerHour?: number;
+        } & {
+            [k: string]: unknown;
+        };
+        transferTargets?: {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }[];
         twilio?: {
             accountSid?: string;
             authToken?: string;
@@ -3529,11 +5436,14 @@ declare const configInfoSchema: z.ZodObject<{
             streamPublicUrl?: string;
             webhookSigningSecret?: string;
             statusCallbackUrl?: string;
+            amdStatusCallbackUrl?: string;
+            onMachine?: "hangup" | "continue";
         } & {
             [k: string]: unknown;
         };
         vonage?: {
             apiKey?: string;
+            onMachine?: "hangup" | "continue";
             applicationId?: string;
             privateKey?: string;
             apiSecret?: string;
@@ -3554,6 +5464,27 @@ declare const configInfoSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
+        livekitSip?: {
+            apiKey?: string;
+            apiSecret?: string;
+            serverUrl?: string;
+            roomPrefix?: string;
+            numbers?: string[];
+            inboundTrunkId?: string;
+            outboundTrunkId?: string;
+            outboundFromNumber?: string;
+            autoProvision?: boolean;
+            allowedAddresses?: string[];
+            carrier?: {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            };
+        } & {
+            [k: string]: unknown;
+        };
         teams?: {
             enabled?: boolean;
             tenantId?: string;
@@ -3661,6 +5592,20 @@ declare const configInfoSchema: z.ZodObject<{
         pollingIntervalMs?: number;
         maxConcurrentRuns?: number;
     };
+    workQueue?: {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    };
     telemetry?: {
         enabled?: boolean;
         level?: "minimal" | "standard" | "verbose" | "debug";
@@ -3717,12 +5662,12 @@ declare const configInfoSchema: z.ZodObject<{
         maxAge?: number;
     };
     rateLimiting?: {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;
@@ -3808,6 +5753,25 @@ declare const configInfoSchema: z.ZodObject<{
     };
     telephony?: {
         enabled?: string | number | boolean;
+        inboundRunAsUserEmail?: string;
+        maxCallSeconds?: number;
+        maxConcurrentCalls?: number;
+        outbound?: {
+            allowedPrefixes?: string[];
+            blockedPrefixes?: string[];
+            maxCallsPerUserPerHour?: number;
+        } & {
+            [k: string]: unknown;
+        };
+        transferTargets?: {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }[];
         twilio?: {
             accountSid?: string;
             authToken?: string;
@@ -3816,11 +5780,14 @@ declare const configInfoSchema: z.ZodObject<{
             streamPublicUrl?: string;
             webhookSigningSecret?: string;
             statusCallbackUrl?: string;
+            amdStatusCallbackUrl?: string;
+            onMachine?: "hangup" | "continue";
         } & {
             [k: string]: unknown;
         };
         vonage?: {
             apiKey?: string;
+            onMachine?: "hangup" | "continue";
             applicationId?: string;
             privateKey?: string;
             apiSecret?: string;
@@ -3841,6 +5808,27 @@ declare const configInfoSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
+        livekitSip?: {
+            apiKey?: string;
+            apiSecret?: string;
+            serverUrl?: string;
+            roomPrefix?: string;
+            numbers?: string[];
+            inboundTrunkId?: string;
+            outboundTrunkId?: string;
+            outboundFromNumber?: string;
+            autoProvision?: string | number | boolean;
+            allowedAddresses?: string[];
+            carrier?: {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            };
+        } & {
+            [k: string]: unknown;
+        };
         teams?: {
             enabled?: string | number | boolean;
             tenantId?: string;
@@ -3948,6 +5936,20 @@ declare const configInfoSchema: z.ZodObject<{
         pollingIntervalMs?: number;
         maxConcurrentRuns?: number;
     };
+    workQueue?: {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    };
     telemetry?: {
         enabled?: string | number | boolean;
         level?: "minimal" | "standard" | "verbose" | "debug";
@@ -4004,12 +6006,12 @@ declare const configInfoSchema: z.ZodObject<{
         maxAge?: number;
     };
     rateLimiting?: {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;
@@ -4049,6 +6051,7 @@ export type RealtimeConfig = z.infer<typeof realtimeSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
 export type RingCentralTelephonyConfig = z.infer<typeof ringcentralTelephonySchema>;
+export type LiveKitSipTelephonyConfig = z.infer<typeof livekitSipTelephonySchema>;
 export type TeamsMeetingsConfig = z.infer<typeof teamsMeetingsSchema>;
 export type DatabaseSettingsInfo = z.infer<typeof databaseSettingsInfoSchema>;
 export type ViewingSystemSettingsInfo = z.infer<typeof viewingSystemInfoSchema>;
@@ -4059,6 +6062,7 @@ export type AuthProviderConfig = z.infer<typeof authProviderSchema>;
 export type ComponentRegistryConfig = z.infer<typeof componentRegistrySchema>;
 export type ScheduledJobsConfig = z.infer<typeof scheduledJobsSchema>;
 export type IntegrationSyncWorkerConfig = z.infer<typeof integrationSyncWorkerSchema>;
+export type { WorkQueueConfig } from './services/workQueueConfig.js';
 export type TelemetryConfig = z.infer<typeof telemetrySchema>;
 export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
@@ -4157,6 +6161,25 @@ export declare function LoadConfig(): {
     };
     telephony?: {
         enabled?: boolean;
+        inboundRunAsUserEmail?: string;
+        maxCallSeconds?: number;
+        maxConcurrentCalls?: number;
+        outbound?: {
+            allowedPrefixes?: string[];
+            blockedPrefixes?: string[];
+            maxCallsPerUserPerHour?: number;
+        } & {
+            [k: string]: unknown;
+        };
+        transferTargets?: {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }[];
         twilio?: {
             accountSid?: string;
             authToken?: string;
@@ -4165,11 +6188,14 @@ export declare function LoadConfig(): {
             streamPublicUrl?: string;
             webhookSigningSecret?: string;
             statusCallbackUrl?: string;
+            amdStatusCallbackUrl?: string;
+            onMachine?: "hangup" | "continue";
         } & {
             [k: string]: unknown;
         };
         vonage?: {
             apiKey?: string;
+            onMachine?: "hangup" | "continue";
             applicationId?: string;
             privateKey?: string;
             apiSecret?: string;
@@ -4190,6 +6216,27 @@ export declare function LoadConfig(): {
         } & {
             [k: string]: unknown;
         };
+        livekitSip?: {
+            apiKey?: string;
+            apiSecret?: string;
+            serverUrl?: string;
+            roomPrefix?: string;
+            numbers?: string[];
+            inboundTrunkId?: string;
+            outboundTrunkId?: string;
+            outboundFromNumber?: string;
+            autoProvision?: boolean;
+            allowedAddresses?: string[];
+            carrier?: {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            };
+        } & {
+            [k: string]: unknown;
+        };
         teams?: {
             enabled?: boolean;
             tenantId?: string;
@@ -4297,6 +6344,20 @@ export declare function LoadConfig(): {
         pollingIntervalMs?: number;
         maxConcurrentRuns?: number;
     };
+    workQueue?: {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    };
     telemetry?: {
         enabled?: boolean;
         level?: "minimal" | "standard" | "verbose" | "debug";
@@ -4353,12 +6414,12 @@ export declare function LoadConfig(): {
         maxAge?: number;
     };
     rateLimiting?: {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;
@@ -4446,6 +6507,25 @@ export declare function loadConfig(): {
     };
     telephony?: {
         enabled?: boolean;
+        inboundRunAsUserEmail?: string;
+        maxCallSeconds?: number;
+        maxConcurrentCalls?: number;
+        outbound?: {
+            allowedPrefixes?: string[];
+            blockedPrefixes?: string[];
+            maxCallsPerUserPerHour?: number;
+        } & {
+            [k: string]: unknown;
+        };
+        transferTargets?: {
+            number?: string;
+            name?: string;
+            kind?: "number" | "user" | "agent";
+            userEmail?: string;
+            fallbackNumber?: string;
+            agentName?: string;
+            description?: string;
+        }[];
         twilio?: {
             accountSid?: string;
             authToken?: string;
@@ -4454,11 +6534,14 @@ export declare function loadConfig(): {
             streamPublicUrl?: string;
             webhookSigningSecret?: string;
             statusCallbackUrl?: string;
+            amdStatusCallbackUrl?: string;
+            onMachine?: "hangup" | "continue";
         } & {
             [k: string]: unknown;
         };
         vonage?: {
             apiKey?: string;
+            onMachine?: "hangup" | "continue";
             applicationId?: string;
             privateKey?: string;
             apiSecret?: string;
@@ -4479,6 +6562,27 @@ export declare function loadConfig(): {
         } & {
             [k: string]: unknown;
         };
+        livekitSip?: {
+            apiKey?: string;
+            apiSecret?: string;
+            serverUrl?: string;
+            roomPrefix?: string;
+            numbers?: string[];
+            inboundTrunkId?: string;
+            outboundTrunkId?: string;
+            outboundFromNumber?: string;
+            autoProvision?: boolean;
+            allowedAddresses?: string[];
+            carrier?: {
+                type?: "twilio-elastic-sip";
+                numbers?: string[];
+                originationUri?: string;
+                terminationUri?: string;
+                terminationAuth?: "credential-list" | "ip-acl";
+            };
+        } & {
+            [k: string]: unknown;
+        };
         teams?: {
             enabled?: boolean;
             tenantId?: string;
@@ -4586,6 +6690,20 @@ export declare function loadConfig(): {
         pollingIntervalMs?: number;
         maxConcurrentRuns?: number;
     };
+    workQueue?: {
+        enabled?: boolean;
+        systemUserEmail?: string;
+        subscriptions?: {
+            name?: string;
+            concurrency?: number;
+        }[];
+        idlePollMinMs?: number;
+        idlePollMaxMs?: number;
+        shutdownDrainMs?: number;
+        sweeperEnabled?: boolean;
+        sweeperIntervalMs?: number;
+        reconcileIntervalMs?: number;
+    };
     telemetry?: {
         enabled?: boolean;
         level?: "minimal" | "standard" | "verbose" | "debug";
@@ -4642,12 +6760,12 @@ export declare function loadConfig(): {
         maxAge?: number;
     };
     rateLimiting?: {
+        enabled?: boolean;
         global?: {
             message?: string;
             windowMs?: number;
             maxRequests?: number;
         };
-        enabled?: boolean;
         graphql?: {
             windowMs?: number;
             maxRequests?: number;