@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/dist/config.d.ts

@@ -29,6 +29,23 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     CreateUserApplicationRecords: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     UserApplications: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Build each auto-created user as a copy of a template user (`User.IsTemplate`), so new people start
+     * with its pinned apps, views, settings, dashboards and conversations. `email` names the template;
+     * `preset` is the `MJ: Users` clone preset to apply (default `template`). The copy takes the roles
+     * and apps of the template, so `newUserRoles`, `CreateUserApplicationRecords` and `UserApplications`
+     * apply only when the template can't be used, in which case a plain user is created as before.
+     */
+    newUserTemplate: z.ZodOptional<z.ZodObject<{
+        email: z.ZodString;
+        preset: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        email?: string;
+        preset?: string;
+    }, {
+        email?: string;
+        preset?: string;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     autoCreateNewUsers?: boolean;
     newUserLimitedToAuthorizedDomains?: boolean;
@@ -39,6 +56,10 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation?: string;
     CreateUserApplicationRecords?: boolean;
     UserApplications?: string[];
+    newUserTemplate?: {
+        email?: string;
+        preset?: string;
+    };
 }, {
     autoCreateNewUsers?: boolean;
     newUserLimitedToAuthorizedDomains?: boolean;
@@ -49,6 +70,10 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation?: string;
     CreateUserApplicationRecords?: boolean;
     UserApplications?: string[];
+    newUserTemplate?: {
+        email?: string;
+        preset?: string;
+    };
 }>;
 declare const databaseSettingsInfoSchema: z.ZodObject<{
     connectionTimeout: z.ZodNumber;
@@ -494,6 +519,38 @@ declare const cacheSettingsSchema: z.ZodObject<{
      * every signed-in user may read every row of every entity.
      */
     recordDataBroadcastEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Expiry, in seconds, of entries in the shared Redis cache (used when REDIS_URL is set). The
+     * REDIS_TTL_SECONDS environment variable overrides it. 0 stores entries without expiry. When
+     * neither is set, the Redis provider's default applies (one hour).
+     */
+    sharedCacheTTLSeconds: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How often, in seconds, loaded engines compare their rows with the database and reload what
+     * changed without an MJ event (direct SQL, other applications). With a shared cache one server
+     * does it per interval. 0 = disabled. Default: 300 (5 minutes).
+     */
+    engineSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How often, in seconds, the user cache compares two row counts and the newest update timestamp
+     * with the database and reloads only when they differ. The cache already refreshes on MJ writes
+     * (locally and, with a shared cache, on other servers); this covers changes made outside MJ.
+     * 0 = disabled. Default: 300 (5 minutes).
+     */
+    userCacheCheckIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How often to compare this process's metadata with the database, in seconds (0 disables).
+     * Costs nothing unless an entity the metadata is built from declares
+     * `TrustServerCacheCompletely = false`; see `ProviderBase.SweepMetadataAgainstDatabase`.
+     */
+    metadataSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How long, in seconds, a server holds the shared warm-up turn while it loads its engines, so
+     * servers starting together load one at a time and the rest find the cache warm. The lease is
+     * renewed while the load runs; this value is both its expiry and how long another server waits
+     * for it. 0 disables the turn-taking. Default: 30.
+     */
+    startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, "strip", z.ZodTypeAny, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
@@ -501,6 +558,11 @@ declare const cacheSettingsSchema: z.ZodObject<{
     evictionSweepIntervalSeconds?: number;
     verboseLogging?: boolean;
     recordDataBroadcastEntities?: string[];
+    sharedCacheTTLSeconds?: number;
+    engineSweepIntervalSeconds?: number;
+    userCacheCheckIntervalSeconds?: number;
+    metadataSweepIntervalSeconds?: number;
+    startupWarmupLeaseSeconds?: number;
 }, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
@@ -508,6 +570,11 @@ declare const cacheSettingsSchema: z.ZodObject<{
     evictionSweepIntervalSeconds?: number;
     verboseLogging?: boolean;
     recordDataBroadcastEntities?: string[];
+    sharedCacheTTLSeconds?: number;
+    engineSweepIntervalSeconds?: number;
+    userCacheCheckIntervalSeconds?: number;
+    metadataSweepIntervalSeconds?: number;
+    startupWarmupLeaseSeconds?: number;
 }>;
 declare const loggingSettingsSchema: z.ZodObject<{
     graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -2856,15 +2923,1210 @@ declare const telephonySchema: z.ZodObject<{
         modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * Mid-session identity verification for realtime sessions (see `src/realtimeSessions/README.md`).
+ *
+ * A person talking to an agent proves they control an email address WITHOUT leaving the conversation:
+ * the server emails a one-time link plus a short code, records the verification on the session, extends
+ * the session's limits, and tells the live session through a session event. The session's principal is
+ * never changed.
+ *
+ * Off by default: nothing is emailed and `/realtime/verify` is not mounted until `enabled` is true AND a
+ * `communicationProvider` is configured. Policy set here is the BASE layer; the config cascade
+ * (`channels.config.IdentityVerification`) snapshotted onto each session at mint overrides it per knob.
+ */
+declare const identityVerificationSchema: z.ZodObject<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const realtimeSchema: z.ZodObject<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
@@ -2897,6 +4159,23 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
         CreateUserApplicationRecords: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         UserApplications: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Build each auto-created user as a copy of a template user (`User.IsTemplate`), so new people start
+         * with its pinned apps, views, settings, dashboards and conversations. `email` names the template;
+         * `preset` is the `MJ: Users` clone preset to apply (default `template`). The copy takes the roles
+         * and apps of the template, so `newUserRoles`, `CreateUserApplicationRecords` and `UserApplications`
+         * apply only when the template can't be used, in which case a plain user is created as before.
+         */
+        newUserTemplate: z.ZodOptional<z.ZodObject<{
+            email: z.ZodString;
+            preset: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            email?: string;
+            preset?: string;
+        }, {
+            email?: string;
+            preset?: string;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         autoCreateNewUsers?: boolean;
         newUserLimitedToAuthorizedDomains?: boolean;
@@ -2907,6 +4186,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     }, {
         autoCreateNewUsers?: boolean;
         newUserLimitedToAuthorizedDomains?: boolean;
@@ -2917,6 +4200,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     }>;
     magicLink: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
@@ -4658,12 +5945,900 @@ declare const configInfoSchema: z.ZodObject<{
     realtime: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
@@ -5140,6 +7315,38 @@ declare const configInfoSchema: z.ZodObject<{
          * every signed-in user may read every row of every entity.
          */
         recordDataBroadcastEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Expiry, in seconds, of entries in the shared Redis cache (used when REDIS_URL is set). The
+         * REDIS_TTL_SECONDS environment variable overrides it. 0 stores entries without expiry. When
+         * neither is set, the Redis provider's default applies (one hour).
+         */
+        sharedCacheTTLSeconds: z.ZodOptional<z.ZodNumber>;
+        /**
+         * How often, in seconds, loaded engines compare their rows with the database and reload what
+         * changed without an MJ event (direct SQL, other applications). With a shared cache one server
+         * does it per interval. 0 = disabled. Default: 300 (5 minutes).
+         */
+        engineSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How often, in seconds, the user cache compares two row counts and the newest update timestamp
+         * with the database and reloads only when they differ. The cache already refreshes on MJ writes
+         * (locally and, with a shared cache, on other servers); this covers changes made outside MJ.
+         * 0 = disabled. Default: 300 (5 minutes).
+         */
+        userCacheCheckIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How often to compare this process's metadata with the database, in seconds (0 disables).
+         * Costs nothing unless an entity the metadata is built from declares
+         * `TrustServerCacheCompletely = false`; see `ProviderBase.SweepMetadataAgainstDatabase`.
+         */
+        metadataSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How long, in seconds, a server holds the shared warm-up turn while it loads its engines, so
+         * servers starting together load one at a time and the rest find the cache warm. The lease is
+         * renewed while the load runs; this value is both its expiry and how long another server waits
+         * for it. 0 disables the turn-taking. Default: 30.
+         */
+        startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, "strip", z.ZodTypeAny, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
@@ -5147,6 +7354,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     }, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
@@ -5154,6 +7366,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     }>>>;
     loggingSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -5368,6 +7585,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -5501,6 +7722,37 @@ declare const configInfoSchema: z.ZodObject<{
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -5639,6 +7891,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
@@ -5712,6 +7969,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: string | number | boolean;
@@ -5845,6 +8106,37 @@ declare const configInfoSchema: z.ZodObject<{
     };
     realtime?: {
         enabled?: string | number | boolean;
+        identityVerification?: {
+            enabled?: string | number | boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -5983,6 +8275,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
@@ -6048,6 +8345,7 @@ export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type WidgetConfig = z.infer<typeof widgetSchema>;
 export type TelephonyConfig = z.infer<typeof telephonySchema>;
 export type RealtimeConfig = z.infer<typeof realtimeSchema>;
+export type IdentityVerificationConfig = z.infer<typeof identityVerificationSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
 export type RingCentralTelephonyConfig = z.infer<typeof ringcentralTelephonySchema>;
@@ -6120,6 +8418,10 @@ export declare function LoadConfig(): {
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -6253,6 +8555,37 @@ export declare function LoadConfig(): {
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -6391,6 +8724,11 @@ export declare function LoadConfig(): {
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
@@ -6466,6 +8804,10 @@ export declare function loadConfig(): {
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -6599,6 +8941,37 @@ export declare function loadConfig(): {
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -6737,6 +9110,11 @@ export declare function loadConfig(): {
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {