@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/dist/config.d.ts

@@ -29,6 +29,23 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     CreateUserApplicationRecords: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     UserApplications: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Build each auto-created user as a copy of a template user (`User.IsTemplate`), so new people start
+     * with its pinned apps, views, settings, dashboards and conversations. `email` names the template;
+     * `preset` is the `MJ: Users` clone preset to apply (default `template`). The copy takes the roles
+     * and apps of the template, so `newUserRoles`, `CreateUserApplicationRecords` and `UserApplications`
+     * apply only when the template can't be used, in which case a plain user is created as before.
+     */
+    newUserTemplate: z.ZodOptional<z.ZodObject<{
+        email: z.ZodString;
+        preset: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        email?: string;
+        preset?: string;
+    }, {
+        email?: string;
+        preset?: string;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     autoCreateNewUsers?: boolean;
     newUserLimitedToAuthorizedDomains?: boolean;
@@ -39,6 +56,10 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation?: string;
     CreateUserApplicationRecords?: boolean;
     UserApplications?: string[];
+    newUserTemplate?: {
+        email?: string;
+        preset?: string;
+    };
 }, {
     autoCreateNewUsers?: boolean;
     newUserLimitedToAuthorizedDomains?: boolean;
@@ -49,6 +70,10 @@ declare const userHandlingInfoSchema: z.ZodObject<{
     contextUserForNewUserCreation?: string;
     CreateUserApplicationRecords?: boolean;
     UserApplications?: string[];
+    newUserTemplate?: {
+        email?: string;
+        preset?: string;
+    };
 }>;
 declare const databaseSettingsInfoSchema: z.ZodObject<{
     connectionTimeout: z.ZodNumber;
@@ -444,20 +469,29 @@ declare const telemetrySchema: z.ZodObject<{
     enabled?: string | number | boolean;
     level?: "minimal" | "standard" | "verbose" | "debug";
 }>;
-declare const serverExtensionSchema: z.ZodObject<{
-    Enabled: z.ZodDefault<z.ZodBoolean>;
+/**
+ * A host `mj.config.cjs` `serverExtensions[]` entry. Only `DriverClass` is required: an entry whose
+ * DriverClass an Open App package already publishes is an OVERLAY (MergeServerExtensionConfigs) and
+ * may set just the fields it overrides — `{ DriverClass: 'X', OwnsCORS: false }` — without repeating
+ * `RootPath`. `Enabled` has no schema default for the same reason: a defaulted `true` would silently
+ * re-enable an extension the package ships disabled. Whether the MERGED entry is complete (a valid
+ * `RootPath`; `Enabled` defaults to true) is validated after the merge, by prepareServerExtensionConfigs,
+ * which reports an incomplete host-only entry instead of mounting it.
+ */
+export declare const ServerExtensionSchema: z.ZodObject<{
+    Enabled: z.ZodOptional<z.ZodBoolean>;
     DriverClass: z.ZodString;
-    RootPath: z.ZodString;
+    RootPath: z.ZodOptional<z.ZodString>;
     Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    Enabled: z.ZodDefault<z.ZodBoolean>;
+    Enabled: z.ZodOptional<z.ZodBoolean>;
     DriverClass: z.ZodString;
-    RootPath: z.ZodString;
+    RootPath: z.ZodOptional<z.ZodString>;
     Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    Enabled: z.ZodDefault<z.ZodBoolean>;
+    Enabled: z.ZodOptional<z.ZodBoolean>;
     DriverClass: z.ZodString;
-    RootPath: z.ZodString;
+    RootPath: z.ZodOptional<z.ZodString>;
     Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.ZodTypeAny, "passthrough">>;
 declare const cacheSettingsSchema: z.ZodObject<{
@@ -465,6 +499,14 @@ declare const cacheSettingsSchema: z.ZodObject<{
     maxMemoryMB: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     /** Maximum percentage of total cache memory that any single entity can occupy. Default: 50. Set to 0 to disable. */
     maxPercentOfCachePerEntity: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Ceiling on any ONE cache entry. 'auto' (the default) derives it from maxMemoryMB, so the
+     * largest entity the server caches scales with the memory the cache was given; a number is an
+     * explicit stricter percentage of maxMemoryMB; 0 removes the ceiling. Leave it on 'auto' unless
+     * a specific entry must be kept out of the cache — an entry declined by the ceiling is re-read
+     * from the database on every call, and the server logs which maxMemoryMB would admit it.
+     */
+    maxEntryPercentOfCache: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodNumber, z.ZodLiteral<"auto">]>>>;
     /** Default TTL in seconds. 0 = no TTL, rely on event-based invalidation. Default: 0. */
     defaultTTLSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     /** Interval in seconds for periodic eviction sweep. 0 = disabled. Default: 300 (5 minutes). */
@@ -494,20 +536,64 @@ declare const cacheSettingsSchema: z.ZodObject<{
      * every signed-in user may read every row of every entity.
      */
     recordDataBroadcastEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Expiry, in seconds, of entries in the shared Redis cache (used when REDIS_URL is set). The
+     * REDIS_TTL_SECONDS environment variable overrides it. 0 stores entries without expiry. When
+     * neither is set, the Redis provider's default applies (one hour).
+     */
+    sharedCacheTTLSeconds: z.ZodOptional<z.ZodNumber>;
+    /**
+     * How often, in seconds, loaded engines compare their rows with the database and reload what
+     * changed without an MJ event (direct SQL, other applications). With a shared cache one server
+     * does it per interval. 0 = disabled. Default: 300 (5 minutes).
+     */
+    engineSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How often, in seconds, the user cache compares two row counts and the newest update timestamp
+     * with the database and reloads only when they differ. The cache already refreshes on MJ writes
+     * (locally and, with a shared cache, on other servers); this covers changes made outside MJ.
+     * 0 = disabled. Default: 300 (5 minutes).
+     */
+    userCacheCheckIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How often to compare this process's metadata with the database, in seconds (0 disables).
+     * Costs nothing unless an entity the metadata is built from declares
+     * `TrustServerCacheCompletely = false`; see `ProviderBase.SweepMetadataAgainstDatabase`.
+     */
+    metadataSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * How long, in seconds, a server holds the shared warm-up turn while it loads its engines, so
+     * servers starting together load one at a time and the rest find the cache warm. The lease is
+     * renewed while the load runs; this value is both its expiry and how long another server waits
+     * for it. 0 disables the turn-taking. Default: 30.
+     */
+    startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, "strip", z.ZodTypeAny, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
+    maxEntryPercentOfCache?: number | "auto";
     defaultTTLSeconds?: number;
     evictionSweepIntervalSeconds?: number;
     verboseLogging?: boolean;
     recordDataBroadcastEntities?: string[];
+    sharedCacheTTLSeconds?: number;
+    engineSweepIntervalSeconds?: number;
+    userCacheCheckIntervalSeconds?: number;
+    metadataSweepIntervalSeconds?: number;
+    startupWarmupLeaseSeconds?: number;
 }, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
+    maxEntryPercentOfCache?: number | "auto";
     defaultTTLSeconds?: number;
     evictionSweepIntervalSeconds?: number;
     verboseLogging?: boolean;
     recordDataBroadcastEntities?: string[];
+    sharedCacheTTLSeconds?: number;
+    engineSweepIntervalSeconds?: number;
+    userCacheCheckIntervalSeconds?: number;
+    metadataSweepIntervalSeconds?: number;
+    startupWarmupLeaseSeconds?: number;
 }>;
 declare const loggingSettingsSchema: z.ZodObject<{
     graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -535,6 +621,18 @@ declare const loggingSettingsSchema: z.ZodObject<{
         logVariables?: boolean;
     };
 }>;
+declare const aiPromptRunsSchema: z.ZodObject<{
+    /**
+     * Server default for which template inputs prompt runs store in AIPromptRun.Messages:
+     * 'None' (key sizes only), 'Referenced' (keys the templates read) or 'Full'.
+     * AIPrompt.TemplateDataCapture and AIPromptParams.TemplateDataCapture override it.
+     */
+    templateDataCapture: z.ZodOptional<z.ZodEnum<["None", "Referenced", "Full"]>>;
+}, "strip", z.ZodTypeAny, {
+    templateDataCapture?: "None" | "Referenced" | "Full";
+}, {
+    templateDataCapture?: "None" | "Referenced" | "Full";
+}>;
 declare const corsSchema: z.ZodObject<{
     /** Allowed origins for CORS. Default ['*'] preserves backward-compatible "allow all" behavior. */
     allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -2856,15 +2954,1225 @@ declare const telephonySchema: z.ZodObject<{
         modelSampleRate: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * Mid-session identity verification for realtime sessions (see `src/realtimeSessions/README.md`).
+ *
+ * A person talking to an agent proves they control an email address WITHOUT leaving the conversation:
+ * the server emails a one-time link plus a short code, records the verification on the session, extends
+ * the session's limits, and tells the live session through a session event. The session's principal is
+ * never changed.
+ *
+ * Off by default: nothing is emailed and `/realtime/verify` is not mounted until `enabled` is true AND a
+ * `communicationProvider` is configured. Policy set here is the BASE layer; the config cascade
+ * (`channels.config.IdentityVerification`) snapshotted onto each session at mint overrides it per knob.
+ */
+declare const identityVerificationSchema: z.ZodObject<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address of the verification email. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /**
+     * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+     * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+     * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+     * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+     */
+    hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+     * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+     * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+     * Communication Log then holds live credentials and no one is emailed.
+     */
+    deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+    /**
+     * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+     * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+     */
+    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * The internal user the server acts as to read/write the session, send the email and write the audit
+     * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+     * active Owner). The verify link is public, so it has no caller identity of its own.
+     */
+    contextUserForVerification: z.ZodOptional<z.ZodString>;
+    /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+    policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+        blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+        maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+        unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }, {
+        requireBusinessDomain?: boolean;
+        blockedDomains?: string[];
+        consumerDomains?: string[];
+        linkTtlMinutes?: number;
+        maxSendsPerSession?: number;
+        maxCodeAttempts?: number;
+        unverifiedMaxSeconds?: number;
+        verifiedMaxSeconds?: number;
+    }>>>;
+    /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+    rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Window (ms) for the three send limits. Default 1 hour. */
+        sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per client IP per window. Default 10. 0 disables. */
+        perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+        perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+        perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) for code attempts. Default 10 minutes. */
+        codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Code submissions per session per window. Default 10. 0 disables. */
+        perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+        redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** `/realtime/verify` requests per IP per window. Default 30. */
+        redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }, {
+        sendWindowMs?: number;
+        perIpSends?: number;
+        perEmailDomainSends?: number;
+        perEmailSends?: number;
+        codeAttemptWindowMs?: number;
+        perSessionCodeAttempts?: number;
+        redeemWindowMs?: number;
+        redeemPerIp?: number;
+    }>>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const realtimeSchema: z.ZodObject<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+     * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+     */
+    recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+     * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+     */
+    recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Mid-session identity verification (off by default). */
+    identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address of the verification email. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /**
+         * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+         * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+         * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+         * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+         */
+        hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+         * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+         * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+         * Communication Log then holds live credentials and no one is emailed.
+         */
+        deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+        /**
+         * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+         * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+         */
+        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * The internal user the server acts as to read/write the session, send the email and write the audit
+         * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+         * active Owner). The verify link is public, so it has no caller identity of its own.
+         */
+        contextUserForVerification: z.ZodOptional<z.ZodString>;
+        /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+        policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+            blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+            maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+            unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }, {
+            requireBusinessDomain?: boolean;
+            blockedDomains?: string[];
+            consumerDomains?: string[];
+            linkTtlMinutes?: number;
+            maxSendsPerSession?: number;
+            maxCodeAttempts?: number;
+            unverifiedMaxSeconds?: number;
+            verifiedMaxSeconds?: number;
+        }>>>;
+        /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+        rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Window (ms) for the three send limits. Default 1 hour. */
+            sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per client IP per window. Default 10. 0 disables. */
+            perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+            perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+            perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) for code attempts. Default 10 minutes. */
+            codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Code submissions per session per window. Default 10. 0 disables. */
+            perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+            redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /** `/realtime/verify` requests per IP per window. Default 30. */
+            redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }, {
+            sendWindowMs?: number;
+            perIpSends?: number;
+            perEmailDomainSends?: number;
+            perEmailSends?: number;
+            codeAttemptWindowMs?: number;
+            perSessionCodeAttempts?: number;
+            redeemWindowMs?: number;
+            redeemPerIp?: number;
+        }>>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    /**
+     * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+     * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+     */
+    recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
 }, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
@@ -2897,6 +4205,23 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation: z.ZodDefault<z.ZodOptional<z.ZodString>>;
         CreateUserApplicationRecords: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         UserApplications: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Build each auto-created user as a copy of a template user (`User.IsTemplate`), so new people start
+         * with its pinned apps, views, settings, dashboards and conversations. `email` names the template;
+         * `preset` is the `MJ: Users` clone preset to apply (default `template`). The copy takes the roles
+         * and apps of the template, so `newUserRoles`, `CreateUserApplicationRecords` and `UserApplications`
+         * apply only when the template can't be used, in which case a plain user is created as before.
+         */
+        newUserTemplate: z.ZodOptional<z.ZodObject<{
+            email: z.ZodString;
+            preset: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            email?: string;
+            preset?: string;
+        }, {
+            email?: string;
+            preset?: string;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         autoCreateNewUsers?: boolean;
         newUserLimitedToAuthorizedDomains?: boolean;
@@ -2907,6 +4232,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     }, {
         autoCreateNewUsers?: boolean;
         newUserLimitedToAuthorizedDomains?: boolean;
@@ -2917,6 +4246,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     }>;
     magicLink: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
@@ -4658,12 +5991,915 @@ declare const configInfoSchema: z.ZodObject<{
     realtime: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+         * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+         */
+        recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+         * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+         */
+        recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Mid-session identity verification (off by default). */
+        identityVerification: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false the verify routes are not mounted and the GraphQL operations refuse. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** CommunicationEngine provider that delivers the verification email (e.g. 'SendGrid', 'Microsoft Graph'). Required to send. */
+            communicationProvider: z.ZodOptional<z.ZodString>;
+            /** From address of the verification email. */
+            fromAddress: z.ZodOptional<z.ZodString>;
+            /**
+             * Server-only secret the typed verification code is HMAC'd under before it is stored on the session
+             * (at least 16 characters; 32+ random characters recommended). REQUIRED: without it verification is
+             * unavailable, because a session's owner can read their own session row and a bare hash of a six-digit
+             * code can be reversed offline. Never exposed to clients. Rotating it voids pending verifications only.
+             */
+            hmacSecret: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            /**
+             * `send` (default) delivers the email. `dry-run` builds and logs the message through the communication
+             * provider WITHOUT delivering it — for rehearsal and integration environments, where a test reads the
+             * emailed link and code from the `MJ: Communication Logs` row. Never use `dry-run` in production: the
+             * Communication Log then holds live credentials and no one is emailed.
+             */
+            deliveryMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["send", "dry-run"]>>>;
+            /**
+             * Base URL the emailed link is built from (`<publicBaseUrl>/realtime/verify/<token>`). Defaults to the
+             * server's `publicUrl`, or `baseUrl:graphqlPort` when that is unset — the same derivation magic links use.
+             */
+            publicBaseUrl: z.ZodOptional<z.ZodString>;
+            /**
+             * The internal user the server acts as to read/write the session, send the email and write the audit
+             * row, matched against `User.Name` then `User.Email` (falls back to the system user, then the lowest-ID
+             * active Owner). The verify link is public, so it has no caller identity of its own.
+             */
+            contextUserForVerification: z.ZodOptional<z.ZodString>;
+            /** Base policy layer; each knob here is overridden by the per-session cascade layer. */
+            policy: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                requireBusinessDomain: z.ZodOptional<z.ZodBoolean>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                consumerDomains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                linkTtlMinutes: z.ZodOptional<z.ZodNumber>;
+                maxSendsPerSession: z.ZodOptional<z.ZodNumber>;
+                maxCodeAttempts: z.ZodOptional<z.ZodNumber>;
+                unverifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+                verifiedMaxSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }, {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            }>>>;
+            /** Send-side and attempt-side limits (per instance, in memory; per-session limits are persisted and exact). */
+            rateLimits: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+                /** Window (ms) for the three send limits. Default 1 hour. */
+                sendWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per client IP per window. Default 10. 0 disables. */
+                perIpSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient domain per window. Default 30. 0 disables. */
+                perEmailDomainSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Verification emails per recipient address per window — stops the feature being used to mail-bomb one inbox. Default 3. 0 disables. */
+                perEmailSends: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) for code attempts. Default 10 minutes. */
+                codeAttemptWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Code submissions per session per window. Default 10. 0 disables. */
+                perSessionCodeAttempts: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** Window (ms) of the public `/realtime/verify` route limiter. Default 60s. */
+                redeemWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                /** `/realtime/verify` requests per IP per window. Default 30. */
+                redeemPerIp: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }, {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            }>>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
+        /**
+         * Seconds a client-direct call's recording waits for missing shards after its terminal signal before it
+         * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
+         */
+        recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
@@ -5091,19 +7327,19 @@ declare const configInfoSchema: z.ZodObject<{
         writeProtection?: "strict" | "log" | "off";
     }>>>;
     serverExtensions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">>, "many">>>;
     cacheSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -5111,6 +7347,14 @@ declare const configInfoSchema: z.ZodObject<{
         maxMemoryMB: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         /** Maximum percentage of total cache memory that any single entity can occupy. Default: 50. Set to 0 to disable. */
         maxPercentOfCachePerEntity: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Ceiling on any ONE cache entry. 'auto' (the default) derives it from maxMemoryMB, so the
+         * largest entity the server caches scales with the memory the cache was given; a number is an
+         * explicit stricter percentage of maxMemoryMB; 0 removes the ceiling. Leave it on 'auto' unless
+         * a specific entry must be kept out of the cache — an entry declined by the ceiling is re-read
+         * from the database on every call, and the server logs which maxMemoryMB would admit it.
+         */
+        maxEntryPercentOfCache: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodNumber, z.ZodLiteral<"auto">]>>>;
         /** Default TTL in seconds. 0 = no TTL, rely on event-based invalidation. Default: 0. */
         defaultTTLSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         /** Interval in seconds for periodic eviction sweep. 0 = disabled. Default: 300 (5 minutes). */
@@ -5140,20 +7384,64 @@ declare const configInfoSchema: z.ZodObject<{
          * every signed-in user may read every row of every entity.
          */
         recordDataBroadcastEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Expiry, in seconds, of entries in the shared Redis cache (used when REDIS_URL is set). The
+         * REDIS_TTL_SECONDS environment variable overrides it. 0 stores entries without expiry. When
+         * neither is set, the Redis provider's default applies (one hour).
+         */
+        sharedCacheTTLSeconds: z.ZodOptional<z.ZodNumber>;
+        /**
+         * How often, in seconds, loaded engines compare their rows with the database and reload what
+         * changed without an MJ event (direct SQL, other applications). With a shared cache one server
+         * does it per interval. 0 = disabled. Default: 300 (5 minutes).
+         */
+        engineSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How often, in seconds, the user cache compares two row counts and the newest update timestamp
+         * with the database and reloads only when they differ. The cache already refreshes on MJ writes
+         * (locally and, with a shared cache, on other servers); this covers changes made outside MJ.
+         * 0 = disabled. Default: 300 (5 minutes).
+         */
+        userCacheCheckIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How often to compare this process's metadata with the database, in seconds (0 disables).
+         * Costs nothing unless an entity the metadata is built from declares
+         * `TrustServerCacheCompletely = false`; see `ProviderBase.SweepMetadataAgainstDatabase`.
+         */
+        metadataSweepIntervalSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * How long, in seconds, a server holds the shared warm-up turn while it loads its engines, so
+         * servers starting together load one at a time and the rest find the cache warm. The lease is
+         * renewed while the load runs; this value is both its expiry and how long another server waits
+         * for it. 0 disables the turn-taking. Default: 30.
+         */
+        startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     }, "strip", z.ZodTypeAny, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     }, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     }>>>;
     loggingSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -5181,6 +7469,18 @@ declare const configInfoSchema: z.ZodObject<{
             logVariables?: boolean;
         };
     }>>>;
+    aiPromptRuns: z.ZodOptional<z.ZodObject<{
+        /**
+         * Server default for which template inputs prompt runs store in AIPromptRun.Messages:
+         * 'None' (key sizes only), 'Referenced' (keys the templates read) or 'Full'.
+         * AIPrompt.TemplateDataCapture and AIPromptParams.TemplateDataCapture override it.
+         */
+        templateDataCapture: z.ZodOptional<z.ZodEnum<["None", "Referenced", "Full"]>>;
+    }, "strip", z.ZodTypeAny, {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    }, {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    }>>;
     feedbackSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Org-level kill switch for the in-app feedback feature. Defaults to true (enabled). */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -5350,6 +7650,12 @@ declare const configInfoSchema: z.ZodObject<{
     ___codeGenAPIPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     ___codeGenAPISubmissionDelay: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     graphqlRootPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * Path prefix MJAPI mounts every route it serves under (core routes and server extensions), on its own
+     * listener. `/` unless a proxy forwards a prefix WITHOUT stripping it (e.g. CloudFront `/api/*` → MJAPI):
+     * then set `MJAPI_BASE_PATH=/api`. Independent of `graphqlRootPath`, which is only Apollo's path. MJ #5674.
+     */
+    apiBasePath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
     enableIntrospection: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     websiteRunFromPackage: z.ZodOptional<z.ZodNumber>;
     userEmailMap: z.ZodOptional<z.ZodEffects<z.ZodString, Record<string, string>, string>>;
@@ -5368,6 +7674,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -5501,6 +7811,38 @@ declare const configInfoSchema: z.ZodObject<{
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
+        recordingAssemblyGraceSeconds?: number;
     } & {
         [k: string]: unknown;
     };
@@ -5627,24 +7969,33 @@ declare const configInfoSchema: z.ZodObject<{
         writeProtection?: "strict" | "log" | "off";
     };
     serverExtensions?: z.objectOutputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">[];
     cacheSettings?: {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
             logVariables?: boolean;
         };
     };
+    aiPromptRuns?: {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -5694,6 +8045,7 @@ declare const configInfoSchema: z.ZodObject<{
     ___codeGenAPIPort?: number;
     ___codeGenAPISubmissionDelay?: number;
     graphqlRootPath?: string;
+    apiBasePath?: string;
     enableIntrospection?: boolean;
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;
@@ -5712,6 +8064,10 @@ declare const configInfoSchema: z.ZodObject<{
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: string | number | boolean;
@@ -5845,6 +8201,38 @@ declare const configInfoSchema: z.ZodObject<{
     };
     realtime?: {
         enabled?: string | number | boolean;
+        identityVerification?: {
+            enabled?: string | number | boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
+        recordingAssemblyGraceSeconds?: number;
     } & {
         [k: string]: unknown;
     };
@@ -5971,24 +8359,33 @@ declare const configInfoSchema: z.ZodObject<{
         writeProtection?: "strict" | "log" | "off";
     };
     serverExtensions?: z.objectInputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">[];
     cacheSettings?: {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
             logVariables?: boolean;
         };
     };
+    aiPromptRuns?: {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -6038,6 +8435,7 @@ declare const configInfoSchema: z.ZodObject<{
     ___codeGenAPIPort?: number;
     ___codeGenAPISubmissionDelay?: number;
     graphqlRootPath?: string;
+    apiBasePath?: string;
     enableIntrospection?: boolean;
     websiteRunFromPackage?: number;
     userEmailMap?: string;
@@ -6048,6 +8446,7 @@ export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type WidgetConfig = z.infer<typeof widgetSchema>;
 export type TelephonyConfig = z.infer<typeof telephonySchema>;
 export type RealtimeConfig = z.infer<typeof realtimeSchema>;
+export type IdentityVerificationConfig = z.infer<typeof identityVerificationSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
 export type RingCentralTelephonyConfig = z.infer<typeof ringcentralTelephonySchema>;
@@ -6066,9 +8465,10 @@ export type { WorkQueueConfig } from './services/workQueueConfig.js';
 export type TelemetryConfig = z.infer<typeof telemetrySchema>;
 export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
-export type ServerExtensionConfig = z.infer<typeof serverExtensionSchema>;
+export type ServerExtensionConfig = z.infer<typeof ServerExtensionSchema>;
 export type CacheSettingsConfig = z.infer<typeof cacheSettingsSchema>;
 export type LoggingSettingsConfig = z.infer<typeof loggingSettingsSchema>;
+export type AIPromptRunsConfig = z.infer<typeof aiPromptRunsSchema>;
 export type FeedbackGithubSettingsConfig = z.infer<typeof feedbackGithubSettingsSchema>;
 export type FeedbackSettingsConfig = z.infer<typeof feedbackSettingsSchema>;
 export type CorsConfig = z.infer<typeof corsSchema>;
@@ -6120,6 +8520,10 @@ export declare function LoadConfig(): {
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -6253,6 +8657,38 @@ export declare function LoadConfig(): {
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
+        recordingAssemblyGraceSeconds?: number;
     } & {
         [k: string]: unknown;
     };
@@ -6379,24 +8815,33 @@ export declare function LoadConfig(): {
         writeProtection?: "strict" | "log" | "off";
     };
     serverExtensions?: z.objectOutputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">[];
     cacheSettings?: {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
             logVariables?: boolean;
         };
     };
+    aiPromptRuns?: {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -6446,6 +8891,7 @@ export declare function LoadConfig(): {
     ___codeGenAPIPort?: number;
     ___codeGenAPISubmissionDelay?: number;
     graphqlRootPath?: string;
+    apiBasePath?: string;
     enableIntrospection?: boolean;
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;
@@ -6466,6 +8912,10 @@ export declare function loadConfig(): {
         contextUserForNewUserCreation?: string;
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
+        newUserTemplate?: {
+            email?: string;
+            preset?: string;
+        };
     };
     magicLink?: {
         enabled?: boolean;
@@ -6599,6 +9049,38 @@ export declare function loadConfig(): {
     };
     realtime?: {
         enabled?: boolean;
+        identityVerification?: {
+            enabled?: boolean;
+            communicationProvider?: string;
+            fromAddress?: string;
+            hmacSecret?: string;
+            deliveryMode?: "send" | "dry-run";
+            publicBaseUrl?: string;
+            contextUserForVerification?: string;
+            policy?: {
+                requireBusinessDomain?: boolean;
+                blockedDomains?: string[];
+                consumerDomains?: string[];
+                linkTtlMinutes?: number;
+                maxSendsPerSession?: number;
+                maxCodeAttempts?: number;
+                unverifiedMaxSeconds?: number;
+                verifiedMaxSeconds?: number;
+            };
+            rateLimits?: {
+                sendWindowMs?: number;
+                perIpSends?: number;
+                perEmailDomainSends?: number;
+                perEmailSends?: number;
+                codeAttemptWindowMs?: number;
+                perSessionCodeAttempts?: number;
+                redeemWindowMs?: number;
+                redeemPerIp?: number;
+            };
+        } & {
+            [k: string]: unknown;
+        };
+        recordingAssemblyGraceSeconds?: number;
     } & {
         [k: string]: unknown;
     };
@@ -6725,24 +9207,33 @@ export declare function loadConfig(): {
         writeProtection?: "strict" | "log" | "off";
     };
     serverExtensions?: z.objectOutputType<{
-        Enabled: z.ZodDefault<z.ZodBoolean>;
+        Enabled: z.ZodOptional<z.ZodBoolean>;
         DriverClass: z.ZodString;
-        RootPath: z.ZodString;
+        RootPath: z.ZodOptional<z.ZodString>;
         Settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.ZodTypeAny, "passthrough">[];
     cacheSettings?: {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
+        maxEntryPercentOfCache?: number | "auto";
         defaultTTLSeconds?: number;
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
         recordDataBroadcastEntities?: string[];
+        sharedCacheTTLSeconds?: number;
+        engineSweepIntervalSeconds?: number;
+        userCacheCheckIntervalSeconds?: number;
+        metadataSweepIntervalSeconds?: number;
+        startupWarmupLeaseSeconds?: number;
     };
     loggingSettings?: {
         graphql?: {
             logVariables?: boolean;
         };
     };
+    aiPromptRuns?: {
+        templateDataCapture?: "None" | "Referenced" | "Full";
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -6792,6 +9283,7 @@ export declare function loadConfig(): {
     ___codeGenAPIPort?: number;
     ___codeGenAPISubmissionDelay?: number;
     graphqlRootPath?: string;
+    apiBasePath?: string;
     enableIntrospection?: boolean;
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;