@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type ServerRole } from './serverRoleConfigUnits.js';
 declare const userHandlingInfoSchema: z.ZodObject<{
     autoCreateNewUsers: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     /** When true, auto-provisioning is restricted to the domains in `newUserAuthorizedDomains`. */
@@ -446,7 +447,7 @@ declare const multiTenancySchema: z.ZodObject<{
     defaultTenantColumn?: string;
     entityColumnMappings?: Record<string, string>;
     adminRoles?: string[];
-    writeProtection?: "strict" | "log" | "off";
+    writeProtection?: "off" | "strict" | "log";
 }, {
     enabled?: string | number | boolean;
     contextSource?: "header" | "linkedEntity" | "custom";
@@ -457,7 +458,7 @@ declare const multiTenancySchema: z.ZodObject<{
     defaultTenantColumn?: string;
     entityColumnMappings?: Record<string, string>;
     adminRoles?: string[];
-    writeProtection?: "strict" | "log" | "off";
+    writeProtection?: "off" | "strict" | "log";
 }>;
 declare const telemetrySchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -568,6 +569,123 @@ declare const cacheSettingsSchema: z.ZodObject<{
      * for it. 0 disables the turn-taking. Default: 30.
      */
     startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Pluggable cache invalidation broadcast topology configuration.
+     * Defaults to `'SequencedRoleBucket'` (Topology 1 Monotonic Sequence Ring Buffer + Topology 2
+     * Role-Fingerprint $O(\text{Roles})$ evaluation & shaping memoizer).
+     */
+    broadcast: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        ringBufferSize: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        excludedEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        azureWebPubSub: z.ZodOptional<z.ZodObject<{
+            endpoint: z.ZodOptional<z.ZodString>;
+            hubName: z.ZodOptional<z.ZodString>;
+            accessKey: z.ZodOptional<z.ZodString>;
+            tokenTtlMinutes: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        }, {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        }>>;
+        awsIoTCore: z.ZodOptional<z.ZodObject<{
+            endpoint: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+            topicPrefix: z.ZodOptional<z.ZodString>;
+            accessKeyId: z.ZodOptional<z.ZodString>;
+            secretAccessKey: z.ZodOptional<z.ZodString>;
+            tokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        }, {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        }>>;
+        gcpPubSub: z.ZodOptional<z.ZodObject<{
+            projectId: z.ZodOptional<z.ZodString>;
+            topicPrefix: z.ZodOptional<z.ZodString>;
+            gatewayUrl: z.ZodOptional<z.ZodString>;
+            signingSecret: z.ZodOptional<z.ZodString>;
+            tokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        }, {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        provider?: string;
+        ringBufferSize?: number;
+        excludedEntities?: string[];
+        azureWebPubSub?: {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        };
+        awsIoTCore?: {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        };
+        gcpPubSub?: {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        };
+    }, {
+        provider?: string;
+        ringBufferSize?: number;
+        excludedEntities?: string[];
+        azureWebPubSub?: {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        };
+        awsIoTCore?: {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        };
+        gcpPubSub?: {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        };
+    }>>;
 }, "strip", z.ZodTypeAny, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
@@ -581,6 +699,32 @@ declare const cacheSettingsSchema: z.ZodObject<{
     userCacheCheckIntervalSeconds?: number;
     metadataSweepIntervalSeconds?: number;
     startupWarmupLeaseSeconds?: number;
+    broadcast?: {
+        provider?: string;
+        ringBufferSize?: number;
+        excludedEntities?: string[];
+        azureWebPubSub?: {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        };
+        awsIoTCore?: {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        };
+        gcpPubSub?: {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        };
+    };
 }, {
     maxMemoryMB?: number;
     maxPercentOfCachePerEntity?: number;
@@ -594,6 +738,32 @@ declare const cacheSettingsSchema: z.ZodObject<{
     userCacheCheckIntervalSeconds?: number;
     metadataSweepIntervalSeconds?: number;
     startupWarmupLeaseSeconds?: number;
+    broadcast?: {
+        provider?: string;
+        ringBufferSize?: number;
+        excludedEntities?: string[];
+        azureWebPubSub?: {
+            endpoint?: string;
+            hubName?: string;
+            accessKey?: string;
+            tokenTtlMinutes?: number;
+        };
+        awsIoTCore?: {
+            endpoint?: string;
+            region?: string;
+            topicPrefix?: string;
+            accessKeyId?: string;
+            secretAccessKey?: string;
+            tokenTtlSeconds?: number;
+        };
+        gcpPubSub?: {
+            topicPrefix?: string;
+            tokenTtlSeconds?: number;
+            projectId?: string;
+            gatewayUrl?: string;
+            signingSecret?: string;
+        };
+    };
 }>;
 declare const loggingSettingsSchema: z.ZodObject<{
     graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -869,6 +1039,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -931,6 +1108,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -993,6 +1177,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, z.ZodTypeAny, "passthrough">>;
 /**
  * Public web widget config (plans/realtime/bridges-and-widget/public-web-widget.md).
@@ -3261,6 +3452,101 @@ declare const identityVerificationSchema: z.ZodObject<{
         redeemPerIp?: number;
     }>>>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * Remote browsers a TEXT conversation opens (`<mj-conversation-chat-area [AllowRemoteBrowser]>`), whose
+ * agents drive them through the `browser_*` tools. Realtime calls' browsers are not affected.
+ *
+ * Off by default: until `enabled` is true, every remote-browser operation on a conversation is refused,
+ * since each browser is a server Chromium process or a billed hosted session.
+ */
+declare const conversationBrowserSchema: z.ZodObject<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const realtimeSchema: z.ZodObject<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -3565,6 +3851,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -3869,6 +4244,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4173,6 +4637,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
@@ -4313,6 +4866,13 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4375,6 +4935,13 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4437,6 +5004,29 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    devAuth: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch for local-only development JWT auth (`MJ_DEV_AUTH_ENABLED=true`). Forbidden when NODE_ENV=production. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Optional default email for `/auth/dev-login` when no email is specified in the request body. */
+        defaultEmail: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch for local-only development JWT auth (`MJ_DEV_AUTH_ENABLED=true`). Forbidden when NODE_ENV=production. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Optional default email for `/auth/dev-login` when no email is specified in the request body. */
+        defaultEmail: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch for local-only development JWT auth (`MJ_DEV_AUTH_ENABLED=true`). Forbidden when NODE_ENV=production. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Optional default email for `/auth/dev-login` when no email is specified in the request body. */
+        defaultEmail: z.ZodOptional<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>>;
     widget: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch. When false, the /widget routes are not mounted. */
@@ -6292,6 +6882,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -6596,6 +7275,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -6900,6 +7668,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
@@ -7168,6 +8025,92 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     }>>>;
+    agentSessions: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        janitor: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            closeThresholdMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        }>>>;
+        bridgeReconciler: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }>>>;
+        handoffOfferExpiry: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    }, {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    }>>>;
+    agentRunWatchdog: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        heartbeatIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        staleThresholdMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    }, {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    }>>>;
+    conversationDetailReconciler: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    }, {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    }>>>;
     integrationSyncWorker: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch — off by default so existing deployments keep running syncs inline. */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -7313,7 +8256,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     }, {
         enabled?: string | number | boolean;
         contextSource?: "header" | "linkedEntity" | "custom";
@@ -7324,7 +8267,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     }>>>;
     serverExtensions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -7416,6 +8359,123 @@ declare const configInfoSchema: z.ZodObject<{
          * for it. 0 disables the turn-taking. Default: 30.
          */
         startupWarmupLeaseSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Pluggable cache invalidation broadcast topology configuration.
+         * Defaults to `'SequencedRoleBucket'` (Topology 1 Monotonic Sequence Ring Buffer + Topology 2
+         * Role-Fingerprint $O(\text{Roles})$ evaluation & shaping memoizer).
+         */
+        broadcast: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+            ringBufferSize: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            excludedEntities: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+            azureWebPubSub: z.ZodOptional<z.ZodObject<{
+                endpoint: z.ZodOptional<z.ZodString>;
+                hubName: z.ZodOptional<z.ZodString>;
+                accessKey: z.ZodOptional<z.ZodString>;
+                tokenTtlMinutes: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            }, {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            }>>;
+            awsIoTCore: z.ZodOptional<z.ZodObject<{
+                endpoint: z.ZodOptional<z.ZodString>;
+                region: z.ZodOptional<z.ZodString>;
+                topicPrefix: z.ZodOptional<z.ZodString>;
+                accessKeyId: z.ZodOptional<z.ZodString>;
+                secretAccessKey: z.ZodOptional<z.ZodString>;
+                tokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            }, {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            }>>;
+            gcpPubSub: z.ZodOptional<z.ZodObject<{
+                projectId: z.ZodOptional<z.ZodString>;
+                topicPrefix: z.ZodOptional<z.ZodString>;
+                gatewayUrl: z.ZodOptional<z.ZodString>;
+                signingSecret: z.ZodOptional<z.ZodString>;
+                tokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            }, {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        }, {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        }>>;
     }, "strip", z.ZodTypeAny, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
@@ -7429,6 +8489,32 @@ declare const configInfoSchema: z.ZodObject<{
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     }, {
         maxMemoryMB?: number;
         maxPercentOfCachePerEntity?: number;
@@ -7442,6 +8528,32 @@ declare const configInfoSchema: z.ZodObject<{
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     }>>>;
     loggingSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
@@ -7660,6 +8772,14 @@ declare const configInfoSchema: z.ZodObject<{
     websiteRunFromPackage: z.ZodOptional<z.ZodNumber>;
     userEmailMap: z.ZodOptional<z.ZodEffects<z.ZodString, Record<string, string>, string>>;
     mjCoreSchema: z.ZodString;
+    /**
+     * Server execution role for horizontal scaling:
+     * - `'all'` (default): runs both interactive HTTP/GraphQL/WebSocket handlers and background worker loops.
+     * - `'api'`: runs interactive HTTP/GraphQL/WebSocket handlers only; background worker loops are skipped.
+     * - `'worker'`: runs background worker loops (`ScheduledJobsService`, `IntegrationSyncWorkerService`,
+     *   `StartTaskGraphDispatcher`, `StartWorkQueueHost`, `SessionJanitor`, reconcilers).
+     */
+    serverRole: z.ZodDefault<z.ZodOptional<z.ZodEnum<["all", "api", "worker"]>>>;
 }, "strip", z.ZodTypeAny, {
     dbReadOnlyUsername?: string;
     dbReadOnlyPassword?: string;
@@ -7696,6 +8816,13 @@ declare const configInfoSchema: z.ZodObject<{
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
+    } & {
+        [k: string]: unknown;
+    };
+    devAuth?: {
+        enabled?: boolean;
+        defaultEmail?: string;
     } & {
         [k: string]: unknown;
     };
@@ -7843,6 +8970,16 @@ declare const configInfoSchema: z.ZodObject<{
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -7928,6 +9065,30 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -7966,7 +9127,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -7987,6 +9148,32 @@ declare const configInfoSchema: z.ZodObject<{
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     };
     loggingSettings?: {
         graphql?: {
@@ -8050,6 +9237,7 @@ declare const configInfoSchema: z.ZodObject<{
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;
     mjCoreSchema?: string;
+    serverRole?: "all" | "api" | "worker";
 }, {
     dbReadOnlyUsername?: string;
     dbReadOnlyPassword?: string;
@@ -8086,6 +9274,13 @@ declare const configInfoSchema: z.ZodObject<{
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
+    } & {
+        [k: string]: unknown;
+    };
+    devAuth?: {
+        enabled?: string | number | boolean;
+        defaultEmail?: string;
     } & {
         [k: string]: unknown;
     };
@@ -8233,6 +9428,16 @@ declare const configInfoSchema: z.ZodObject<{
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: string | number | boolean;
+            allowAnonymous?: string | number | boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -8318,6 +9523,30 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -8356,7 +9585,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectInputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -8377,6 +9606,32 @@ declare const configInfoSchema: z.ZodObject<{
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     };
     loggingSettings?: {
         graphql?: {
@@ -8440,12 +9695,15 @@ declare const configInfoSchema: z.ZodObject<{
     websiteRunFromPackage?: number;
     userEmailMap?: string;
     mjCoreSchema?: string;
+    serverRole?: "all" | "api" | "worker";
 }>;
+export type { ServerRole };
 export type UserHandlingInfo = z.infer<typeof userHandlingInfoSchema>;
 export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type WidgetConfig = z.infer<typeof widgetSchema>;
 export type TelephonyConfig = z.infer<typeof telephonySchema>;
 export type RealtimeConfig = z.infer<typeof realtimeSchema>;
+export type ConversationBrowserConfig = z.infer<typeof conversationBrowserSchema>;
 export type IdentityVerificationConfig = z.infer<typeof identityVerificationSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
@@ -8542,6 +9800,13 @@ export declare function LoadConfig(): {
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
+    } & {
+        [k: string]: unknown;
+    };
+    devAuth?: {
+        enabled?: boolean;
+        defaultEmail?: string;
     } & {
         [k: string]: unknown;
     };
@@ -8689,6 +9954,16 @@ export declare function LoadConfig(): {
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -8774,6 +10049,30 @@ export declare function LoadConfig(): {
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -8812,7 +10111,7 @@ export declare function LoadConfig(): {
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -8833,6 +10132,32 @@ export declare function LoadConfig(): {
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     };
     loggingSettings?: {
         graphql?: {
@@ -8896,6 +10221,7 @@ export declare function LoadConfig(): {
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;
     mjCoreSchema?: string;
+    serverRole?: "all" | "api" | "worker";
 };
 /** @deprecated Use {@link LoadConfig}. */
 export declare function loadConfig(): {
@@ -8934,6 +10260,13 @@ export declare function loadConfig(): {
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
+    } & {
+        [k: string]: unknown;
+    };
+    devAuth?: {
+        enabled?: boolean;
+        defaultEmail?: string;
     } & {
         [k: string]: unknown;
     };
@@ -9081,6 +10414,16 @@ export declare function loadConfig(): {
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -9166,6 +10509,30 @@ export declare function loadConfig(): {
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -9204,7 +10571,7 @@ export declare function loadConfig(): {
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -9225,6 +10592,32 @@ export declare function loadConfig(): {
         userCacheCheckIntervalSeconds?: number;
         metadataSweepIntervalSeconds?: number;
         startupWarmupLeaseSeconds?: number;
+        broadcast?: {
+            provider?: string;
+            ringBufferSize?: number;
+            excludedEntities?: string[];
+            azureWebPubSub?: {
+                endpoint?: string;
+                hubName?: string;
+                accessKey?: string;
+                tokenTtlMinutes?: number;
+            };
+            awsIoTCore?: {
+                endpoint?: string;
+                region?: string;
+                topicPrefix?: string;
+                accessKeyId?: string;
+                secretAccessKey?: string;
+                tokenTtlSeconds?: number;
+            };
+            gcpPubSub?: {
+                topicPrefix?: string;
+                tokenTtlSeconds?: number;
+                projectId?: string;
+                gatewayUrl?: string;
+                signingSecret?: string;
+            };
+        };
     };
     loggingSettings?: {
         graphql?: {
@@ -9288,5 +10681,6 @@ export declare function loadConfig(): {
     websiteRunFromPackage?: number;
     userEmailMap?: Record<string, string>;
     mjCoreSchema?: string;
+    serverRole?: "all" | "api" | "worker";
 };
 //# sourceMappingURL=config.d.ts.map