@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.8

package/dist/config.d.ts

@@ -447,7 +447,7 @@ declare const multiTenancySchema: z.ZodObject<{
     defaultTenantColumn?: string;
     entityColumnMappings?: Record<string, string>;
     adminRoles?: string[];
-    writeProtection?: "strict" | "log" | "off";
+    writeProtection?: "off" | "strict" | "log";
 }, {
     enabled?: string | number | boolean;
     contextSource?: "header" | "linkedEntity" | "custom";
@@ -458,7 +458,7 @@ declare const multiTenancySchema: z.ZodObject<{
     defaultTenantColumn?: string;
     entityColumnMappings?: Record<string, string>;
     adminRoles?: string[];
-    writeProtection?: "strict" | "log" | "off";
+    writeProtection?: "off" | "strict" | "log";
 }>;
 declare const telemetrySchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -1039,6 +1039,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -1101,6 +1108,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -1163,6 +1177,13 @@ declare const magicLinkSchema: z.ZodObject<{
      * returns the token as JSON. Append `?format=json` to force JSON regardless.
      */
     explorerUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+     * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+     * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+     * never expose an open redirect carrying session tokens.
+     */
+    allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, z.ZodTypeAny, "passthrough">>;
 /**
  * Public web widget config (plans/realtime/bridges-and-widget/public-web-widget.md).
@@ -3431,6 +3452,101 @@ declare const identityVerificationSchema: z.ZodObject<{
         redeemPerIp?: number;
     }>>>;
 }, z.ZodTypeAny, "passthrough">>;
+/**
+ * Remote browsers a TEXT conversation opens (`<mj-conversation-chat-area [AllowRemoteBrowser]>`), whose
+ * agents drive them through the `browser_*` tools. Realtime calls' browsers are not affected.
+ *
+ * Off by default: until `enabled` is true, every remote-browser operation on a conversation is refused,
+ * since each browser is a server Chromium process or a billed hosted session.
+ */
+declare const conversationBrowserSchema: z.ZodObject<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch. When false, no conversation can open a browser. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+    allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+    maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+     * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+     */
+    maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+     * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+     * pushed screencast with nothing else happening counts as unused. Default 15.
+     */
+    idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+     * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+     * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+     * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+     * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+     * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+     * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+     * refused). For real isolation, run the browsers under network egress rules. Default none.
+     */
+    allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const realtimeSchema: z.ZodObject<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -3735,6 +3851,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4039,6 +4244,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
     enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4343,6 +4637,95 @@ declare const realtimeSchema: z.ZodObject<{
      * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
      */
     recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Remote browsers that text conversations open (off by default). */
+    conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch. When false, no conversation can open a browser. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+        allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+        maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+         * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+         */
+        maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+         * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+         * pushed screencast with nothing else happening counts as unused. Default 15.
+         */
+        idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+         * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+         * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+         * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+         * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+         * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+         * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+         * refused). For real isolation, run the browsers under network egress rules. Default none.
+         */
+        allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
 }, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
@@ -4483,6 +4866,13 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4545,6 +4935,13 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -4607,6 +5004,13 @@ declare const configInfoSchema: z.ZodObject<{
          * returns the token as JSON. Append `?format=json` to force JSON regardless.
          */
         explorerUrl: z.ZodOptional<z.ZodString>;
+        /**
+         * Explicit frontend origins permitted for per-invite `RedirectUrl` targets (in addition to
+         * `explorerUrl` and concrete non-wildcard entries in `cors.allowedOrigins`). Wildcard `'*'`
+         * entries are always ignored so deployments using the default `cors.allowedOrigins: ['*']`
+         * never expose an open redirect carrying session tokens.
+         */
+        allowedRedirectOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, z.ZodTypeAny, "passthrough">>>>;
     devAuth: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch for local-only development JWT auth (`MJ_DEV_AUTH_ENABLED=true`). Forbidden when NODE_ENV=production. */
@@ -6478,6 +6882,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -6782,6 +7275,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         /** Master switch. When false, the WebRTC SDP broker router is not mounted. Defaults to true. */
         enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
@@ -7086,6 +7668,95 @@ declare const configInfoSchema: z.ZodObject<{
          * is assembled anyway as `Partial` (gaps become silence). Defaults to 90.
          */
         recordingAssemblyGraceSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Remote browsers that text conversations open (off by default). */
+        conversationBrowser: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            /** Master switch. When false, no conversation can open a browser. */
+            enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Also let anonymous principals (public widget guests, anonymous magic links) open one. */
+            allowAnonymous: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+            /** Most conversation browsers one user (or one anonymous guest) may hold at once. Default 2. */
+            maxPerUser: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Most conversation browsers all anonymous guests together may hold at once, since a guest can start a
+             * new guest scope cheaply (limited only by the per-IP rate limit). Applies only with `allowAnonymous`. Default 4.
+             */
+            maxAnonymousTotal: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Minutes unused after which a conversation browser is ended (a reloaded or closed tab never ends its own).
+             * Used means an agent or the user acts on it, or its open drawer polls for a snapshot; a drawer showing a
+             * pushed screencast with nothing else happening counts as unused. Default 15.
+             */
+            idleMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            /**
+             * Private hosts a conversation browser may still reach, as `host` or `host:port` (e.g. `localhost:4200`).
+             * Every other loopback, link-local or private-network HOSTNAME is refused (private IPv4 and IPv6 ranges,
+             * `localhost`, names under `.local`, `.localdomain`, `.internal`, `.intranet`, `.lan`, `.corp`, `.home`,
+             * `.home.arpa`, `.private` and `.svc`, and the Docker, Kubernetes and cloud-metadata names), including where
+             * a main-frame redirect lands, and in popups the page opens. This is a best-effort hostname check. Gets through: a public name that resolves to a
+             * private address, WebSockets, service-worker fetches, an iframe whose source redirects to a private
+             * host, redirects of the page's own requests, and the redirect request itself (only where it lands is
+             * refused). For real isolation, run the browsers under network egress rules. Default none.
+             */
+            allowedPrivateHosts: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        }, z.ZodTypeAny, "passthrough">>>>;
     }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
@@ -7354,6 +8025,92 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     }>>>;
+    agentSessions: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        janitor: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            closeThresholdMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        }>>>;
+        bridgeReconciler: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }>>>;
+        handoffOfferExpiry: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }, {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    }, {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    }>>>;
+    agentRunWatchdog: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        heartbeatIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        staleThresholdMinutes: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    }, {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    }>>>;
+    conversationDetailReconciler: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        sweepIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    }, {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    }>>>;
     integrationSyncWorker: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Master switch — off by default so existing deployments keep running syncs inline. */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -7499,7 +8256,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     }, {
         enabled?: string | number | boolean;
         contextSource?: "header" | "linkedEntity" | "custom";
@@ -7510,7 +8267,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     }>>>;
     serverExtensions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -8059,6 +8816,7 @@ declare const configInfoSchema: z.ZodObject<{
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
     } & {
         [k: string]: unknown;
     };
@@ -8212,6 +8970,16 @@ declare const configInfoSchema: z.ZodObject<{
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -8297,6 +9065,30 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -8335,7 +9127,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -8482,6 +9274,7 @@ declare const configInfoSchema: z.ZodObject<{
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
     } & {
         [k: string]: unknown;
     };
@@ -8635,6 +9428,16 @@ declare const configInfoSchema: z.ZodObject<{
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: string | number | boolean;
+            allowAnonymous?: string | number | boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -8720,6 +9523,30 @@ declare const configInfoSchema: z.ZodObject<{
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -8758,7 +9585,7 @@ declare const configInfoSchema: z.ZodObject<{
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectInputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -8876,6 +9703,7 @@ export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type WidgetConfig = z.infer<typeof widgetSchema>;
 export type TelephonyConfig = z.infer<typeof telephonySchema>;
 export type RealtimeConfig = z.infer<typeof realtimeSchema>;
+export type ConversationBrowserConfig = z.infer<typeof conversationBrowserSchema>;
 export type IdentityVerificationConfig = z.infer<typeof identityVerificationSchema>;
 export type TwilioTelephonyConfig = z.infer<typeof twilioTelephonySchema>;
 export type VonageTelephonyConfig = z.infer<typeof vonageTelephonySchema>;
@@ -8972,6 +9800,7 @@ export declare function LoadConfig(): {
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
     } & {
         [k: string]: unknown;
     };
@@ -9125,6 +9954,16 @@ export declare function LoadConfig(): {
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -9210,6 +10049,30 @@ export declare function LoadConfig(): {
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -9248,7 +10111,7 @@ export declare function LoadConfig(): {
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;
@@ -9397,6 +10260,7 @@ export declare function loadConfig(): {
         redeemRateLimitMax?: number;
         createRateLimitMax?: number;
         explorerUrl?: string;
+        allowedRedirectOrigins?: string[];
     } & {
         [k: string]: unknown;
     };
@@ -9550,6 +10414,16 @@ export declare function loadConfig(): {
             [k: string]: unknown;
         };
         recordingAssemblyGraceSeconds?: number;
+        conversationBrowser?: {
+            enabled?: boolean;
+            allowAnonymous?: boolean;
+            maxPerUser?: number;
+            maxAnonymousTotal?: number;
+            idleMinutes?: number;
+            allowedPrivateHosts?: string[];
+        } & {
+            [k: string]: unknown;
+        };
     } & {
         [k: string]: unknown;
     };
@@ -9635,6 +10509,30 @@ export declare function loadConfig(): {
         defaultLockTimeout?: number;
         staleLockCleanupInterval?: number;
     };
+    agentSessions?: {
+        janitor?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+            closeThresholdMinutes?: number;
+        };
+        bridgeReconciler?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+        handoffOfferExpiry?: {
+            enabled?: boolean;
+            sweepIntervalMs?: number;
+        };
+    };
+    agentRunWatchdog?: {
+        sweepIntervalMs?: number;
+        heartbeatIntervalMs?: number;
+        staleThresholdMinutes?: number;
+    };
+    conversationDetailReconciler?: {
+        enabled?: boolean;
+        sweepIntervalMs?: number;
+    };
     integrationSyncWorker?: {
         enabled?: boolean;
         systemUserEmail?: string;
@@ -9673,7 +10571,7 @@ export declare function loadConfig(): {
         defaultTenantColumn?: string;
         entityColumnMappings?: Record<string, string>;
         adminRoles?: string[];
-        writeProtection?: "strict" | "log" | "off";
+        writeProtection?: "off" | "strict" | "log";
     };
     serverExtensions?: z.objectOutputType<{
         Enabled: z.ZodOptional<z.ZodBoolean>;