remoteclaw 0.0.0 → 0.0.1

package/dist/zod-schema-CdBaNuxH.js

@@ -0,0 +1,2715 @@
+import path from "node:path";
+import { z } from "zod";
+
+//#region src/cli/parse-bytes.ts
+const UNIT_MULTIPLIERS = {
+	b: 1,
+	kb: 1024,
+	k: 1024,
+	mb: 1024 ** 2,
+	m: 1024 ** 2,
+	gb: 1024 ** 3,
+	g: 1024 ** 3,
+	tb: 1024 ** 4,
+	t: 1024 ** 4
+};
+function parseByteSize(raw, opts) {
+	const trimmed = String(raw ?? "").trim().toLowerCase();
+	if (!trimmed) throw new Error("invalid byte size (empty)");
+	const m = /^(\d+(?:\.\d+)?)([a-z]+)?$/.exec(trimmed);
+	if (!m) throw new Error(`invalid byte size: ${raw}`);
+	const value = Number(m[1]);
+	if (!Number.isFinite(value) || value < 0) throw new Error(`invalid byte size: ${raw}`);
+	const multiplier = UNIT_MULTIPLIERS[(m[2] ?? opts?.defaultUnit ?? "b").toLowerCase()];
+	if (!multiplier) throw new Error(`invalid byte size unit: ${raw}`);
+	const bytes = Math.round(value * multiplier);
+	if (!Number.isFinite(bytes)) throw new Error(`invalid byte size: ${raw}`);
+	return bytes;
+}
+
+//#endregion
+//#region src/cli/parse-duration.ts
+const DURATION_MULTIPLIERS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+function parseDurationMs(raw, opts) {
+	const trimmed = String(raw ?? "").trim().toLowerCase();
+	if (!trimmed) throw new Error("invalid duration (empty)");
+	const single = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)?$/.exec(trimmed);
+	if (single) {
+		const value = Number(single[1]);
+		if (!Number.isFinite(value) || value < 0) throw new Error(`invalid duration: ${raw}`);
+		const unit = single[2] ?? opts?.defaultUnit ?? "ms";
+		const ms = Math.round(value * DURATION_MULTIPLIERS[unit]);
+		if (!Number.isFinite(ms)) throw new Error(`invalid duration: ${raw}`);
+		return ms;
+	}
+	let totalMs = 0;
+	let consumed = 0;
+	for (const match of trimmed.matchAll(/(\d+(?:\.\d+)?)(ms|s|m|h|d)/g)) {
+		const [full, valueRaw, unitRaw] = match;
+		const index = match.index ?? -1;
+		if (!full || !valueRaw || !unitRaw || index < 0) throw new Error(`invalid duration: ${raw}`);
+		if (index !== consumed) throw new Error(`invalid duration: ${raw}`);
+		const value = Number(valueRaw);
+		if (!Number.isFinite(value) || value < 0) throw new Error(`invalid duration: ${raw}`);
+		const multiplier = DURATION_MULTIPLIERS[unitRaw];
+		if (!multiplier) throw new Error(`invalid duration: ${raw}`);
+		totalMs += value * multiplier;
+		consumed += full.length;
+	}
+	if (consumed !== trimmed.length || consumed === 0) throw new Error(`invalid duration: ${raw}`);
+	const ms = Math.round(totalMs);
+	if (!Number.isFinite(ms)) throw new Error(`invalid duration: ${raw}`);
+	return ms;
+}
+
+//#endregion
+//#region src/infra/safe-executable-value.ts
+const SHELL_METACHARS = /[;&|`$<>]/;
+const CONTROL_CHARS = /[\r\n]/;
+const QUOTE_CHARS = /["']/;
+const BARE_NAME_PATTERN = /^[A-Za-z0-9._+-]+$/;
+function isLikelyPath(value) {
+	if (value.startsWith(".") || value.startsWith("~")) return true;
+	if (value.includes("/") || value.includes("\\")) return true;
+	return /^[A-Za-z]:[\\/]/.test(value);
+}
+function isSafeExecutableValue(value) {
+	if (!value) return false;
+	const trimmed = value.trim();
+	if (!trimmed) return false;
+	if (trimmed.includes("\0")) return false;
+	if (CONTROL_CHARS.test(trimmed)) return false;
+	if (SHELL_METACHARS.test(trimmed)) return false;
+	if (QUOTE_CHARS.test(trimmed)) return false;
+	if (isLikelyPath(trimmed)) return true;
+	if (trimmed.startsWith("-")) return false;
+	return BARE_NAME_PATTERN.test(trimmed);
+}
+
+//#endregion
+//#region src/config/zod-schema.sensitive.ts
+const sensitive = z.registry();
+
+//#endregion
+//#region src/config/zod-schema.core.ts
+const GroupChatSchema = z.object({
+	mentionPatterns: z.array(z.string()).optional(),
+	historyLimit: z.number().int().positive().optional()
+}).strict().optional();
+const DmConfigSchema = z.object({ historyLimit: z.number().int().min(0).optional() }).strict();
+const IdentitySchema = z.object({
+	name: z.string().optional(),
+	theme: z.string().optional(),
+	emoji: z.string().optional(),
+	avatar: z.string().optional()
+}).strict().optional();
+const QueueModeSchema = z.union([
+	z.literal("steer"),
+	z.literal("followup"),
+	z.literal("collect"),
+	z.literal("steer-backlog"),
+	z.literal("steer+backlog"),
+	z.literal("queue"),
+	z.literal("interrupt")
+]);
+const QueueDropSchema = z.union([
+	z.literal("old"),
+	z.literal("new"),
+	z.literal("summarize")
+]);
+const ReplyToModeSchema = z.union([
+	z.literal("off"),
+	z.literal("first"),
+	z.literal("all")
+]);
+const TypingModeSchema = z.union([
+	z.literal("never"),
+	z.literal("instant"),
+	z.literal("thinking"),
+	z.literal("message")
+]);
+const GroupPolicySchema = z.enum([
+	"open",
+	"disabled",
+	"allowlist"
+]);
+const DmPolicySchema = z.enum([
+	"pairing",
+	"allowlist",
+	"open",
+	"disabled"
+]);
+const BlockStreamingCoalesceSchema = z.object({
+	minChars: z.number().int().positive().optional(),
+	maxChars: z.number().int().positive().optional(),
+	idleMs: z.number().int().nonnegative().optional()
+}).strict();
+const ReplyRuntimeConfigSchemaShape = {
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	responsePrefix: z.string().optional(),
+	mediaMaxMb: z.number().positive().optional()
+};
+const BlockStreamingChunkSchema = z.object({
+	minChars: z.number().int().positive().optional(),
+	maxChars: z.number().int().positive().optional(),
+	breakPreference: z.union([
+		z.literal("paragraph"),
+		z.literal("newline"),
+		z.literal("sentence")
+	]).optional()
+}).strict();
+const MarkdownTableModeSchema = z.enum([
+	"off",
+	"bullets",
+	"code"
+]);
+const MarkdownConfigSchema = z.object({ tables: MarkdownTableModeSchema.optional() }).strict().optional();
+const TtsProviderSchema = z.string().min(1);
+const TtsModeSchema = z.enum(["final", "all"]);
+const TtsAutoSchema = z.enum([
+	"off",
+	"always",
+	"inbound",
+	"tagged"
+]);
+const TtsConfigSchema = z.object({
+	auto: TtsAutoSchema.optional(),
+	enabled: z.boolean().optional(),
+	mode: TtsModeSchema.optional(),
+	provider: TtsProviderSchema.optional(),
+	summaryModel: z.string().optional(),
+	modelOverrides: z.object({
+		enabled: z.boolean().optional(),
+		allowText: z.boolean().optional(),
+		allowProvider: z.boolean().optional(),
+		allowVoice: z.boolean().optional(),
+		allowModelId: z.boolean().optional(),
+		allowVoiceSettings: z.boolean().optional(),
+		allowNormalization: z.boolean().optional(),
+		allowSeed: z.boolean().optional()
+	}).strict().optional(),
+	elevenlabs: z.object({
+		apiKey: z.string().optional().register(sensitive),
+		baseUrl: z.string().optional(),
+		voiceId: z.string().optional(),
+		modelId: z.string().optional(),
+		seed: z.number().int().min(0).max(4294967295).optional(),
+		applyTextNormalization: z.enum([
+			"auto",
+			"on",
+			"off"
+		]).optional(),
+		languageCode: z.string().optional(),
+		voiceSettings: z.object({
+			stability: z.number().min(0).max(1).optional(),
+			similarityBoost: z.number().min(0).max(1).optional(),
+			style: z.number().min(0).max(1).optional(),
+			useSpeakerBoost: z.boolean().optional(),
+			speed: z.number().min(.5).max(2).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	openai: z.object({
+		apiKey: z.string().optional().register(sensitive),
+		model: z.string().optional(),
+		voice: z.string().optional()
+	}).strict().optional(),
+	edge: z.object({
+		enabled: z.boolean().optional(),
+		voice: z.string().optional(),
+		lang: z.string().optional(),
+		outputFormat: z.string().optional(),
+		pitch: z.string().optional(),
+		rate: z.string().optional(),
+		volume: z.string().optional(),
+		saveSubtitles: z.boolean().optional(),
+		proxy: z.string().optional(),
+		timeoutMs: z.number().int().min(1e3).max(12e4).optional()
+	}).strict().optional(),
+	prefsPath: z.string().optional(),
+	maxTextLength: z.number().int().min(1).optional(),
+	timeoutMs: z.number().int().min(1e3).max(12e4).optional()
+}).strict().optional();
+const HumanDelaySchema = z.object({
+	mode: z.union([
+		z.literal("off"),
+		z.literal("natural"),
+		z.literal("custom")
+	]).optional(),
+	minMs: z.number().int().nonnegative().optional(),
+	maxMs: z.number().int().nonnegative().optional()
+}).strict();
+const CliBackendWatchdogModeSchema = z.object({
+	noOutputTimeoutMs: z.number().int().min(1e3).optional(),
+	noOutputTimeoutRatio: z.number().min(.05).max(.95).optional(),
+	minMs: z.number().int().min(1e3).optional(),
+	maxMs: z.number().int().min(1e3).optional()
+}).strict().optional();
+const CliBackendSchema = z.object({
+	command: z.string(),
+	args: z.array(z.string()).optional(),
+	output: z.union([
+		z.literal("json"),
+		z.literal("text"),
+		z.literal("jsonl")
+	]).optional(),
+	resumeOutput: z.union([
+		z.literal("json"),
+		z.literal("text"),
+		z.literal("jsonl")
+	]).optional(),
+	input: z.union([z.literal("arg"), z.literal("stdin")]).optional(),
+	maxPromptArgChars: z.number().int().positive().optional(),
+	env: z.record(z.string(), z.string()).optional(),
+	clearEnv: z.array(z.string()).optional(),
+	modelArg: z.string().optional(),
+	modelAliases: z.record(z.string(), z.string()).optional(),
+	sessionArg: z.string().optional(),
+	sessionArgs: z.array(z.string()).optional(),
+	resumeArgs: z.array(z.string()).optional(),
+	sessionMode: z.union([
+		z.literal("always"),
+		z.literal("existing"),
+		z.literal("none")
+	]).optional(),
+	sessionIdFields: z.array(z.string()).optional(),
+	systemPromptArg: z.string().optional(),
+	systemPromptMode: z.union([z.literal("append"), z.literal("replace")]).optional(),
+	systemPromptWhen: z.union([
+		z.literal("first"),
+		z.literal("always"),
+		z.literal("never")
+	]).optional(),
+	imageArg: z.string().optional(),
+	imageMode: z.union([z.literal("repeat"), z.literal("list")]).optional(),
+	serialize: z.boolean().optional(),
+	reliability: z.object({ watchdog: z.object({
+		fresh: CliBackendWatchdogModeSchema,
+		resume: CliBackendWatchdogModeSchema
+	}).strict().optional() }).strict().optional()
+}).strict();
+const normalizeAllowFrom = (values) => (values ?? []).map((v) => String(v).trim()).filter(Boolean);
+const requireOpenAllowFrom = (params) => {
+	if (params.policy !== "open") return;
+	if (normalizeAllowFrom(params.allowFrom).includes("*")) return;
+	params.ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: params.path,
+		message: params.message
+	});
+};
+const MSTeamsReplyStyleSchema = z.enum(["thread", "top-level"]);
+const RetryConfigSchema = z.object({
+	attempts: z.number().int().min(1).optional(),
+	minDelayMs: z.number().int().min(0).optional(),
+	maxDelayMs: z.number().int().min(0).optional(),
+	jitter: z.number().min(0).max(1).optional()
+}).strict().optional();
+const QueueModeBySurfaceSchema = z.object({
+	whatsapp: QueueModeSchema.optional(),
+	telegram: QueueModeSchema.optional(),
+	discord: QueueModeSchema.optional(),
+	irc: QueueModeSchema.optional(),
+	slack: QueueModeSchema.optional(),
+	mattermost: QueueModeSchema.optional(),
+	signal: QueueModeSchema.optional(),
+	imessage: QueueModeSchema.optional(),
+	msteams: QueueModeSchema.optional(),
+	webchat: QueueModeSchema.optional()
+}).strict().optional();
+const DebounceMsBySurfaceSchema = z.record(z.string(), z.number().int().nonnegative()).optional();
+const QueueSchema = z.object({
+	mode: QueueModeSchema.optional(),
+	byChannel: QueueModeBySurfaceSchema,
+	debounceMs: z.number().int().nonnegative().optional(),
+	debounceMsByChannel: DebounceMsBySurfaceSchema,
+	cap: z.number().int().positive().optional(),
+	drop: QueueDropSchema.optional()
+}).strict().optional();
+const InboundDebounceSchema = z.object({
+	debounceMs: z.number().int().nonnegative().optional(),
+	byChannel: DebounceMsBySurfaceSchema
+}).strict().optional();
+const TranscribeAudioSchema = z.object({
+	command: z.array(z.string()).superRefine((value, ctx) => {
+		const executable = value[0];
+		if (!isSafeExecutableValue(executable)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: [0],
+			message: "expected safe executable name or path"
+		});
+	}),
+	timeoutSeconds: z.number().int().positive().optional()
+}).strict().optional();
+const HexColorSchema = z.string().regex(/^#?[0-9a-fA-F]{6}$/, "expected hex color (RRGGBB)");
+const ExecutableTokenSchema = z.string().refine(isSafeExecutableValue, "expected safe executable name or path");
+const DeepgramAudioSchema = z.object({
+	detectLanguage: z.boolean().optional(),
+	punctuate: z.boolean().optional(),
+	smartFormat: z.boolean().optional()
+}).strict().optional();
+const ProviderOptionValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+const ProviderOptionsSchema = z.record(z.string(), z.record(z.string(), ProviderOptionValueSchema)).optional();
+const MediaUnderstandingRuntimeFields = {
+	prompt: z.string().optional(),
+	timeoutSeconds: z.number().int().positive().optional(),
+	language: z.string().optional(),
+	providerOptions: ProviderOptionsSchema,
+	deepgram: DeepgramAudioSchema,
+	baseUrl: z.string().optional(),
+	headers: z.record(z.string(), z.string()).optional()
+};
+const MediaUnderstandingModelSchema = z.object({
+	provider: z.string().optional(),
+	model: z.string().optional(),
+	type: z.union([z.literal("provider"), z.literal("cli")]).optional(),
+	command: z.string().optional(),
+	args: z.array(z.string()).optional(),
+	maxChars: z.number().int().positive().optional(),
+	maxBytes: z.number().int().positive().optional(),
+	...MediaUnderstandingRuntimeFields,
+	profile: z.string().optional(),
+	preferredProfile: z.string().optional()
+}).strict().optional();
+const ToolsMediaUnderstandingSchema = z.object({
+	enabled: z.boolean().optional(),
+	maxBytes: z.number().int().positive().optional(),
+	maxChars: z.number().int().positive().optional(),
+	...MediaUnderstandingRuntimeFields,
+	models: z.array(MediaUnderstandingModelSchema).optional()
+}).strict().optional();
+const ToolsMediaSchema = z.object({ audio: ToolsMediaUnderstandingSchema.optional() }).strict().optional();
+const NativeCommandsSettingSchema = z.union([z.boolean(), z.literal("auto")]);
+const ProviderCommandsSchema = z.object({ native: NativeCommandsSettingSchema.optional() }).strict().optional();
+
+//#endregion
+//#region src/config/zod-schema.agent-runtime.ts
+/** Auth profile ref: `false` (skip), single string, or string array (rotation). */
+const AuthFieldSchema = z.union([
+	z.literal(false),
+	z.string(),
+	z.array(z.string())
+]).optional();
+const BootSchema = z.object({
+	prompt: z.string().optional(),
+	file: z.string().optional()
+}).strict().optional();
+const HeartbeatSchema = z.object({
+	every: z.string().optional(),
+	activeHours: z.object({
+		start: z.string().optional(),
+		end: z.string().optional(),
+		timezone: z.string().optional()
+	}).strict().optional(),
+	model: z.string().optional(),
+	session: z.string().optional(),
+	target: z.string().optional(),
+	to: z.string().optional(),
+	accountId: z.string().optional(),
+	prompt: z.string().optional(),
+	file: z.string().optional(),
+	suppressToolErrorWarnings: z.boolean().optional()
+}).strict().superRefine((val, ctx) => {
+	if (!val.every) return;
+	try {
+		parseDurationMs(val.every, { defaultUnit: "m" });
+	} catch {
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["every"],
+			message: "invalid duration (use ms, s, m, h)"
+		});
+	}
+	const active = val.activeHours;
+	if (!active) return;
+	const timePattern = /^([01]\d|2[0-3]|24):([0-5]\d)$/;
+	const validateTime = (raw, opts, path) => {
+		if (!raw) return;
+		if (!timePattern.test(raw)) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["activeHours", path],
+				message: "invalid time (use \"HH:MM\" 24h format)"
+			});
+			return;
+		}
+		const [hourStr, minuteStr] = raw.split(":");
+		const hour = Number(hourStr);
+		if (hour === 24 && Number(minuteStr) !== 0) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["activeHours", path],
+				message: "invalid time (24:00 is the only allowed 24:xx value)"
+			});
+			return;
+		}
+		if (hour === 24 && !opts.allow24) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["activeHours", path],
+			message: "invalid time (start cannot be 24:00)"
+		});
+	};
+	validateTime(active.start, { allow24: false }, "start");
+	validateTime(active.end, { allow24: true }, "end");
+}).optional();
+const ToolPolicyBaseSchema = z.object({
+	allow: z.array(z.string()).optional(),
+	alsoAllow: z.array(z.string()).optional(),
+	deny: z.array(z.string()).optional()
+}).strict();
+const ToolPolicySchema = ToolPolicyBaseSchema.superRefine((value, ctx) => {
+	if (value.allow && value.allow.length > 0 && value.alsoAllow && value.alsoAllow.length > 0) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "tools policy cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)"
+	});
+}).optional();
+const ToolProfileSchema = z.union([
+	z.literal("minimal"),
+	z.literal("coding"),
+	z.literal("messaging"),
+	z.literal("full")
+]).optional();
+function addAllowAlsoAllowConflictIssue(value, ctx, message) {
+	if (value.allow && value.allow.length > 0 && value.alsoAllow && value.alsoAllow.length > 0) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message
+	});
+}
+const ToolPolicyWithProfileSchema = z.object({
+	allow: z.array(z.string()).optional(),
+	alsoAllow: z.array(z.string()).optional(),
+	deny: z.array(z.string()).optional(),
+	profile: ToolProfileSchema
+}).strict().superRefine((value, ctx) => {
+	addAllowAlsoAllowConflictIssue(value, ctx, "tools.byProvider policy cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)");
+});
+const ToolExecSafeBinProfileSchema = z.object({
+	minPositional: z.number().int().nonnegative().optional(),
+	maxPositional: z.number().int().nonnegative().optional(),
+	allowedValueFlags: z.array(z.string()).optional(),
+	deniedFlags: z.array(z.string()).optional()
+}).strict();
+const ToolExecBaseShape = {
+	host: z.enum([
+		"sandbox",
+		"gateway",
+		"node"
+	]).optional(),
+	security: z.enum([
+		"deny",
+		"allowlist",
+		"full"
+	]).optional(),
+	ask: z.enum([
+		"off",
+		"on-miss",
+		"always"
+	]).optional(),
+	node: z.string().optional(),
+	pathPrepend: z.array(z.string()).optional(),
+	safeBins: z.array(z.string()).optional(),
+	safeBinTrustedDirs: z.array(z.string()).optional(),
+	safeBinProfiles: z.record(z.string(), ToolExecSafeBinProfileSchema).optional(),
+	backgroundMs: z.number().int().positive().optional(),
+	timeoutSec: z.number().int().positive().optional(),
+	cleanupMs: z.number().int().positive().optional(),
+	notifyOnExit: z.boolean().optional(),
+	notifyOnExitEmptySuccess: z.boolean().optional()
+};
+const AgentToolExecSchema = z.object({
+	...ToolExecBaseShape,
+	approvalRunningNoticeMs: z.number().int().nonnegative().optional()
+}).strict().optional();
+const ToolExecSchema = z.object(ToolExecBaseShape).strict().optional();
+const ToolFsSchema = z.object({ workspaceOnly: z.boolean().optional() }).strict().optional();
+const CommonToolPolicyFields = {
+	profile: ToolProfileSchema,
+	allow: z.array(z.string()).optional(),
+	alsoAllow: z.array(z.string()).optional(),
+	deny: z.array(z.string()).optional(),
+	byProvider: z.record(z.string(), ToolPolicyWithProfileSchema).optional()
+};
+const AgentToolsSchema = z.object({
+	...CommonToolPolicyFields,
+	exec: AgentToolExecSchema,
+	fs: ToolFsSchema
+}).strict().superRefine((value, ctx) => {
+	addAllowAlsoAllowConflictIssue(value, ctx, "agent tools cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)");
+}).optional();
+const AgentEntrySchema = z.object({
+	id: z.string(),
+	default: z.boolean().optional(),
+	name: z.string().optional(),
+	workspace: z.string().optional(),
+	agentDir: z.string().optional(),
+	humanDelay: HumanDelaySchema.optional(),
+	heartbeat: HeartbeatSchema,
+	boot: BootSchema,
+	identity: IdentitySchema,
+	groupChat: GroupChatSchema,
+	subagents: z.object({ allowAgents: z.array(z.string()).optional() }).strict().optional(),
+	editableFiles: z.array(z.string()).optional(),
+	tools: AgentToolsSchema,
+	auth: AuthFieldSchema,
+	runtime: z.union([
+		z.literal("claude"),
+		z.literal("gemini"),
+		z.literal("codex"),
+		z.literal("opencode")
+	]).optional(),
+	runtimeArgs: z.array(z.string()).optional(),
+	runtimeEnv: z.record(z.string(), z.string()).optional()
+}).strict();
+const ToolsSchema = z.object({
+	...CommonToolPolicyFields,
+	media: ToolsMediaSchema,
+	sessions: z.object({ visibility: z.enum([
+		"self",
+		"tree",
+		"agent",
+		"all"
+	]).optional() }).strict().optional(),
+	message: z.object({
+		allowCrossContextSend: z.boolean().optional(),
+		crossContext: z.object({
+			allowWithinProvider: z.boolean().optional(),
+			allowAcrossProviders: z.boolean().optional(),
+			marker: z.object({
+				enabled: z.boolean().optional(),
+				prefix: z.string().optional(),
+				suffix: z.string().optional()
+			}).strict().optional()
+		}).strict().optional(),
+		broadcast: z.object({ enabled: z.boolean().optional() }).strict().optional()
+	}).strict().optional(),
+	agentToAgent: z.object({
+		enabled: z.boolean().optional(),
+		allow: z.array(z.string()).optional()
+	}).strict().optional(),
+	exec: ToolExecSchema,
+	fs: ToolFsSchema,
+	subagents: z.object({ tools: ToolPolicySchema }).strict().optional()
+}).strict().superRefine((value, ctx) => {
+	addAllowAlsoAllowConflictIssue(value, ctx, "tools cannot set both allow and alsoAllow in the same scope (merge alsoAllow into allow, or remove allow and use profile + alsoAllow)");
+}).optional();
+
+//#endregion
+//#region src/config/zod-schema.agent-defaults.ts
+const AgentDefaultsSchema = z.object({
+	imageModel: z.unknown().optional(),
+	models: z.unknown().optional(),
+	workspace: z.string().optional(),
+	repoRoot: z.string().optional(),
+	userTimezone: z.string().optional(),
+	timeFormat: z.union([
+		z.literal("auto"),
+		z.literal("12"),
+		z.literal("24")
+	]).optional(),
+	envelopeTimezone: z.string().optional(),
+	envelopeTimestamp: z.union([z.literal("on"), z.literal("off")]).optional(),
+	envelopeElapsed: z.union([z.literal("on"), z.literal("off")]).optional(),
+	contextTokens: z.number().int().positive().optional(),
+	cliBackends: z.unknown().optional(),
+	contextPruning: z.object({
+		mode: z.union([z.literal("off"), z.literal("cache-ttl")]).optional(),
+		ttl: z.string().optional(),
+		keepLastAssistants: z.number().int().nonnegative().optional(),
+		softTrimRatio: z.number().min(0).max(1).optional(),
+		hardClearRatio: z.number().min(0).max(1).optional(),
+		minPrunableToolChars: z.number().int().nonnegative().optional(),
+		tools: z.object({
+			allow: z.array(z.string()).optional(),
+			deny: z.array(z.string()).optional()
+		}).strict().optional(),
+		softTrim: z.object({
+			maxChars: z.number().int().nonnegative().optional(),
+			headChars: z.number().int().nonnegative().optional(),
+			tailChars: z.number().int().nonnegative().optional()
+		}).strict().optional(),
+		hardClear: z.object({
+			enabled: z.boolean().optional(),
+			placeholder: z.string().optional()
+		}).strict().optional()
+	}).strict().optional(),
+	verboseDefault: z.union([
+		z.literal("off"),
+		z.literal("on"),
+		z.literal("full")
+	]).optional(),
+	blockStreamingDefault: z.union([z.literal("off"), z.literal("on")]).optional(),
+	blockStreamingBreak: z.union([z.literal("text_end"), z.literal("message_end")]).optional(),
+	blockStreamingChunk: BlockStreamingChunkSchema.optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	humanDelay: HumanDelaySchema.optional(),
+	timeoutSeconds: z.number().int().positive().optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	imageMaxDimensionPx: z.number().int().positive().optional(),
+	typingIntervalSeconds: z.number().int().positive().optional(),
+	typingMode: TypingModeSchema.optional(),
+	heartbeat: HeartbeatSchema,
+	boot: BootSchema,
+	maxConcurrent: z.number().int().positive().optional(),
+	subagents: z.object({
+		maxConcurrent: z.number().int().positive().optional(),
+		maxSpawnDepth: z.number().int().min(1).max(5).optional().describe("Maximum nesting depth for sub-agent spawning. 1 = no nesting (default), 2 = sub-agents can spawn sub-sub-agents."),
+		maxChildrenPerAgent: z.number().int().min(1).max(20).optional().describe("Maximum number of active children a single agent session can spawn (default: 5)."),
+		archiveAfterMinutes: z.number().int().positive().optional(),
+		runTimeoutSeconds: z.number().int().min(0).optional(),
+		announceTimeoutMs: z.number().int().positive().optional()
+	}).strict().optional(),
+	editableFiles: z.array(z.string()).optional(),
+	sandbox: z.unknown().optional(),
+	runtime: z.union([
+		z.literal("claude"),
+		z.literal("gemini"),
+		z.literal("codex"),
+		z.literal("opencode")
+	]).optional(),
+	runtimeArgs: z.array(z.string()).optional(),
+	runtimeEnv: z.record(z.string(), z.string()).optional(),
+	auth: AuthFieldSchema
+}).strict().optional();
+
+//#endregion
+//#region src/config/zod-schema.agents.ts
+const AgentsSchema = z.object({
+	defaults: z.lazy(() => AgentDefaultsSchema).optional(),
+	list: z.array(AgentEntrySchema).optional()
+}).strict().optional();
+const BindingsSchema = z.array(z.object({
+	agentId: z.string(),
+	comment: z.string().optional(),
+	match: z.object({
+		channel: z.string(),
+		accountId: z.string().optional(),
+		peer: z.object({
+			kind: z.union([
+				z.literal("direct"),
+				z.literal("group"),
+				z.literal("channel"),
+				z.literal("dm")
+			]),
+			id: z.string()
+		}).strict().optional(),
+		guildId: z.string().optional(),
+		teamId: z.string().optional(),
+		roles: z.array(z.string()).optional()
+	}).strict()
+}).strict()).optional();
+const BroadcastStrategySchema = z.enum(["parallel", "sequential"]);
+const BroadcastSchema = z.object({ strategy: BroadcastStrategySchema.optional() }).catchall(z.array(z.string())).optional();
+const AudioSchema = z.object({ transcription: TranscribeAudioSchema }).strict().optional();
+
+//#endregion
+//#region src/config/zod-schema.approvals.ts
+const ExecApprovalForwardTargetSchema = z.object({
+	channel: z.string().min(1),
+	to: z.string().min(1),
+	accountId: z.string().optional(),
+	threadId: z.union([z.string(), z.number()]).optional()
+}).strict();
+const ExecApprovalForwardingSchema = z.object({
+	enabled: z.boolean().optional(),
+	mode: z.union([
+		z.literal("session"),
+		z.literal("targets"),
+		z.literal("both")
+	]).optional(),
+	agentFilter: z.array(z.string()).optional(),
+	sessionFilter: z.array(z.string()).optional(),
+	targets: z.array(ExecApprovalForwardTargetSchema).optional()
+}).strict().optional();
+const ApprovalsSchema = z.object({ exec: ExecApprovalForwardingSchema }).strict().optional();
+
+//#endregion
+//#region src/config/zod-schema.installs.ts
+const InstallSourceSchema = z.union([
+	z.literal("npm"),
+	z.literal("archive"),
+	z.literal("path")
+]);
+const InstallRecordShape = {
+	source: InstallSourceSchema,
+	spec: z.string().optional(),
+	sourcePath: z.string().optional(),
+	installPath: z.string().optional(),
+	version: z.string().optional(),
+	resolvedName: z.string().optional(),
+	resolvedVersion: z.string().optional(),
+	resolvedSpec: z.string().optional(),
+	integrity: z.string().optional(),
+	shasum: z.string().optional(),
+	resolvedAt: z.string().optional(),
+	installedAt: z.string().optional()
+};
+
+//#endregion
+//#region src/config/zod-schema.hooks.ts
+function isSafeRelativeModulePath(raw) {
+	const value = raw.trim();
+	if (!value) return false;
+	if (path.isAbsolute(value)) return false;
+	if (value.startsWith("~")) return false;
+	if (value.includes(":")) return false;
+	if (value.split(/[\\/]+/g).some((part) => part === "..")) return false;
+	return true;
+}
+const SafeRelativeModulePathSchema = z.string().refine(isSafeRelativeModulePath, "module must be a safe relative path (no absolute paths)");
+const HookMappingSchema = z.object({
+	id: z.string().optional(),
+	match: z.object({
+		path: z.string().optional(),
+		source: z.string().optional()
+	}).optional(),
+	action: z.union([z.literal("wake"), z.literal("agent")]).optional(),
+	wakeMode: z.union([z.literal("now"), z.literal("next-heartbeat")]).optional(),
+	name: z.string().optional(),
+	agentId: z.string().optional(),
+	sessionKey: z.string().optional().register(sensitive),
+	messageTemplate: z.string().optional(),
+	textTemplate: z.string().optional(),
+	deliver: z.boolean().optional(),
+	allowUnsafeExternalContent: z.boolean().optional(),
+	channel: z.union([
+		z.literal("last"),
+		z.literal("whatsapp"),
+		z.literal("telegram"),
+		z.literal("discord"),
+		z.literal("irc"),
+		z.literal("slack"),
+		z.literal("signal"),
+		z.literal("imessage"),
+		z.literal("msteams")
+	]).optional(),
+	to: z.string().optional(),
+	model: z.string().optional(),
+	thinking: z.string().optional(),
+	timeoutSeconds: z.number().int().positive().optional(),
+	transform: z.object({
+		module: SafeRelativeModulePathSchema,
+		export: z.string().optional()
+	}).strict().optional()
+}).strict().optional();
+const InternalHookHandlerSchema = z.object({
+	event: z.string(),
+	module: SafeRelativeModulePathSchema,
+	export: z.string().optional()
+}).strict();
+const HookConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	env: z.record(z.string(), z.string()).optional()
+}).passthrough();
+const HookInstallRecordSchema = z.object({
+	...InstallRecordShape,
+	hooks: z.array(z.string()).optional()
+}).strict();
+const InternalHooksSchema = z.object({
+	enabled: z.boolean().optional(),
+	handlers: z.array(InternalHookHandlerSchema).optional(),
+	entries: z.record(z.string(), HookConfigSchema).optional(),
+	load: z.object({ extraDirs: z.array(z.string()).optional() }).strict().optional(),
+	installs: z.record(z.string(), HookInstallRecordSchema).optional()
+}).strict().optional();
+const HooksGmailSchema = z.object({
+	account: z.string().optional(),
+	label: z.string().optional(),
+	topic: z.string().optional(),
+	subscription: z.string().optional(),
+	pushToken: z.string().optional().register(sensitive),
+	hookUrl: z.string().optional(),
+	includeBody: z.boolean().optional(),
+	maxBytes: z.number().int().positive().optional(),
+	renewEveryMinutes: z.number().int().positive().optional(),
+	allowUnsafeExternalContent: z.boolean().optional(),
+	serve: z.object({
+		bind: z.string().optional(),
+		port: z.number().int().positive().optional(),
+		path: z.string().optional()
+	}).strict().optional(),
+	tailscale: z.object({
+		mode: z.union([
+			z.literal("off"),
+			z.literal("serve"),
+			z.literal("funnel")
+		]).optional(),
+		path: z.string().optional(),
+		target: z.string().optional()
+	}).strict().optional(),
+	model: z.string().optional(),
+	thinking: z.union([
+		z.literal("off"),
+		z.literal("minimal"),
+		z.literal("low"),
+		z.literal("medium"),
+		z.literal("high")
+	]).optional()
+}).strict().optional();
+
+//#endregion
+//#region src/config/zod-schema.channels.ts
+const ChannelHeartbeatVisibilitySchema = z.object({
+	showOk: z.boolean().optional(),
+	showAlerts: z.boolean().optional(),
+	useIndicator: z.boolean().optional()
+}).strict().optional();
+
+//#endregion
+//#region src/infra/scp-host.ts
+const SSH_TOKEN = /^[A-Za-z0-9._-]+$/;
+const BRACKETED_IPV6 = /^\[[0-9A-Fa-f:.%]+\]$/;
+const WHITESPACE = /\s/;
+function hasControlOrWhitespace(value) {
+	for (const char of value) {
+		const code = char.charCodeAt(0);
+		if (code <= 31 || code === 127 || WHITESPACE.test(char)) return true;
+	}
+	return false;
+}
+function normalizeScpRemoteHost(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	if (hasControlOrWhitespace(trimmed)) return;
+	if (trimmed.startsWith("-") || trimmed.includes("/") || trimmed.includes("\\")) return;
+	const firstAt = trimmed.indexOf("@");
+	const lastAt = trimmed.lastIndexOf("@");
+	let user;
+	let host = trimmed;
+	if (firstAt !== -1) {
+		if (firstAt !== lastAt || firstAt === 0 || firstAt === trimmed.length - 1) return;
+		user = trimmed.slice(0, firstAt);
+		host = trimmed.slice(firstAt + 1);
+		if (!SSH_TOKEN.test(user)) return;
+	}
+	if (!host || host.startsWith("-") || host.includes("@")) return;
+	if (host.includes(":") && !BRACKETED_IPV6.test(host)) return;
+	if (!SSH_TOKEN.test(host) && !BRACKETED_IPV6.test(host)) return;
+	return user ? `${user}@${host}` : host;
+}
+function isSafeScpRemoteHost(value) {
+	return normalizeScpRemoteHost(value) !== void 0;
+}
+
+//#endregion
+//#region src/media/inbound-path-policy.ts
+const WILDCARD_SEGMENT = "*";
+const WINDOWS_DRIVE_ABS_RE = /^[A-Za-z]:\//;
+const WINDOWS_DRIVE_ROOT_RE = /^[A-Za-z]:$/;
+const DEFAULT_IMESSAGE_ATTACHMENT_ROOTS = ["/Users/*/Library/Messages/Attachments"];
+function normalizePosixAbsolutePath(value) {
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.includes("\0")) return;
+	const normalized = path.posix.normalize(trimmed.replaceAll("\\", "/"));
+	if (!(normalized.startsWith("/") || WINDOWS_DRIVE_ABS_RE.test(normalized)) || normalized === "/") return;
+	const withoutTrailingSlash = normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+	if (WINDOWS_DRIVE_ROOT_RE.test(withoutTrailingSlash)) return;
+	return withoutTrailingSlash;
+}
+function splitPathSegments(value) {
+	return value.split("/").filter(Boolean);
+}
+function matchesRootPattern(params) {
+	const candidateSegments = splitPathSegments(params.candidatePath);
+	const rootSegments = splitPathSegments(params.rootPattern);
+	if (candidateSegments.length < rootSegments.length) return false;
+	for (let idx = 0; idx < rootSegments.length; idx += 1) {
+		const expected = rootSegments[idx];
+		const actual = candidateSegments[idx];
+		if (expected === WILDCARD_SEGMENT) continue;
+		if (expected !== actual) return false;
+	}
+	return true;
+}
+function isValidInboundPathRootPattern(value) {
+	const normalized = normalizePosixAbsolutePath(value);
+	if (!normalized) return false;
+	const segments = splitPathSegments(normalized);
+	if (segments.length === 0) return false;
+	return segments.every((segment) => segment === WILDCARD_SEGMENT || !segment.includes("*"));
+}
+function normalizeInboundPathRoots(roots) {
+	const normalized = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const root of roots ?? []) {
+		if (typeof root !== "string") continue;
+		if (!isValidInboundPathRootPattern(root)) continue;
+		const candidate = normalizePosixAbsolutePath(root);
+		if (!candidate || seen.has(candidate)) continue;
+		seen.add(candidate);
+		normalized.push(candidate);
+	}
+	return normalized;
+}
+function mergeInboundPathRoots(...rootsLists) {
+	const merged = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const roots of rootsLists) {
+		const normalized = normalizeInboundPathRoots(roots);
+		for (const root of normalized) {
+			if (seen.has(root)) continue;
+			seen.add(root);
+			merged.push(root);
+		}
+	}
+	return merged;
+}
+function isInboundPathAllowed(params) {
+	const candidatePath = normalizePosixAbsolutePath(params.filePath);
+	if (!candidatePath) return false;
+	const roots = normalizeInboundPathRoots(params.roots);
+	const effectiveRoots = roots.length > 0 ? roots : normalizeInboundPathRoots(params.fallbackRoots ?? void 0);
+	if (effectiveRoots.length === 0) return false;
+	return effectiveRoots.some((rootPattern) => matchesRootPattern({
+		candidatePath,
+		rootPattern
+	}));
+}
+function resolveIMessageAccountConfig(params) {
+	const accountId = params.accountId?.trim();
+	if (!accountId) return;
+	return params.cfg.channels?.imessage?.accounts?.[accountId];
+}
+function resolveIMessageAttachmentRoots(params) {
+	return mergeInboundPathRoots(resolveIMessageAccountConfig(params)?.attachmentRoots, params.cfg.channels?.imessage?.attachmentRoots, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS);
+}
+function resolveIMessageRemoteAttachmentRoots(params) {
+	const accountConfig = resolveIMessageAccountConfig(params);
+	return mergeInboundPathRoots(accountConfig?.remoteAttachmentRoots, params.cfg.channels?.imessage?.remoteAttachmentRoots, accountConfig?.attachmentRoots, params.cfg.channels?.imessage?.attachmentRoots, DEFAULT_IMESSAGE_ATTACHMENT_ROOTS);
+}
+
+//#endregion
+//#region src/config/discord-preview-streaming.ts
+function normalizeStreamingMode(value) {
+	if (typeof value !== "string") return null;
+	return value.trim().toLowerCase() || null;
+}
+function parseStreamingMode(value) {
+	const normalized = normalizeStreamingMode(value);
+	if (normalized === "off" || normalized === "partial" || normalized === "block" || normalized === "progress") return normalized;
+	return null;
+}
+function parseDiscordPreviewStreamMode(value) {
+	const parsed = parseStreamingMode(value);
+	if (!parsed) return null;
+	return parsed === "progress" ? "partial" : parsed;
+}
+function parseSlackLegacyDraftStreamMode(value) {
+	const normalized = normalizeStreamingMode(value);
+	if (normalized === "replace" || normalized === "status_final" || normalized === "append") return normalized;
+	return null;
+}
+function mapSlackLegacyDraftStreamModeToStreaming(mode) {
+	if (mode === "append") return "block";
+	if (mode === "status_final") return "progress";
+	return "partial";
+}
+function mapStreamingModeToSlackLegacyDraftStreamMode(mode) {
+	if (mode === "block") return "append";
+	if (mode === "progress") return "status_final";
+	return "replace";
+}
+function resolveTelegramPreviewStreamMode(params = {}) {
+	const parsedStreaming = parseStreamingMode(params.streaming);
+	if (parsedStreaming) {
+		if (parsedStreaming === "progress") return "partial";
+		return parsedStreaming;
+	}
+	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
+	if (legacy) return legacy;
+	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
+	return "off";
+}
+function resolveDiscordPreviewStreamMode(params = {}) {
+	const parsedStreaming = parseDiscordPreviewStreamMode(params.streaming);
+	if (parsedStreaming) return parsedStreaming;
+	const legacy = parseDiscordPreviewStreamMode(params.streamMode);
+	if (legacy) return legacy;
+	if (typeof params.streaming === "boolean") return params.streaming ? "partial" : "off";
+	return "off";
+}
+function resolveSlackStreamingMode(params = {}) {
+	const parsedStreaming = parseStreamingMode(params.streaming);
+	if (parsedStreaming) return parsedStreaming;
+	const legacyStreamMode = parseSlackLegacyDraftStreamMode(params.streamMode);
+	if (legacyStreamMode) return mapSlackLegacyDraftStreamModeToStreaming(legacyStreamMode);
+	if (typeof params.streaming === "boolean") return "partial";
+	return "partial";
+}
+function resolveSlackNativeStreaming(params = {}) {
+	if (typeof params.nativeStreaming === "boolean") return params.nativeStreaming;
+	if (typeof params.streaming === "boolean") return params.streaming;
+	return true;
+}
+
+//#endregion
+//#region src/config/telegram-custom-commands.ts
+const TELEGRAM_COMMAND_NAME_PATTERN = /^[a-z0-9_]{1,32}$/;
+function normalizeTelegramCommandName(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return "";
+	return (trimmed.startsWith("/") ? trimmed.slice(1) : trimmed).trim().toLowerCase().replace(/-/g, "_");
+}
+function normalizeTelegramCommandDescription(value) {
+	return value.trim();
+}
+function resolveTelegramCustomCommands(params) {
+	const entries = Array.isArray(params.commands) ? params.commands : [];
+	const reserved = params.reservedCommands ?? /* @__PURE__ */ new Set();
+	const checkReserved = params.checkReserved !== false;
+	const checkDuplicates = params.checkDuplicates !== false;
+	const seen = /* @__PURE__ */ new Set();
+	const resolved = [];
+	const issues = [];
+	for (let index = 0; index < entries.length; index += 1) {
+		const entry = entries[index];
+		const normalized = normalizeTelegramCommandName(String(entry?.command ?? ""));
+		if (!normalized) {
+			issues.push({
+				index,
+				field: "command",
+				message: "Telegram custom command is missing a command name."
+			});
+			continue;
+		}
+		if (!TELEGRAM_COMMAND_NAME_PATTERN.test(normalized)) {
+			issues.push({
+				index,
+				field: "command",
+				message: `Telegram custom command "/${normalized}" is invalid (use a-z, 0-9, underscore; max 32 chars).`
+			});
+			continue;
+		}
+		if (checkReserved && reserved.has(normalized)) {
+			issues.push({
+				index,
+				field: "command",
+				message: `Telegram custom command "/${normalized}" conflicts with a native command.`
+			});
+			continue;
+		}
+		if (checkDuplicates && seen.has(normalized)) {
+			issues.push({
+				index,
+				field: "command",
+				message: `Telegram custom command "/${normalized}" is duplicated.`
+			});
+			continue;
+		}
+		const description = normalizeTelegramCommandDescription(String(entry?.description ?? ""));
+		if (!description) {
+			issues.push({
+				index,
+				field: "description",
+				message: `Telegram custom command "/${normalized}" is missing a description.`
+			});
+			continue;
+		}
+		if (checkDuplicates) seen.add(normalized);
+		resolved.push({
+			command: normalized,
+			description
+		});
+	}
+	return {
+		commands: resolved,
+		issues
+	};
+}
+
+//#endregion
+//#region src/config/zod-schema.providers-core.ts
+const ToolPolicyBySenderSchema$1 = z.record(z.string(), ToolPolicySchema).optional();
+const DiscordIdSchema = z.union([z.string(), z.number()]).refine((value) => typeof value === "string", { message: "Discord IDs must be strings (wrap numeric IDs in quotes)." });
+const DiscordIdListSchema = z.array(DiscordIdSchema);
+const TelegramInlineButtonsScopeSchema = z.enum([
+	"off",
+	"dm",
+	"group",
+	"all",
+	"allowlist"
+]);
+const TelegramCapabilitiesSchema = z.union([z.array(z.string()), z.object({ inlineButtons: TelegramInlineButtonsScopeSchema.optional() }).strict()]);
+const TelegramTopicSchema = z.object({
+	requireMention: z.boolean().optional(),
+	groupPolicy: GroupPolicySchema.optional(),
+	enabled: z.boolean().optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
+const TelegramGroupSchema = z.object({
+	requireMention: z.boolean().optional(),
+	groupPolicy: GroupPolicySchema.optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	enabled: z.boolean().optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional(),
+	topics: z.record(z.string(), TelegramTopicSchema.optional()).optional()
+}).strict();
+const TelegramCustomCommandSchema = z.object({
+	command: z.string().transform(normalizeTelegramCommandName),
+	description: z.string().transform(normalizeTelegramCommandDescription)
+}).strict();
+const validateTelegramCustomCommands = (value, ctx) => {
+	if (!value.customCommands || value.customCommands.length === 0) return;
+	const { issues } = resolveTelegramCustomCommands({
+		commands: value.customCommands,
+		checkReserved: false,
+		checkDuplicates: false
+	});
+	for (const issue of issues) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: [
+			"customCommands",
+			issue.index,
+			issue.field
+		],
+		message: issue.message
+	});
+};
+function normalizeTelegramStreamingConfig(value) {
+	value.streaming = resolveTelegramPreviewStreamMode(value);
+	delete value.streamMode;
+}
+function normalizeDiscordStreamingConfig(value) {
+	value.streaming = resolveDiscordPreviewStreamMode(value);
+	delete value.streamMode;
+}
+function normalizeSlackStreamingConfig(value) {
+	value.nativeStreaming = resolveSlackNativeStreaming(value);
+	value.streaming = resolveSlackStreamingMode(value);
+	delete value.streamMode;
+}
+const TelegramAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: TelegramCapabilitiesSchema.optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	commands: ProviderCommandsSchema,
+	customCommands: z.array(TelegramCustomCommandSchema).optional(),
+	configWrites: z.boolean().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	botToken: z.string().optional().register(sensitive),
+	tokenFile: z.string().optional(),
+	replyToMode: ReplyToModeSchema.optional(),
+	groups: z.record(z.string(), TelegramGroupSchema.optional()).optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	defaultTo: z.union([z.string(), z.number()]).optional(),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	streaming: z.union([z.boolean(), z.enum([
+		"off",
+		"partial",
+		"block",
+		"progress"
+	])]).optional(),
+	blockStreaming: z.boolean().optional(),
+	draftChunk: BlockStreamingChunkSchema.optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	streamMode: z.enum([
+		"off",
+		"partial",
+		"block"
+	]).optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	timeoutSeconds: z.number().int().positive().optional(),
+	retry: RetryConfigSchema,
+	network: z.object({
+		autoSelectFamily: z.boolean().optional(),
+		dnsResultOrder: z.enum(["ipv4first", "verbatim"]).optional()
+	}).strict().optional(),
+	proxy: z.string().optional(),
+	webhookUrl: z.string().optional(),
+	webhookSecret: z.string().optional().register(sensitive),
+	webhookPath: z.string().optional(),
+	webhookHost: z.string().optional(),
+	webhookPort: z.number().int().positive().optional(),
+	actions: z.object({
+		reactions: z.boolean().optional(),
+		sendMessage: z.boolean().optional(),
+		deleteMessage: z.boolean().optional(),
+		sticker: z.boolean().optional()
+	}).strict().optional(),
+	reactionNotifications: z.enum([
+		"off",
+		"own",
+		"all"
+	]).optional(),
+	reactionLevel: z.enum([
+		"off",
+		"ack",
+		"minimal",
+		"extensive"
+	]).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	linkPreview: z.boolean().optional(),
+	responsePrefix: z.string().optional(),
+	ackReaction: z.string().optional()
+}).strict();
+const TelegramAccountSchema = TelegramAccountSchemaBase.superRefine((value, ctx) => {
+	normalizeTelegramStreamingConfig(value);
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.telegram.dmPolicy=\"open\" requires channels.telegram.allowFrom to include \"*\""
+	});
+	validateTelegramCustomCommands(value, ctx);
+});
+const TelegramConfigSchema = TelegramAccountSchemaBase.extend({ accounts: z.record(z.string(), TelegramAccountSchema.optional()).optional() }).superRefine((value, ctx) => {
+	normalizeTelegramStreamingConfig(value);
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.telegram.dmPolicy=\"open\" requires channels.telegram.allowFrom to include \"*\""
+	});
+	validateTelegramCustomCommands(value, ctx);
+	const baseWebhookUrl = typeof value.webhookUrl === "string" ? value.webhookUrl.trim() : "";
+	const baseWebhookSecret = typeof value.webhookSecret === "string" ? value.webhookSecret.trim() : "";
+	if (baseWebhookUrl && !baseWebhookSecret) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "channels.telegram.webhookUrl requires channels.telegram.webhookSecret",
+		path: ["webhookSecret"]
+	});
+	if (!value.accounts) return;
+	for (const [accountId, account] of Object.entries(value.accounts)) {
+		if (!account) continue;
+		if (account.enabled === false) continue;
+		if (!(typeof account.webhookUrl === "string" ? account.webhookUrl.trim() : "")) continue;
+		if (!(typeof account.webhookSecret === "string" ? account.webhookSecret.trim() : "") && !baseWebhookSecret) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "channels.telegram.accounts.*.webhookUrl requires channels.telegram.webhookSecret or channels.telegram.accounts.*.webhookSecret",
+			path: [
+				"accounts",
+				accountId,
+				"webhookSecret"
+			]
+		});
+	}
+});
+const DiscordDmSchema = z.object({
+	enabled: z.boolean().optional(),
+	policy: DmPolicySchema.optional(),
+	allowFrom: DiscordIdListSchema.optional(),
+	groupEnabled: z.boolean().optional(),
+	groupChannels: DiscordIdListSchema.optional()
+}).strict();
+const DiscordGuildChannelSchema = z.object({
+	allow: z.boolean().optional(),
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	enabled: z.boolean().optional(),
+	users: DiscordIdListSchema.optional(),
+	roles: DiscordIdListSchema.optional(),
+	systemPrompt: z.string().optional(),
+	includeThreadStarter: z.boolean().optional(),
+	autoThread: z.boolean().optional()
+}).strict();
+const DiscordGuildSchema = z.object({
+	slug: z.string().optional(),
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	reactionNotifications: z.enum([
+		"off",
+		"own",
+		"all",
+		"allowlist"
+	]).optional(),
+	users: DiscordIdListSchema.optional(),
+	roles: DiscordIdListSchema.optional(),
+	channels: z.record(z.string(), DiscordGuildChannelSchema.optional()).optional()
+}).strict();
+const DiscordUiSchema = z.object({ components: z.object({ accentColor: HexColorSchema.optional() }).strict().optional() }).strict().optional();
+const DiscordVoiceAutoJoinSchema = z.object({
+	guildId: z.string().min(1),
+	channelId: z.string().min(1)
+}).strict();
+const DiscordVoiceSchema = z.object({
+	enabled: z.boolean().optional(),
+	autoJoin: z.array(DiscordVoiceAutoJoinSchema).optional(),
+	daveEncryption: z.boolean().optional(),
+	decryptionFailureTolerance: z.number().int().min(0).optional(),
+	tts: TtsConfigSchema.optional()
+}).strict().optional();
+const DiscordAccountSchema = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	commands: ProviderCommandsSchema,
+	configWrites: z.boolean().optional(),
+	token: z.string().optional().register(sensitive),
+	proxy: z.string().optional(),
+	allowBots: z.boolean().optional(),
+	dangerouslyAllowNameMatching: z.boolean().optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	streaming: z.union([z.boolean(), z.enum([
+		"off",
+		"partial",
+		"block",
+		"progress"
+	])]).optional(),
+	streamMode: z.enum([
+		"partial",
+		"block",
+		"off"
+	]).optional(),
+	draftChunk: BlockStreamingChunkSchema.optional(),
+	maxLinesPerMessage: z.number().int().positive().optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	retry: RetryConfigSchema,
+	actions: z.object({
+		reactions: z.boolean().optional(),
+		stickers: z.boolean().optional(),
+		emojiUploads: z.boolean().optional(),
+		stickerUploads: z.boolean().optional(),
+		polls: z.boolean().optional(),
+		permissions: z.boolean().optional(),
+		messages: z.boolean().optional(),
+		threads: z.boolean().optional(),
+		pins: z.boolean().optional(),
+		search: z.boolean().optional(),
+		memberInfo: z.boolean().optional(),
+		roleInfo: z.boolean().optional(),
+		roles: z.boolean().optional(),
+		channelInfo: z.boolean().optional(),
+		voiceStatus: z.boolean().optional(),
+		events: z.boolean().optional(),
+		moderation: z.boolean().optional(),
+		channels: z.boolean().optional(),
+		presence: z.boolean().optional()
+	}).strict().optional(),
+	replyToMode: ReplyToModeSchema.optional(),
+	dmPolicy: DmPolicySchema.optional(),
+	allowFrom: DiscordIdListSchema.optional(),
+	defaultTo: z.string().optional(),
+	dm: DiscordDmSchema.optional(),
+	guilds: z.record(z.string(), DiscordGuildSchema.optional()).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	execApprovals: z.object({
+		enabled: z.boolean().optional(),
+		approvers: DiscordIdListSchema.optional(),
+		agentFilter: z.array(z.string()).optional(),
+		sessionFilter: z.array(z.string()).optional(),
+		cleanupAfterResolve: z.boolean().optional(),
+		target: z.enum([
+			"dm",
+			"channel",
+			"both"
+		]).optional()
+	}).strict().optional(),
+	ui: DiscordUiSchema,
+	slashCommand: z.object({ ephemeral: z.boolean().optional() }).strict().optional(),
+	threadBindings: z.object({
+		enabled: z.boolean().optional(),
+		ttlHours: z.number().nonnegative().optional(),
+		spawnSubagentSessions: z.boolean().optional()
+	}).strict().optional(),
+	intents: z.object({
+		presence: z.boolean().optional(),
+		guildMembers: z.boolean().optional()
+	}).strict().optional(),
+	voice: DiscordVoiceSchema,
+	pluralkit: z.object({
+		enabled: z.boolean().optional(),
+		token: z.string().optional().register(sensitive)
+	}).strict().optional(),
+	responsePrefix: z.string().optional(),
+	ackReaction: z.string().optional(),
+	activity: z.string().optional(),
+	status: z.enum([
+		"online",
+		"dnd",
+		"idle",
+		"invisible"
+	]).optional(),
+	activityType: z.union([
+		z.literal(0),
+		z.literal(1),
+		z.literal(2),
+		z.literal(3),
+		z.literal(4),
+		z.literal(5)
+	]).optional(),
+	activityUrl: z.string().url().optional()
+}).strict().superRefine((value, ctx) => {
+	normalizeDiscordStreamingConfig(value);
+	const activityText = typeof value.activity === "string" ? value.activity.trim() : "";
+	const hasActivity = Boolean(activityText);
+	const hasActivityType = value.activityType !== void 0;
+	const activityUrl = typeof value.activityUrl === "string" ? value.activityUrl.trim() : "";
+	const hasActivityUrl = Boolean(activityUrl);
+	if ((hasActivityType || hasActivityUrl) && !hasActivity) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "channels.discord.activity is required when activityType or activityUrl is set",
+		path: ["activity"]
+	});
+	if (value.activityType === 1 && !hasActivityUrl) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "channels.discord.activityUrl is required when activityType is 1 (Streaming)",
+		path: ["activityUrl"]
+	});
+	if (hasActivityUrl && value.activityType !== 1) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "channels.discord.activityType must be 1 (Streaming) when activityUrl is set",
+		path: ["activityType"]
+	});
+	requireOpenAllowFrom({
+		policy: value.dmPolicy ?? value.dm?.policy ?? "pairing",
+		allowFrom: value.allowFrom ?? value.dm?.allowFrom,
+		ctx,
+		path: [...value.allowFrom !== void 0 ? ["allowFrom"] : ["dm", "allowFrom"]],
+		message: "channels.discord.dmPolicy=\"open\" requires channels.discord.allowFrom (or channels.discord.dm.allowFrom) to include \"*\""
+	});
+});
+const DiscordConfigSchema = DiscordAccountSchema.extend({ accounts: z.record(z.string(), DiscordAccountSchema.optional()).optional() });
+const GoogleChatDmSchema = z.object({
+	enabled: z.boolean().optional(),
+	policy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional()
+}).strict().superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.policy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.googlechat.dm.policy=\"open\" requires channels.googlechat.dm.allowFrom to include \"*\""
+	});
+});
+const GoogleChatGroupSchema = z.object({
+	enabled: z.boolean().optional(),
+	allow: z.boolean().optional(),
+	requireMention: z.boolean().optional(),
+	users: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
+const GoogleChatAccountSchema = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
+	allowBots: z.boolean().optional(),
+	dangerouslyAllowNameMatching: z.boolean().optional(),
+	requireMention: z.boolean().optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groups: z.record(z.string(), GoogleChatGroupSchema.optional()).optional(),
+	defaultTo: z.string().optional(),
+	serviceAccount: z.union([z.string(), z.record(z.string(), z.unknown())]).optional(),
+	serviceAccountFile: z.string().optional(),
+	audienceType: z.enum(["app-url", "project-number"]).optional(),
+	audience: z.string().optional(),
+	webhookPath: z.string().optional(),
+	webhookUrl: z.string().optional(),
+	botUser: z.string().optional(),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	streamMode: z.enum([
+		"replace",
+		"status_final",
+		"append"
+	]).optional().default("replace"),
+	mediaMaxMb: z.number().positive().optional(),
+	replyToMode: ReplyToModeSchema.optional(),
+	actions: z.object({ reactions: z.boolean().optional() }).strict().optional(),
+	dm: GoogleChatDmSchema.optional(),
+	typingIndicator: z.enum([
+		"none",
+		"message",
+		"reaction"
+	]).optional(),
+	responsePrefix: z.string().optional()
+}).strict();
+const GoogleChatConfigSchema = GoogleChatAccountSchema.extend({
+	accounts: z.record(z.string(), GoogleChatAccountSchema.optional()).optional(),
+	defaultAccount: z.string().optional()
+});
+const SlackDmSchema = z.object({
+	enabled: z.boolean().optional(),
+	policy: DmPolicySchema.optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupEnabled: z.boolean().optional(),
+	groupChannels: z.array(z.union([z.string(), z.number()])).optional(),
+	replyToMode: ReplyToModeSchema.optional()
+}).strict();
+const SlackChannelSchema = z.object({
+	enabled: z.boolean().optional(),
+	allow: z.boolean().optional(),
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	allowBots: z.boolean().optional(),
+	users: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
+const SlackThreadSchema = z.object({
+	historyScope: z.enum(["thread", "channel"]).optional(),
+	inheritParent: z.boolean().optional(),
+	initialHistoryLimit: z.number().int().min(0).optional()
+}).strict();
+const SlackReplyToModeByChatTypeSchema = z.object({
+	direct: ReplyToModeSchema.optional(),
+	group: ReplyToModeSchema.optional(),
+	channel: ReplyToModeSchema.optional()
+}).strict();
+const SlackAccountSchema = z.object({
+	name: z.string().optional(),
+	mode: z.enum(["socket", "http"]).optional(),
+	signingSecret: z.string().optional().register(sensitive),
+	webhookPath: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	commands: ProviderCommandsSchema,
+	configWrites: z.boolean().optional(),
+	botToken: z.string().optional().register(sensitive),
+	appToken: z.string().optional().register(sensitive),
+	userToken: z.string().optional().register(sensitive),
+	userTokenReadOnly: z.boolean().optional().default(true),
+	allowBots: z.boolean().optional(),
+	dangerouslyAllowNameMatching: z.boolean().optional(),
+	requireMention: z.boolean().optional(),
+	groupPolicy: GroupPolicySchema.optional(),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	streaming: z.union([z.boolean(), z.enum([
+		"off",
+		"partial",
+		"block",
+		"progress"
+	])]).optional(),
+	nativeStreaming: z.boolean().optional(),
+	streamMode: z.enum([
+		"replace",
+		"status_final",
+		"append"
+	]).optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	reactionNotifications: z.enum([
+		"off",
+		"own",
+		"all",
+		"allowlist"
+	]).optional(),
+	reactionAllowlist: z.array(z.union([z.string(), z.number()])).optional(),
+	replyToMode: ReplyToModeSchema.optional(),
+	replyToModeByChatType: SlackReplyToModeByChatTypeSchema.optional(),
+	thread: SlackThreadSchema.optional(),
+	actions: z.object({
+		reactions: z.boolean().optional(),
+		messages: z.boolean().optional(),
+		pins: z.boolean().optional(),
+		search: z.boolean().optional(),
+		permissions: z.boolean().optional(),
+		memberInfo: z.boolean().optional(),
+		channelInfo: z.boolean().optional(),
+		emojiList: z.boolean().optional()
+	}).strict().optional(),
+	slashCommand: z.object({
+		enabled: z.boolean().optional(),
+		name: z.string().optional(),
+		sessionPrefix: z.string().optional(),
+		ephemeral: z.boolean().optional()
+	}).strict().optional(),
+	dmPolicy: DmPolicySchema.optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	defaultTo: z.string().optional(),
+	dm: SlackDmSchema.optional(),
+	channels: z.record(z.string(), SlackChannelSchema.optional()).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional(),
+	ackReaction: z.string().optional()
+}).strict().superRefine((value, ctx) => {
+	normalizeSlackStreamingConfig(value);
+	requireOpenAllowFrom({
+		policy: value.dmPolicy ?? value.dm?.policy ?? "pairing",
+		allowFrom: value.allowFrom ?? value.dm?.allowFrom,
+		ctx,
+		path: [...value.allowFrom !== void 0 ? ["allowFrom"] : ["dm", "allowFrom"]],
+		message: "channels.slack.dmPolicy=\"open\" requires channels.slack.allowFrom (or channels.slack.dm.allowFrom) to include \"*\""
+	});
+});
+const SlackConfigSchema = SlackAccountSchema.safeExtend({
+	mode: z.enum(["socket", "http"]).optional().default("socket"),
+	signingSecret: z.string().optional().register(sensitive),
+	webhookPath: z.string().optional().default("/slack/events"),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	accounts: z.record(z.string(), SlackAccountSchema.optional()).optional()
+}).superRefine((value, ctx) => {
+	const baseMode = value.mode ?? "socket";
+	if (baseMode === "http" && !value.signingSecret) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "channels.slack.mode=\"http\" requires channels.slack.signingSecret",
+		path: ["signingSecret"]
+	});
+	if (!value.accounts) return;
+	for (const [accountId, account] of Object.entries(value.accounts)) {
+		if (!account) continue;
+		if (account.enabled === false) continue;
+		if ((account.mode ?? baseMode) !== "http") continue;
+		if (!(account.signingSecret ?? value.signingSecret)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "channels.slack.accounts.*.mode=\"http\" requires channels.slack.signingSecret or channels.slack.accounts.*.signingSecret",
+			path: [
+				"accounts",
+				accountId,
+				"signingSecret"
+			]
+		});
+	}
+});
+const SignalAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
+	account: z.string().optional(),
+	httpUrl: z.string().optional(),
+	httpHost: z.string().optional(),
+	httpPort: z.number().int().positive().optional(),
+	cliPath: ExecutableTokenSchema.optional(),
+	autoStart: z.boolean().optional(),
+	startupTimeoutMs: z.number().int().min(1e3).max(12e4).optional(),
+	receiveMode: z.union([z.literal("on-start"), z.literal("manual")]).optional(),
+	ignoreAttachments: z.boolean().optional(),
+	ignoreStories: z.boolean().optional(),
+	sendReadReceipts: z.boolean().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	defaultTo: z.string().optional(),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	mediaMaxMb: z.number().int().positive().optional(),
+	reactionNotifications: z.enum([
+		"off",
+		"own",
+		"all",
+		"allowlist"
+	]).optional(),
+	reactionAllowlist: z.array(z.union([z.string(), z.number()])).optional(),
+	actions: z.object({ reactions: z.boolean().optional() }).strict().optional(),
+	reactionLevel: z.enum([
+		"off",
+		"ack",
+		"minimal",
+		"extensive"
+	]).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict();
+const SignalAccountSchema = SignalAccountSchemaBase.superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.signal.dmPolicy=\"open\" requires channels.signal.allowFrom to include \"*\""
+	});
+});
+const SignalConfigSchema = SignalAccountSchemaBase.extend({ accounts: z.record(z.string(), SignalAccountSchema.optional()).optional() }).superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.signal.dmPolicy=\"open\" requires channels.signal.allowFrom to include \"*\""
+	});
+});
+const IrcGroupSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	enabled: z.boolean().optional(),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	systemPrompt: z.string().optional()
+}).strict();
+const IrcNickServSchema = z.object({
+	enabled: z.boolean().optional(),
+	service: z.string().optional(),
+	password: z.string().optional().register(sensitive),
+	passwordFile: z.string().optional(),
+	register: z.boolean().optional(),
+	registerEmail: z.string().optional()
+}).strict();
+const IrcAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
+	host: z.string().optional(),
+	port: z.number().int().min(1).max(65535).optional(),
+	tls: z.boolean().optional(),
+	nick: z.string().optional(),
+	username: z.string().optional(),
+	realname: z.string().optional(),
+	password: z.string().optional().register(sensitive),
+	passwordFile: z.string().optional(),
+	nickserv: IrcNickServSchema.optional(),
+	channels: z.array(z.string()).optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	defaultTo: z.string().optional(),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	groups: z.record(z.string(), IrcGroupSchema.optional()).optional(),
+	mentionPatterns: z.array(z.string()).optional(),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict();
+function refineIrcAllowFromAndNickserv(value, ctx) {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.irc.dmPolicy=\"open\" requires channels.irc.allowFrom to include \"*\""
+	});
+	if (value.nickserv?.register && !value.nickserv.registerEmail?.trim()) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["nickserv", "registerEmail"],
+		message: "channels.irc.nickserv.register=true requires channels.irc.nickserv.registerEmail"
+	});
+}
+const IrcAccountSchema = IrcAccountSchemaBase.superRefine((value, ctx) => {
+	refineIrcAllowFromAndNickserv(value, ctx);
+});
+const IrcConfigSchema = IrcAccountSchemaBase.extend({ accounts: z.record(z.string(), IrcAccountSchema.optional()).optional() }).superRefine((value, ctx) => {
+	refineIrcAllowFromAndNickserv(value, ctx);
+});
+const IMessageAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
+	cliPath: ExecutableTokenSchema.optional(),
+	dbPath: z.string().optional(),
+	remoteHost: z.string().refine(isSafeScpRemoteHost, "expected SSH host or user@host (no spaces/options)").optional(),
+	service: z.union([
+		z.literal("imessage"),
+		z.literal("sms"),
+		z.literal("auto")
+	]).optional(),
+	region: z.string().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	defaultTo: z.string().optional(),
+	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	includeAttachments: z.boolean().optional(),
+	attachmentRoots: z.array(z.string().refine(isValidInboundPathRootPattern, "expected absolute path root")).optional(),
+	remoteAttachmentRoots: z.array(z.string().refine(isValidInboundPathRootPattern, "expected absolute path root")).optional(),
+	mediaMaxMb: z.number().int().positive().optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	groups: z.record(z.string(), z.object({
+		requireMention: z.boolean().optional(),
+		tools: ToolPolicySchema,
+		toolsBySender: ToolPolicyBySenderSchema$1
+	}).strict().optional()).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict();
+const IMessageAccountSchema = IMessageAccountSchemaBase.superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.imessage.dmPolicy=\"open\" requires channels.imessage.allowFrom to include \"*\""
+	});
+});
+const IMessageConfigSchema = IMessageAccountSchemaBase.extend({ accounts: z.record(z.string(), IMessageAccountSchema.optional()).optional() }).superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.imessage.dmPolicy=\"open\" requires channels.imessage.allowFrom to include \"*\""
+	});
+});
+const BlueBubblesAllowFromEntry = z.union([z.string(), z.number()]);
+const BlueBubblesActionSchema = z.object({
+	reactions: z.boolean().optional(),
+	edit: z.boolean().optional(),
+	unsend: z.boolean().optional(),
+	reply: z.boolean().optional(),
+	sendWithEffect: z.boolean().optional(),
+	renameGroup: z.boolean().optional(),
+	setGroupIcon: z.boolean().optional(),
+	addParticipant: z.boolean().optional(),
+	removeParticipant: z.boolean().optional(),
+	leaveGroup: z.boolean().optional(),
+	sendAttachment: z.boolean().optional()
+}).strict().optional();
+const BlueBubblesGroupConfigSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1
+}).strict();
+const BlueBubblesAccountSchemaBase = z.object({
+	name: z.string().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	configWrites: z.boolean().optional(),
+	enabled: z.boolean().optional(),
+	serverUrl: z.string().optional(),
+	password: z.string().optional().register(sensitive),
+	webhookPath: z.string().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(BlueBubblesAllowFromEntry).optional(),
+	groupAllowFrom: z.array(BlueBubblesAllowFromEntry).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	mediaMaxMb: z.number().int().positive().optional(),
+	mediaLocalRoots: z.array(z.string()).optional(),
+	sendReadReceipts: z.boolean().optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	groups: z.record(z.string(), BlueBubblesGroupConfigSchema.optional()).optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict();
+const BlueBubblesAccountSchema = BlueBubblesAccountSchemaBase.superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.bluebubbles.accounts.*.dmPolicy=\"open\" requires allowFrom to include \"*\""
+	});
+});
+const BlueBubblesConfigSchema = BlueBubblesAccountSchemaBase.extend({
+	accounts: z.record(z.string(), BlueBubblesAccountSchema.optional()).optional(),
+	actions: BlueBubblesActionSchema
+}).superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.bluebubbles.dmPolicy=\"open\" requires channels.bluebubbles.allowFrom to include \"*\""
+	});
+});
+const MSTeamsChannelSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	replyStyle: MSTeamsReplyStyleSchema.optional()
+}).strict();
+const MSTeamsTeamSchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema$1,
+	replyStyle: MSTeamsReplyStyleSchema.optional(),
+	channels: z.record(z.string(), MSTeamsChannelSchema.optional()).optional()
+}).strict();
+const MSTeamsConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	capabilities: z.array(z.string()).optional(),
+	dangerouslyAllowNameMatching: z.boolean().optional(),
+	markdown: MarkdownConfigSchema,
+	configWrites: z.boolean().optional(),
+	appId: z.string().optional(),
+	appPassword: z.string().optional().register(sensitive),
+	tenantId: z.string().optional(),
+	webhook: z.object({
+		port: z.number().int().positive().optional(),
+		path: z.string().optional()
+	}).strict().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	allowFrom: z.array(z.string()).optional(),
+	defaultTo: z.string().optional(),
+	groupAllowFrom: z.array(z.string()).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	mediaAllowHosts: z.array(z.string()).optional(),
+	mediaAuthAllowHosts: z.array(z.string()).optional(),
+	requireMention: z.boolean().optional(),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	replyStyle: MSTeamsReplyStyleSchema.optional(),
+	teams: z.record(z.string(), MSTeamsTeamSchema.optional()).optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	sharePointSiteId: z.string().optional(),
+	heartbeat: ChannelHeartbeatVisibilitySchema,
+	responsePrefix: z.string().optional()
+}).strict().superRefine((value, ctx) => {
+	requireOpenAllowFrom({
+		policy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		path: ["allowFrom"],
+		message: "channels.msteams.dmPolicy=\"open\" requires channels.msteams.allowFrom to include \"*\""
+	});
+});
+
+//#endregion
+//#region src/config/zod-schema.providers-whatsapp.ts
+const ToolPolicyBySenderSchema = z.record(z.string(), ToolPolicySchema).optional();
+const WhatsAppGroupEntrySchema = z.object({
+	requireMention: z.boolean().optional(),
+	tools: ToolPolicySchema,
+	toolsBySender: ToolPolicyBySenderSchema
+}).strict().optional();
+const WhatsAppGroupsSchema = z.record(z.string(), WhatsAppGroupEntrySchema).optional();
+const WhatsAppAckReactionSchema = z.object({
+	emoji: z.string().optional(),
+	direct: z.boolean().optional().default(true),
+	group: z.enum([
+		"always",
+		"mentions",
+		"never"
+	]).optional().default("mentions")
+}).strict().optional();
+const WhatsAppSharedSchema = z.object({
+	enabled: z.boolean().optional(),
+	capabilities: z.array(z.string()).optional(),
+	markdown: MarkdownConfigSchema,
+	configWrites: z.boolean().optional(),
+	sendReadReceipts: z.boolean().optional(),
+	messagePrefix: z.string().optional(),
+	responsePrefix: z.string().optional(),
+	dmPolicy: DmPolicySchema.optional().default("pairing"),
+	selfChatMode: z.boolean().optional(),
+	allowFrom: z.array(z.string()).optional(),
+	defaultTo: z.string().optional(),
+	groupAllowFrom: z.array(z.string()).optional(),
+	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	historyLimit: z.number().int().min(0).optional(),
+	dmHistoryLimit: z.number().int().min(0).optional(),
+	dms: z.record(z.string(), DmConfigSchema.optional()).optional(),
+	textChunkLimit: z.number().int().positive().optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	blockStreaming: z.boolean().optional(),
+	blockStreamingCoalesce: BlockStreamingCoalesceSchema.optional(),
+	groups: WhatsAppGroupsSchema,
+	ackReaction: WhatsAppAckReactionSchema,
+	debounceMs: z.number().int().nonnegative().optional().default(0),
+	heartbeat: ChannelHeartbeatVisibilitySchema
+});
+function enforceOpenDmPolicyAllowFromStar(params) {
+	if (params.dmPolicy !== "open") return;
+	if ((Array.isArray(params.allowFrom) ? params.allowFrom : []).map((v) => String(v).trim()).filter(Boolean).includes("*")) return;
+	params.ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["allowFrom"],
+		message: params.message
+	});
+}
+const WhatsAppAccountSchema = WhatsAppSharedSchema.extend({
+	name: z.string().optional(),
+	enabled: z.boolean().optional(),
+	authDir: z.string().optional(),
+	mediaMaxMb: z.number().int().positive().optional()
+}).strict().superRefine((value, ctx) => {
+	enforceOpenDmPolicyAllowFromStar({
+		dmPolicy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		message: "channels.whatsapp.accounts.*.dmPolicy=\"open\" requires allowFrom to include \"*\""
+	});
+});
+const WhatsAppConfigSchema = WhatsAppSharedSchema.extend({
+	accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional(),
+	mediaMaxMb: z.number().int().positive().optional().default(50),
+	actions: z.object({
+		reactions: z.boolean().optional(),
+		sendMessage: z.boolean().optional(),
+		polls: z.boolean().optional()
+	}).strict().optional()
+}).strict().superRefine((value, ctx) => {
+	enforceOpenDmPolicyAllowFromStar({
+		dmPolicy: value.dmPolicy,
+		allowFrom: value.allowFrom,
+		ctx,
+		message: "channels.whatsapp.dmPolicy=\"open\" requires channels.whatsapp.allowFrom to include \"*\""
+	});
+});
+
+//#endregion
+//#region src/config/zod-schema.providers.ts
+const ChannelModelByChannelSchema = z.record(z.string(), z.record(z.string(), z.string())).optional();
+const ChannelsSchema = z.object({
+	defaults: z.object({
+		groupPolicy: GroupPolicySchema.optional(),
+		heartbeat: ChannelHeartbeatVisibilitySchema
+	}).strict().optional(),
+	modelByChannel: ChannelModelByChannelSchema,
+	whatsapp: WhatsAppConfigSchema.optional(),
+	telegram: TelegramConfigSchema.optional(),
+	discord: DiscordConfigSchema.optional(),
+	irc: IrcConfigSchema.optional(),
+	googlechat: GoogleChatConfigSchema.optional(),
+	slack: SlackConfigSchema.optional(),
+	signal: SignalConfigSchema.optional(),
+	imessage: IMessageConfigSchema.optional(),
+	bluebubbles: BlueBubblesConfigSchema.optional(),
+	msteams: MSTeamsConfigSchema.optional()
+}).passthrough().optional();
+
+//#endregion
+//#region src/config/zod-schema.allowdeny.ts
+const AllowDenyActionSchema = z.union([z.literal("allow"), z.literal("deny")]);
+const AllowDenyChatTypeSchema = z.union([
+	z.literal("direct"),
+	z.literal("group"),
+	z.literal("channel"),
+	z.literal("dm")
+]).optional();
+function createAllowDenyChannelRulesSchema() {
+	return z.object({
+		default: AllowDenyActionSchema.optional(),
+		rules: z.array(z.object({
+			action: AllowDenyActionSchema,
+			match: z.object({
+				channel: z.string().optional(),
+				chatType: AllowDenyChatTypeSchema,
+				keyPrefix: z.string().optional(),
+				rawKeyPrefix: z.string().optional()
+			}).strict().optional()
+		}).strict()).optional()
+	}).strict().optional();
+}
+
+//#endregion
+//#region src/config/zod-schema.session.ts
+const SessionResetConfigSchema = z.object({
+	mode: z.union([z.literal("daily"), z.literal("idle")]).optional(),
+	atHour: z.number().int().min(0).max(23).optional(),
+	idleMinutes: z.number().int().positive().optional()
+}).strict();
+const SessionSendPolicySchema = createAllowDenyChannelRulesSchema();
+const SessionSchema = z.object({
+	scope: z.union([z.literal("per-sender"), z.literal("global")]).optional(),
+	dmScope: z.union([
+		z.literal("main"),
+		z.literal("per-peer"),
+		z.literal("per-channel-peer"),
+		z.literal("per-account-channel-peer")
+	]).optional(),
+	identityLinks: z.record(z.string(), z.array(z.string())).optional(),
+	resetTriggers: z.array(z.string()).optional(),
+	idleMinutes: z.number().int().positive().optional(),
+	reset: SessionResetConfigSchema.optional(),
+	resetByType: z.object({
+		direct: SessionResetConfigSchema.optional(),
+		dm: SessionResetConfigSchema.optional(),
+		group: SessionResetConfigSchema.optional(),
+		thread: SessionResetConfigSchema.optional()
+	}).strict().optional(),
+	resetByChannel: z.record(z.string(), SessionResetConfigSchema).optional(),
+	store: z.string().optional(),
+	typingIntervalSeconds: z.number().int().positive().optional(),
+	typingMode: TypingModeSchema.optional(),
+	mainKey: z.string().optional(),
+	sendPolicy: SessionSendPolicySchema.optional(),
+	agentToAgent: z.object({ maxPingPongTurns: z.number().int().min(0).max(5).optional() }).strict().optional(),
+	threadBindings: z.object({
+		enabled: z.boolean().optional(),
+		ttlHours: z.number().nonnegative().optional()
+	}).strict().optional(),
+	maintenance: z.object({
+		mode: z.enum(["enforce", "warn"]).optional(),
+		pruneAfter: z.union([z.string(), z.number()]).optional(),
+		pruneDays: z.number().int().positive().optional(),
+		maxEntries: z.number().int().positive().optional(),
+		rotateBytes: z.union([z.string(), z.number()]).optional(),
+		resetArchiveRetention: z.union([
+			z.string(),
+			z.number(),
+			z.literal(false)
+		]).optional(),
+		maxDiskBytes: z.union([z.string(), z.number()]).optional(),
+		highWaterBytes: z.union([z.string(), z.number()]).optional()
+	}).strict().superRefine((val, ctx) => {
+		if (val.pruneAfter !== void 0) try {
+			parseDurationMs(String(val.pruneAfter).trim(), { defaultUnit: "d" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["pruneAfter"],
+				message: "invalid duration (use ms, s, m, h, d)"
+			});
+		}
+		if (val.rotateBytes !== void 0) try {
+			parseByteSize(String(val.rotateBytes).trim(), { defaultUnit: "b" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["rotateBytes"],
+				message: "invalid size (use b, kb, mb, gb, tb)"
+			});
+		}
+		if (val.resetArchiveRetention !== void 0 && val.resetArchiveRetention !== false) try {
+			parseDurationMs(String(val.resetArchiveRetention).trim(), { defaultUnit: "d" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["resetArchiveRetention"],
+				message: "invalid duration (use ms, s, m, h, d)"
+			});
+		}
+		if (val.maxDiskBytes !== void 0) try {
+			parseByteSize(String(val.maxDiskBytes).trim(), { defaultUnit: "b" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["maxDiskBytes"],
+				message: "invalid size (use b, kb, mb, gb, tb)"
+			});
+		}
+		if (val.highWaterBytes !== void 0) try {
+			parseByteSize(String(val.highWaterBytes).trim(), { defaultUnit: "b" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["highWaterBytes"],
+				message: "invalid size (use b, kb, mb, gb, tb)"
+			});
+		}
+	}).optional()
+}).strict().optional();
+const MessagesSchema = z.object({
+	messagePrefix: z.string().optional(),
+	responsePrefix: z.string().optional(),
+	groupChat: GroupChatSchema,
+	queue: QueueSchema,
+	inbound: InboundDebounceSchema,
+	ackReaction: z.string().optional(),
+	ackReactionScope: z.enum([
+		"group-mentions",
+		"group-all",
+		"direct",
+		"all"
+	]).optional(),
+	removeAckAfterReply: z.boolean().optional(),
+	statusReactions: z.object({
+		enabled: z.boolean().optional(),
+		emojis: z.object({
+			thinking: z.string().optional(),
+			tool: z.string().optional(),
+			coding: z.string().optional(),
+			web: z.string().optional(),
+			done: z.string().optional(),
+			error: z.string().optional(),
+			stallSoft: z.string().optional(),
+			stallHard: z.string().optional()
+		}).strict().optional(),
+		timing: z.object({
+			debounceMs: z.number().int().min(0).optional(),
+			stallSoftMs: z.number().int().min(0).optional(),
+			stallHardMs: z.number().int().min(0).optional(),
+			doneHoldMs: z.number().int().min(0).optional(),
+			errorHoldMs: z.number().int().min(0).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	suppressToolErrors: z.boolean().optional(),
+	tts: TtsConfigSchema
+}).strict().optional();
+const CommandsSchema = z.object({
+	native: NativeCommandsSettingSchema.optional().default("auto"),
+	text: z.boolean().optional(),
+	config: z.boolean().optional(),
+	debug: z.boolean().optional(),
+	restart: z.boolean().optional().default(true),
+	useAccessGroups: z.boolean().optional(),
+	ownerAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+	ownerDisplay: z.enum(["raw", "hash"]).optional().default("raw"),
+	ownerDisplaySecret: z.string().optional().register(sensitive),
+	allowFrom: z.record(z.string(), z.array(z.union([z.string(), z.number()]))).optional()
+}).strict().optional().default(() => ({
+	native: "auto",
+	restart: true,
+	ownerDisplay: "raw"
+}));
+
+//#endregion
+//#region src/config/zod-schema.ts
+const BrowserSnapshotDefaultsSchema = z.object({ mode: z.literal("efficient").optional() }).strict().optional();
+const NodeHostSchema = z.object({ browserProxy: z.object({
+	enabled: z.boolean().optional(),
+	allowProfiles: z.array(z.string()).optional()
+}).strict().optional() }).strict().optional();
+const LoggingLevelSchema = z.union([
+	z.literal("silent"),
+	z.literal("fatal"),
+	z.literal("error"),
+	z.literal("warn"),
+	z.literal("info"),
+	z.literal("debug"),
+	z.literal("trace")
+]);
+const HttpUrlSchema = z.string().url().refine((value) => {
+	const protocol = new URL(value).protocol;
+	return protocol === "http:" || protocol === "https:";
+}, "Expected http:// or https:// URL");
+const RemoteClawSchema = z.object({
+	$schema: z.string().optional(),
+	meta: z.object({
+		lastTouchedVersion: z.string().optional(),
+		lastTouchedAt: z.union([z.string(), z.number().transform((n, ctx) => {
+			const d = new Date(n);
+			if (Number.isNaN(d.getTime())) {
+				ctx.addIssue({
+					code: z.ZodIssueCode.custom,
+					message: "Invalid timestamp"
+				});
+				return z.NEVER;
+			}
+			return d.toISOString();
+		})]).optional()
+	}).strict().optional(),
+	env: z.object({
+		shellEnv: z.object({
+			enabled: z.boolean().optional(),
+			timeoutMs: z.number().int().nonnegative().optional()
+		}).strict().optional(),
+		vars: z.record(z.string(), z.string()).optional()
+	}).catchall(z.string()).optional(),
+	wizard: z.object({
+		lastRunAt: z.string().optional(),
+		lastRunVersion: z.string().optional(),
+		lastRunCommit: z.string().optional(),
+		lastRunCommand: z.string().optional(),
+		lastRunMode: z.union([z.literal("local"), z.literal("remote")]).optional()
+	}).strict().optional(),
+	diagnostics: z.object({
+		enabled: z.boolean().optional(),
+		flags: z.array(z.string()).optional(),
+		otel: z.object({
+			enabled: z.boolean().optional(),
+			endpoint: z.string().optional(),
+			protocol: z.union([z.literal("http/protobuf"), z.literal("grpc")]).optional(),
+			headers: z.record(z.string(), z.string()).optional(),
+			serviceName: z.string().optional(),
+			traces: z.boolean().optional(),
+			metrics: z.boolean().optional(),
+			logs: z.boolean().optional(),
+			sampleRate: z.number().min(0).max(1).optional(),
+			flushIntervalMs: z.number().int().nonnegative().optional()
+		}).strict().optional(),
+		cacheTrace: z.object({
+			enabled: z.boolean().optional(),
+			filePath: z.string().optional(),
+			includeMessages: z.boolean().optional(),
+			includePrompt: z.boolean().optional(),
+			includeSystem: z.boolean().optional()
+		}).strict().optional()
+	}).strict().optional(),
+	logging: z.object({
+		level: LoggingLevelSchema.optional(),
+		file: z.string().optional(),
+		maxFileBytes: z.number().int().positive().optional(),
+		consoleLevel: LoggingLevelSchema.optional(),
+		consoleStyle: z.union([
+			z.literal("pretty"),
+			z.literal("compact"),
+			z.literal("json")
+		]).optional(),
+		redactSensitive: z.union([z.literal("off"), z.literal("tools")]).optional(),
+		redactPatterns: z.array(z.string()).optional()
+	}).strict().optional(),
+	update: z.object({
+		channel: z.union([
+			z.literal("stable"),
+			z.literal("beta"),
+			z.literal("next")
+		]).optional(),
+		checkOnStart: z.boolean().optional(),
+		auto: z.object({
+			enabled: z.boolean().optional(),
+			stableDelayHours: z.number().nonnegative().max(168).optional(),
+			stableJitterHours: z.number().nonnegative().max(168).optional(),
+			betaCheckIntervalHours: z.number().positive().max(24).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	browser: z.object({
+		enabled: z.boolean().optional(),
+		evaluateEnabled: z.boolean().optional(),
+		cdpUrl: z.string().optional(),
+		remoteCdpTimeoutMs: z.number().int().nonnegative().optional(),
+		remoteCdpHandshakeTimeoutMs: z.number().int().nonnegative().optional(),
+		color: z.string().optional(),
+		executablePath: z.string().optional(),
+		headless: z.boolean().optional(),
+		noSandbox: z.boolean().optional(),
+		attachOnly: z.boolean().optional(),
+		defaultProfile: z.string().optional(),
+		snapshotDefaults: BrowserSnapshotDefaultsSchema,
+		ssrfPolicy: z.object({
+			allowPrivateNetwork: z.boolean().optional(),
+			dangerouslyAllowPrivateNetwork: z.boolean().optional(),
+			allowedHostnames: z.array(z.string()).optional(),
+			hostnameAllowlist: z.array(z.string()).optional()
+		}).strict().optional(),
+		profiles: z.record(z.string().regex(/^[a-z0-9-]+$/, "Profile names must be alphanumeric with hyphens only"), z.object({
+			cdpPort: z.number().int().min(1).max(65535).optional(),
+			cdpUrl: z.string().optional(),
+			driver: z.union([z.literal("clawd"), z.literal("extension")]).optional(),
+			color: HexColorSchema
+		}).strict().refine((value) => value.cdpPort || value.cdpUrl, { message: "Profile must set cdpPort or cdpUrl" })).optional()
+	}).strict().optional(),
+	ui: z.object({
+		seamColor: HexColorSchema.optional(),
+		assistant: z.object({
+			name: z.string().max(50).optional(),
+			avatar: z.string().max(200).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	auth: z.object({
+		profiles: z.record(z.string(), z.object({
+			provider: z.string(),
+			mode: z.union([
+				z.literal("api_key"),
+				z.literal("oauth"),
+				z.literal("token")
+			]),
+			email: z.string().optional()
+		}).strict()).optional(),
+		order: z.record(z.string(), z.array(z.string())).optional(),
+		cooldowns: z.object({
+			billingBackoffHours: z.number().positive().optional(),
+			billingBackoffHoursByProvider: z.record(z.string(), z.number().positive()).optional(),
+			billingMaxHours: z.number().positive().optional(),
+			failureWindowHours: z.number().positive().optional()
+		}).strict().optional()
+	}).strict().optional(),
+	nodeHost: NodeHostSchema,
+	agents: AgentsSchema,
+	tools: ToolsSchema,
+	bindings: BindingsSchema,
+	broadcast: BroadcastSchema,
+	audio: AudioSchema,
+	media: z.object({ preserveFilenames: z.boolean().optional() }).strict().optional(),
+	messages: MessagesSchema,
+	commands: CommandsSchema,
+	approvals: ApprovalsSchema,
+	session: SessionSchema,
+	cron: z.object({
+		enabled: z.boolean().optional(),
+		store: z.string().optional(),
+		maxConcurrentRuns: z.number().int().positive().optional(),
+		webhook: HttpUrlSchema.optional(),
+		webhookToken: z.string().optional().register(sensitive),
+		sessionRetention: z.union([z.string(), z.literal(false)]).optional(),
+		runLog: z.object({
+			maxBytes: z.union([z.string(), z.number()]).optional(),
+			keepLines: z.number().int().positive().optional()
+		}).strict().optional()
+	}).strict().superRefine((val, ctx) => {
+		if (val.sessionRetention !== void 0 && val.sessionRetention !== false) try {
+			parseDurationMs(String(val.sessionRetention).trim(), { defaultUnit: "h" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["sessionRetention"],
+				message: "invalid duration (use ms, s, m, h, d)"
+			});
+		}
+		if (val.runLog?.maxBytes !== void 0) try {
+			parseByteSize(String(val.runLog.maxBytes).trim(), { defaultUnit: "b" });
+		} catch {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: ["runLog", "maxBytes"],
+				message: "invalid size (use b, kb, mb, gb, tb)"
+			});
+		}
+	}).optional(),
+	hooks: z.object({
+		enabled: z.boolean().optional(),
+		path: z.string().optional(),
+		token: z.string().optional().register(sensitive),
+		defaultSessionKey: z.string().optional(),
+		allowRequestSessionKey: z.boolean().optional(),
+		allowedSessionKeyPrefixes: z.array(z.string()).optional(),
+		allowedAgentIds: z.array(z.string()).optional(),
+		maxBodyBytes: z.number().int().positive().optional(),
+		presets: z.array(z.string()).optional(),
+		transformsDir: z.string().optional(),
+		mappings: z.array(HookMappingSchema).optional(),
+		gmail: HooksGmailSchema,
+		internal: InternalHooksSchema
+	}).strict().optional(),
+	web: z.object({
+		enabled: z.boolean().optional(),
+		heartbeatSeconds: z.number().int().positive().optional(),
+		reconnect: z.object({
+			initialMs: z.number().positive().optional(),
+			maxMs: z.number().positive().optional(),
+			factor: z.number().positive().optional(),
+			jitter: z.number().min(0).max(1).optional(),
+			maxAttempts: z.number().int().min(0).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	channels: ChannelsSchema,
+	discovery: z.object({
+		wideArea: z.object({ enabled: z.boolean().optional() }).strict().optional(),
+		mdns: z.object({ mode: z.enum([
+			"off",
+			"minimal",
+			"full"
+		]).optional() }).strict().optional()
+	}).strict().optional(),
+	canvasHost: z.object({
+		enabled: z.boolean().optional(),
+		root: z.string().optional(),
+		port: z.number().int().positive().optional(),
+		liveReload: z.boolean().optional()
+	}).strict().optional(),
+	talk: z.object({
+		provider: z.string().optional(),
+		providers: z.record(z.string(), z.object({
+			voiceId: z.string().optional(),
+			voiceAliases: z.record(z.string(), z.string()).optional(),
+			modelId: z.string().optional(),
+			outputFormat: z.string().optional(),
+			apiKey: z.string().optional().register(sensitive)
+		}).catchall(z.unknown())).optional(),
+		voiceId: z.string().optional(),
+		voiceAliases: z.record(z.string(), z.string()).optional(),
+		modelId: z.string().optional(),
+		outputFormat: z.string().optional(),
+		apiKey: z.string().optional().register(sensitive),
+		interruptOnSpeech: z.boolean().optional()
+	}).strict().optional(),
+	gateway: z.object({
+		port: z.number().int().positive().optional(),
+		mode: z.union([z.literal("local"), z.literal("remote")]).optional(),
+		bind: z.union([
+			z.literal("auto"),
+			z.literal("lan"),
+			z.literal("loopback"),
+			z.literal("custom"),
+			z.literal("tailnet")
+		]).optional(),
+		customBindHost: z.string().optional(),
+		controlUi: z.object({
+			enabled: z.boolean().optional(),
+			basePath: z.string().optional(),
+			root: z.string().optional(),
+			allowedOrigins: z.array(z.string()).optional(),
+			dangerouslyAllowHostHeaderOriginFallback: z.boolean().optional(),
+			allowInsecureAuth: z.boolean().optional(),
+			dangerouslyDisableDeviceAuth: z.boolean().optional()
+		}).strict().optional(),
+		auth: z.object({
+			mode: z.union([
+				z.literal("none"),
+				z.literal("token"),
+				z.literal("password"),
+				z.literal("trusted-proxy")
+			]).optional(),
+			token: z.string().optional().register(sensitive),
+			password: z.string().optional().register(sensitive),
+			allowTailscale: z.boolean().optional(),
+			rateLimit: z.object({
+				maxAttempts: z.number().optional(),
+				windowMs: z.number().optional(),
+				lockoutMs: z.number().optional(),
+				exemptLoopback: z.boolean().optional()
+			}).strict().optional(),
+			trustedProxy: z.object({
+				userHeader: z.string().min(1, "userHeader is required for trusted-proxy mode"),
+				requiredHeaders: z.array(z.string()).optional(),
+				allowUsers: z.array(z.string()).optional()
+			}).strict().optional()
+		}).strict().optional(),
+		trustedProxies: z.array(z.string()).optional(),
+		allowRealIpFallback: z.boolean().optional(),
+		tools: z.object({
+			deny: z.array(z.string()).optional(),
+			allow: z.array(z.string()).optional()
+		}).strict().optional(),
+		channelHealthCheckMinutes: z.number().int().min(0).optional(),
+		tailscale: z.object({
+			mode: z.union([
+				z.literal("off"),
+				z.literal("serve"),
+				z.literal("funnel")
+			]).optional(),
+			resetOnExit: z.boolean().optional()
+		}).strict().optional(),
+		remote: z.object({
+			url: z.string().optional(),
+			transport: z.union([z.literal("ssh"), z.literal("direct")]).optional(),
+			token: z.string().optional().register(sensitive),
+			password: z.string().optional().register(sensitive),
+			tlsFingerprint: z.string().optional(),
+			sshTarget: z.string().optional(),
+			sshIdentity: z.string().optional()
+		}).strict().optional(),
+		reload: z.object({
+			mode: z.union([
+				z.literal("off"),
+				z.literal("restart"),
+				z.literal("hot"),
+				z.literal("hybrid")
+			]).optional(),
+			debounceMs: z.number().int().min(0).optional()
+		}).strict().optional(),
+		tls: z.object({
+			enabled: z.boolean().optional(),
+			autoGenerate: z.boolean().optional(),
+			certPath: z.string().optional(),
+			keyPath: z.string().optional(),
+			caPath: z.string().optional()
+		}).optional(),
+		http: z.object({
+			endpoints: z.object({
+				chatCompletions: z.object({ enabled: z.boolean().optional() }).strict().optional(),
+				responses: z.object({
+					enabled: z.boolean().optional(),
+					maxBodyBytes: z.number().int().positive().optional(),
+					maxUrlParts: z.number().int().nonnegative().optional(),
+					files: z.object({
+						allowUrl: z.boolean().optional(),
+						urlAllowlist: z.array(z.string()).optional(),
+						allowedMimes: z.array(z.string()).optional(),
+						maxBytes: z.number().int().positive().optional(),
+						maxChars: z.number().int().positive().optional(),
+						maxRedirects: z.number().int().nonnegative().optional(),
+						timeoutMs: z.number().int().positive().optional(),
+						pdf: z.object({
+							maxPages: z.number().int().positive().optional(),
+							maxPixels: z.number().int().positive().optional(),
+							minTextChars: z.number().int().nonnegative().optional()
+						}).strict().optional()
+					}).strict().optional(),
+					images: z.object({
+						allowUrl: z.boolean().optional(),
+						urlAllowlist: z.array(z.string()).optional(),
+						allowedMimes: z.array(z.string()).optional(),
+						maxBytes: z.number().int().positive().optional(),
+						maxRedirects: z.number().int().nonnegative().optional(),
+						timeoutMs: z.number().int().positive().optional()
+					}).strict().optional()
+				}).strict().optional()
+			}).strict().optional(),
+			securityHeaders: z.object({ strictTransportSecurity: z.union([z.string(), z.literal(false)]).optional() }).strict().optional()
+		}).strict().optional(),
+		nodes: z.object({
+			browser: z.object({
+				mode: z.union([
+					z.literal("auto"),
+					z.literal("manual"),
+					z.literal("off")
+				]).optional(),
+				node: z.string().optional()
+			}).strict().optional(),
+			allowCommands: z.array(z.string()).optional(),
+			denyCommands: z.array(z.string()).optional()
+		}).strict().optional()
+	}).strict().optional(),
+	memory: z.unknown().optional(),
+	plugins: z.object({
+		enabled: z.boolean().optional(),
+		allow: z.array(z.string()).optional(),
+		deny: z.array(z.string()).optional(),
+		load: z.object({ paths: z.array(z.string()).optional() }).strict().optional(),
+		slots: z.object({ memory: z.string().optional() }).strict().optional(),
+		entries: z.record(z.string(), z.object({
+			enabled: z.boolean().optional(),
+			config: z.record(z.string(), z.unknown()).optional()
+		}).strict()).optional(),
+		installs: z.record(z.string(), z.object({ ...InstallRecordShape }).strict()).optional()
+	}).strict().optional()
+}).strict().superRefine((cfg, ctx) => {
+	const agents = cfg.agents?.list ?? [];
+	if (agents.length === 0) return;
+	const agentIds = new Set(agents.map((agent) => agent.id));
+	const broadcast = cfg.broadcast;
+	if (!broadcast) return;
+	for (const [peerId, ids] of Object.entries(broadcast)) {
+		if (peerId === "strategy") continue;
+		if (!Array.isArray(ids)) continue;
+		for (let idx = 0; idx < ids.length; idx += 1) {
+			const agentId = ids[idx];
+			if (!agentIds.has(agentId)) ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: [
+					"broadcast",
+					peerId,
+					idx
+				],
+				message: `Unknown agent id "${agentId}" (not in agents.list).`
+			});
+		}
+	}
+});
+
+//#endregion
+export { parseByteSize as _, mapStreamingModeToSlackLegacyDraftStreamMode as a, resolveSlackStreamingMode as c, resolveIMessageAttachmentRoots as d, resolveIMessageRemoteAttachmentRoots as f, parseDurationMs as g, isSafeExecutableValue as h, resolveTelegramCustomCommands as i, resolveTelegramPreviewStreamMode as l, sensitive as m, TELEGRAM_COMMAND_NAME_PATTERN as n, resolveDiscordPreviewStreamMode as o, normalizeScpRemoteHost as p, normalizeTelegramCommandName as r, resolveSlackNativeStreaming as s, RemoteClawSchema as t, isInboundPathAllowed as u };