switchroom 0.13.52 → 0.13.54

package/dist/auth-broker/index.js

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 };
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
@@ -70,7 +70,7 @@ var require_identity = __commonJS((exports) => {
   exports.isSeq = isSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/visit.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/visit.js
 var require_visit = __commonJS((exports) => {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
@@ -225,7 +225,7 @@ var require_visit = __commonJS((exports) => {
   exports.visitAsync = visitAsync;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/directives.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/directives.js
 var require_directives = __commonJS((exports) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -377,7 +377,7 @@ var require_directives = __commonJS((exports) => {
   exports.Directives = Directives;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/anchors.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/anchors.js
 var require_anchors = __commonJS((exports) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -439,7 +439,7 @@ var require_anchors = __commonJS((exports) => {
   exports.findNewAnchor = findNewAnchor;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/applyReviver.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/applyReviver.js
 var require_applyReviver = __commonJS((exports) => {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
@@ -486,7 +486,7 @@ var require_applyReviver = __commonJS((exports) => {
   exports.applyReviver = applyReviver;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/toJS.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/toJS.js
 var require_toJS = __commonJS((exports) => {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
@@ -513,7 +513,7 @@ var require_toJS = __commonJS((exports) => {
   exports.toJS = toJS;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Node.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Node.js
 var require_Node = __commonJS((exports) => {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
@@ -550,7 +550,7 @@ var require_Node = __commonJS((exports) => {
   exports.NodeBase = NodeBase;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Alias.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Alias.js
 var require_Alias = __commonJS((exports) => {
   var anchors = require_anchors();
   var visit = require_visit();
@@ -658,7 +658,7 @@ var require_Alias = __commonJS((exports) => {
   exports.Alias = Alias;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Scalar.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Scalar.js
 var require_Scalar = __commonJS((exports) => {
   var identity = require_identity();
   var Node = require_Node();
@@ -686,7 +686,7 @@ var require_Scalar = __commonJS((exports) => {
   exports.isScalarValue = isScalarValue;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/createNode.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/createNode.js
 var require_createNode = __commonJS((exports) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -758,7 +758,7 @@ var require_createNode = __commonJS((exports) => {
   exports.createNode = createNode;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Collection.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Collection.js
 var require_Collection = __commonJS((exports) => {
   var createNode = require_createNode();
   var identity = require_identity();
@@ -873,7 +873,7 @@ var require_Collection = __commonJS((exports) => {
   exports.isEmptyPath = isEmptyPath;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyComment.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyComment.js
 var require_stringifyComment = __commonJS((exports) => {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
@@ -890,7 +890,7 @@ var require_stringifyComment = __commonJS((exports) => {
   exports.stringifyComment = stringifyComment;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/foldFlowLines.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/foldFlowLines.js
 var require_foldFlowLines = __commonJS((exports) => {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
@@ -1027,7 +1027,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
   exports.foldFlowLines = foldFlowLines;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyString.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyString.js
 var require_stringifyString = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
@@ -1325,7 +1325,7 @@ ${indent}`);
   exports.stringifyString = stringifyString;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringify.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringify.js
 var require_stringify = __commonJS((exports) => {
   var anchors = require_anchors();
   var identity = require_identity();
@@ -1446,7 +1446,7 @@ ${ctx.indent}${str}`;
   exports.stringify = stringify;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyPair.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyPair.js
 var require_stringifyPair = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1582,7 +1582,7 @@ ${ctx.indent}`;
   exports.stringifyPair = stringifyPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/log.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/log.js
 var require_log = __commonJS((exports) => {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
@@ -1601,7 +1601,7 @@ var require_log = __commonJS((exports) => {
   exports.warn = warn;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/merge.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/merge.js
 var require_merge = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1655,7 +1655,7 @@ var require_merge = __commonJS((exports) => {
   exports.merge = merge;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js
 var require_addPairToJSMap = __commonJS((exports) => {
   var log = require_log();
   var merge = require_merge();
@@ -1716,7 +1716,7 @@ var require_addPairToJSMap = __commonJS((exports) => {
   exports.addPairToJSMap = addPairToJSMap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Pair.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Pair.js
 var require_Pair = __commonJS((exports) => {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
@@ -1754,7 +1754,7 @@ var require_Pair = __commonJS((exports) => {
   exports.createPair = createPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyCollection.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyCollection.js
 var require_stringifyCollection = __commonJS((exports) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -1906,7 +1906,7 @@ ${indent}${end}`;
   exports.stringifyCollection = stringifyCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLMap.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLMap.js
 var require_YAMLMap = __commonJS((exports) => {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
@@ -2033,7 +2033,7 @@ var require_YAMLMap = __commonJS((exports) => {
   exports.findPair = findPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/map.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/map.js
 var require_map = __commonJS((exports) => {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
@@ -2052,7 +2052,7 @@ var require_map = __commonJS((exports) => {
   exports.map = map;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLSeq.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLSeq.js
 var require_YAMLSeq = __commonJS((exports) => {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
@@ -2145,7 +2145,7 @@ var require_YAMLSeq = __commonJS((exports) => {
   exports.YAMLSeq = YAMLSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/seq.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/seq.js
 var require_seq = __commonJS((exports) => {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
@@ -2164,7 +2164,7 @@ var require_seq = __commonJS((exports) => {
   exports.seq = seq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/string.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/string.js
 var require_string = __commonJS((exports) => {
   var stringifyString = require_stringifyString();
   var string = {
@@ -2180,7 +2180,7 @@ var require_string = __commonJS((exports) => {
   exports.string = string;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/null.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/null.js
 var require_null = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var nullTag = {
@@ -2195,7 +2195,7 @@ var require_null = __commonJS((exports) => {
   exports.nullTag = nullTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/bool.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/bool.js
 var require_bool = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var boolTag = {
@@ -2216,7 +2216,7 @@ var require_bool = __commonJS((exports) => {
   exports.boolTag = boolTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyNumber.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyNumber.js
 var require_stringifyNumber = __commonJS((exports) => {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
@@ -2240,7 +2240,7 @@ var require_stringifyNumber = __commonJS((exports) => {
   exports.stringifyNumber = stringifyNumber;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/float.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/float.js
 var require_float = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2283,7 +2283,7 @@ var require_float = __commonJS((exports) => {
   exports.floatNaN = floatNaN;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/int.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/int.js
 var require_int = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2325,7 +2325,7 @@ var require_int = __commonJS((exports) => {
   exports.intOct = intOct;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/schema.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/schema.js
 var require_schema = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -2350,7 +2350,7 @@ var require_schema = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/json/schema.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/json/schema.js
 var require_schema2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var map = require_map();
@@ -2414,7 +2414,7 @@ var require_schema2 = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/binary.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/binary.js
 var require_binary = __commonJS((exports) => {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
@@ -2469,7 +2469,7 @@ var require_binary = __commonJS((exports) => {
   exports.binary = binary;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
 var require_pairs = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2544,7 +2544,7 @@ ${cn.comment}` : item.comment;
   exports.resolvePairs = resolvePairs;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/omap.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/omap.js
 var require_omap = __commonJS((exports) => {
   var identity = require_identity();
   var toJS = require_toJS();
@@ -2616,7 +2616,7 @@ var require_omap = __commonJS((exports) => {
   exports.omap = omap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/bool.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/bool.js
 var require_bool2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
@@ -2645,7 +2645,7 @@ var require_bool2 = __commonJS((exports) => {
   exports.trueTag = trueTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/float.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/float.js
 var require_float2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2691,7 +2691,7 @@ var require_float2 = __commonJS((exports) => {
   exports.floatNaN = floatNaN;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/int.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/int.js
 var require_int2 = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2767,7 +2767,7 @@ var require_int2 = __commonJS((exports) => {
   exports.intOct = intOct;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/set.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/set.js
 var require_set = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2850,7 +2850,7 @@ var require_set = __commonJS((exports) => {
   exports.set = set;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
 var require_timestamp = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
@@ -2932,7 +2932,7 @@ var require_timestamp = __commonJS((exports) => {
   exports.timestamp = timestamp;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/schema.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/schema.js
 var require_schema3 = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -2973,7 +2973,7 @@ var require_schema3 = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/tags.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/tags.js
 var require_tags = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -3064,7 +3064,7 @@ var require_tags = __commonJS((exports) => {
   exports.getTags = getTags;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/Schema.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/Schema.js
 var require_Schema = __commonJS((exports) => {
   var identity = require_identity();
   var map = require_map();
@@ -3094,7 +3094,7 @@ var require_Schema = __commonJS((exports) => {
   exports.Schema = Schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyDocument.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyDocument.js
 var require_stringifyDocument = __commonJS((exports) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -3174,7 +3174,7 @@ var require_stringifyDocument = __commonJS((exports) => {
   exports.stringifyDocument = stringifyDocument;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/Document.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/Document.js
 var require_Document = __commonJS((exports) => {
   var Alias = require_Alias();
   var Collection = require_Collection();
@@ -3409,7 +3409,7 @@ var require_Document = __commonJS((exports) => {
   exports.Document = Document;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/errors.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/errors.js
 var require_errors = __commonJS((exports) => {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
@@ -3474,7 +3474,7 @@ ${pointer}
   exports.prettifyError = prettifyError;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-props.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-props.js
 var require_resolve_props = __commonJS((exports) => {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
@@ -3604,7 +3604,7 @@ var require_resolve_props = __commonJS((exports) => {
   exports.resolveProps = resolveProps;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-contains-newline.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-contains-newline.js
 var require_util_contains_newline = __commonJS((exports) => {
   function containsNewline(key) {
     if (!key)
@@ -3644,7 +3644,7 @@ var require_util_contains_newline = __commonJS((exports) => {
   exports.containsNewline = containsNewline;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-flow-indent-check.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-flow-indent-check.js
 var require_util_flow_indent_check = __commonJS((exports) => {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
@@ -3659,7 +3659,7 @@ var require_util_flow_indent_check = __commonJS((exports) => {
   exports.flowIndentCheck = flowIndentCheck;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-map-includes.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-map-includes.js
 var require_util_map_includes = __commonJS((exports) => {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
@@ -3672,7 +3672,7 @@ var require_util_map_includes = __commonJS((exports) => {
   exports.mapIncludes = mapIncludes;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-map.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-map.js
 var require_resolve_block_map = __commonJS((exports) => {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -3779,7 +3779,7 @@ var require_resolve_block_map = __commonJS((exports) => {
   exports.resolveBlockMap = resolveBlockMap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-seq.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-seq.js
 var require_resolve_block_seq = __commonJS((exports) => {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
@@ -3827,7 +3827,7 @@ var require_resolve_block_seq = __commonJS((exports) => {
   exports.resolveBlockSeq = resolveBlockSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-end.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-end.js
 var require_resolve_end = __commonJS((exports) => {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
@@ -3867,7 +3867,7 @@ var require_resolve_end = __commonJS((exports) => {
   exports.resolveEnd = resolveEnd;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-collection.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-collection.js
 var require_resolve_flow_collection = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -4058,7 +4058,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
   exports.resolveFlowCollection = resolveFlowCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-collection.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-collection.js
 var require_compose_collection = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4120,7 +4120,7 @@ var require_compose_collection = __commonJS((exports) => {
   exports.composeCollection = composeCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-scalar.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-scalar.js
 var require_resolve_block_scalar = __commonJS((exports) => {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
@@ -4313,7 +4313,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
   exports.resolveBlockScalar = resolveBlockScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-scalar.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-scalar.js
 var require_resolve_flow_scalar = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
@@ -4529,7 +4529,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
   exports.resolveFlowScalar = resolveFlowScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-scalar.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-scalar.js
 var require_compose_scalar = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4607,7 +4607,7 @@ var require_compose_scalar = __commonJS((exports) => {
   exports.composeScalar = composeScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-empty-scalar-position.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-empty-scalar-position.js
 var require_util_empty_scalar_position = __commonJS((exports) => {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
@@ -4634,7 +4634,7 @@ var require_util_empty_scalar_position = __commonJS((exports) => {
   exports.emptyScalarPosition = emptyScalarPosition;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-node.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-node.js
 var require_compose_node = __commonJS((exports) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -4737,7 +4737,7 @@ var require_compose_node = __commonJS((exports) => {
   exports.composeNode = composeNode;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-doc.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-doc.js
 var require_compose_doc = __commonJS((exports) => {
   var Document = require_Document();
   var composeNode = require_compose_node();
@@ -4777,7 +4777,7 @@ var require_compose_doc = __commonJS((exports) => {
   exports.composeDoc = composeDoc;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/composer.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/composer.js
 var require_composer = __commonJS((exports) => {
   var node_process = __require("process");
   var directives = require_directives();
@@ -4966,7 +4966,7 @@ ${end.comment}` : end.comment;
   exports.Composer = Composer;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-scalar.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-scalar.js
 var require_cst_scalar = __commonJS((exports) => {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
@@ -5156,7 +5156,7 @@ var require_cst_scalar = __commonJS((exports) => {
   exports.setScalarValue = setScalarValue;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-stringify.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS((exports) => {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
@@ -5214,7 +5214,7 @@ var require_cst_stringify = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-visit.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-visit.js
 var require_cst_visit = __commonJS((exports) => {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -5273,7 +5273,7 @@ var require_cst_visit = __commonJS((exports) => {
   exports.visit = visit;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst.js
 var require_cst = __commonJS((exports) => {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
@@ -5374,7 +5374,7 @@ var require_cst = __commonJS((exports) => {
   exports.tokenType = tokenType;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/lexer.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/lexer.js
 var require_lexer = __commonJS((exports) => {
   var cst = require_cst();
   function isEmpty(ch) {
@@ -5960,7 +5960,7 @@ var require_lexer = __commonJS((exports) => {
   exports.Lexer = Lexer;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/line-counter.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/line-counter.js
 var require_line_counter = __commonJS((exports) => {
   class LineCounter {
     constructor() {
@@ -5988,7 +5988,7 @@ var require_line_counter = __commonJS((exports) => {
   exports.LineCounter = LineCounter;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/parser.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/parser.js
 var require_parser = __commonJS((exports) => {
   var node_process = __require("process");
   var cst = require_cst();
@@ -6837,7 +6837,7 @@ var require_parser = __commonJS((exports) => {
   exports.Parser = Parser;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/public-api.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/public-api.js
 var require_public_api = __commonJS((exports) => {
   var composer = require_composer();
   var Document = require_Document();
@@ -6939,7 +6939,7 @@ import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:f
 import { homedir } from "node:os";
 import { resolve as resolve3 } from "node:path";
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
+// ../switchroom-sec-1417/node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
 var composer = require_composer();
 var Document = require_Document();
 var Schema = require_Schema();
@@ -6985,7 +6985,7 @@ var $stringify = publicApi.stringify;
 var $visit = visit.visit;
 var $visitAsync = visit.visitAsync;
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -7097,7 +7097,7 @@ __export(exports_external, {
   BRAND: () => BRAND
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {};
@@ -7228,7 +7228,7 @@ var getParsedType = (data) => {
   }
 };
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -7347,7 +7347,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -7450,7 +7450,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -7458,7 +7458,7 @@ function setErrorMap(map) {
 function getErrorMap() {
   return overrideErrorMap;
 }
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -7564,14 +7564,14 @@ var isAborted = (x) => x.status === "aborted";
 var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// ../switchroom-sec-1417/node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -10973,7 +10973,11 @@ var ScheduleEntrySchema = exports_external.object({
   cron: exports_external.string().describe("Cron expression (e.g., '0 8 * * *')"),
   prompt: exports_external.string().describe("Prompt to send at the scheduled time"),
   model: exports_external.string().optional().describe("DEPRECATED / IGNORED. Pre-v0.8 the singleton scheduler ran each " + "task as an isolated headless invocation and could set --model per " + "task. Post cron-fold-in (v0.8) the fire is injected into the agent's " + "running session, so it always uses the agent's configured model " + "— this field has no effect. Accepted (optional) only so existing " + "configs keep validating; set the model at the agent level instead. " + "See docs/scheduling.md."),
-  secrets: exports_external.array(exports_external.string().regex(/^[a-zA-Z0-9_\-/]+$/, "Secret key names must contain only alphanumeric characters, underscores, hyphens, and forward slashes")).default([]).describe("Vault key names this cron task may read via the vault-broker daemon. " + "Empty by default — broker requests for unlisted keys are denied. " + "Note: this is misconfiguration protection (a typo in cron-A doesn't " + "accidentally read cron-B's keys) rather than a security boundary — " + "anyone who can edit cron scripts can also edit switchroom.yaml, and " + "anyone with the vault passphrase can read the vault file directly. " + "See docs/configuration.md for the full framing.")
+  secrets: exports_external.array(exports_external.string().regex(/^[a-zA-Z0-9_\-/]+$/, "Secret key names must contain only alphanumeric characters, underscores, hyphens, and forward slashes")).default([]).describe("Vault key names this cron task may read via the vault-broker daemon. " + "Empty by default — broker requests for unlisted keys are denied. " + "Note: this is misconfiguration protection (a typo in cron-A doesn't " + "accidentally read cron-B's keys) rather than a security boundary — " + "anyone who can edit cron scripts can also edit switchroom.yaml, and " + "anyone with the vault passphrase can read the vault file directly. " + "See docs/configuration.md for the full framing."),
+  topic: exports_external.union([
+    exports_external.string().min(1, "topic alias must be non-empty"),
+    exports_external.number().int().positive("topic ID must be a positive integer")
+  ]).optional().describe("Forum topic this cron fires into when the owning agent is in " + "supergroup-owned mode (channels.telegram.chat_id set). Either a " + 'string alias resolved against `topic_aliases` (e.g. "planning") ' + "or a numeric topic ID. Falls back to the agent's `default_topic_id` " + "when unset. Ignored for agents in fleet-shared or dm_only mode. " + "Alias-resolution happens at config-load — typos surface immediately. " + "See docs/rfcs/supergroup-mode.md.")
 });
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
@@ -10993,7 +10997,8 @@ var AgentMemorySchema = exports_external.object({
   recall: exports_external.object({
     max_memories: exports_external.number().int().min(0).optional().describe("Cap on the number of memories injected into the prompt by " + "auto-recall, regardless of token budget. Plugin default is 12. " + "0 disables the cap (all memories Hindsight returns are injected)."),
     cache_ttl_secs: exports_external.number().int().min(0).optional().describe("Per-session recall cache TTL in seconds. When > 0, identical " + "(prompt, bank) within the same session reuse the cached recall " + "result instead of round-tripping to Hindsight. 0 disables. " + "Default is 600 (10 min) for switchroom-managed agents."),
-    min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default — " + "current behaviour). Try 0.10–0.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`.")
+    min_overlap: exports_external.number().min(0).max(1).optional().describe("Minimum Jaccard token overlap [0.0–1.0] between the user " + "prompt and a memory's text for the memory to be injected. " + "Drops low-relevance matches before the count cap so weak hits " + "don't fill the slot on real queries. 0.0 disables (default — " + "current behaviour). Try 0.10–0.20 to start; observe the " + "`overlap_dropped` field via `switchroom memory recall-log`."),
+    topic_filter_mode: exports_external.enum(["soft-preamble", "hard-filter"]).optional().describe("Supergroup-mode cross-topic memory behaviour. Default " + "(unset) → soft-preamble: recall returns memories from all " + "topics, and a 'Current topic: …' preamble tells the model " + "to self-scope. hard-filter: drop any recalled memory whose " + "metadata.thread_id differs from the active inbound's topic. " + "Flip to hard-filter when the recall_log shows binding " + "failures (model surfacing the right memory but applying " + "it to the wrong topic).")
   }).optional().describe("Auto-recall tuning knobs")
 }).optional();
 var HookEntrySchema = exports_external.object({
@@ -11085,8 +11090,35 @@ var TelegramChannelSchema = exports_external.object({
   }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
   webhook_rate_limit: exports_external.object({
     rpm: exports_external.number().int().positive()
-  }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit.")
-}).optional();
+  }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
+  chat_id: exports_external.string().regex(/^-\d+$/, 'supergroup chat_id must be a negative integer as a string (e.g. "-1001234567890")').optional().describe("Per-agent supergroup ID — overrides fleet `telegram.forum_chat_id`. " + "When set, requires `default_topic_id`. Negative integer as string. " + "Forbidden when `dm_only: true`. See docs/rfcs/supergroup-mode.md."),
+  default_topic_id: exports_external.number().int().positive().optional().describe("Forum topic ID this agent's automated outbounds default to when " + "no more-specific alias resolves. Required when `chat_id` is set. " + "Telegram's General topic is `id=1` at MTProto but sends omit the " + "field — the outbound wrapper strips `message_thread_id === 1` " + "on send. Forbidden when `dm_only: true`."),
+  topic_aliases: exports_external.record(exports_external.string(), exports_external.number().int().positive()).optional().describe("Operator-friendly names for forum topic IDs (e.g. " + "`{ general: 1, planning: 17, cron: 23, admin: 31, alerts: 41 }`). " + "Referenced from per-cron `topic:` fields and the outbound router " + "for autonomous events (boot → alerts, hostd → admin, etc.). " + "Cascades per-key through defaults → profile → agent.")
+}).optional().superRefine((tg, ctx) => {
+  if (!tg)
+    return;
+  if (tg.chat_id != null && tg.default_topic_id == null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`channels.telegram.chat_id` requires `default_topic_id` — supergroup-mode agents need a fallback topic for unclassified outbounds.",
+      path: ["default_topic_id"]
+    });
+  }
+  if (tg.default_topic_id != null && tg.chat_id == null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`channels.telegram.default_topic_id` requires `chat_id` — default_topic_id is only meaningful when the agent owns its own supergroup.",
+      path: ["chat_id"]
+    });
+  }
+  if (tg.topic_aliases != null && tg.chat_id == null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`channels.telegram.topic_aliases` requires `chat_id` — aliases only resolve in supergroup-owned mode.",
+      path: ["topic_aliases"]
+    });
+  }
+});
 var ChannelsSchema = exports_external.object({
   telegram: TelegramChannelSchema
 }).optional();
@@ -11103,6 +11135,12 @@ var GoogleWorkspaceConfigSchema = exports_external.object({
   approvers: exports_external.array(ApproverIdSchema).min(1).describe("Array of numeric Telegram user IDs authorized to approve drive onboarding. " + "At least one must be specified."),
   tier: GoogleWorkspaceTierSchema.optional().describe("RFC G Phase 1: which upstream MCP tier to expose. " + "core (default) = ~16 tools (Drive+Docs+Sheets+Calendar). " + "extended = ~40 tools (+Slides, Forms, Tasks, Chat). " + "complete = ~60+ tools (+Gmail; not recommended yet — see RFC G §5).")
 }).optional();
+var MicrosoftWorkspaceConfigSchema = exports_external.object({
+  microsoft_client_id: exports_external.string().min(1).describe("Microsoft OAuth application (client) ID from Entra portal " + "(literal string or vault reference e.g. " + "'vault:microsoft-oauth-client-id')."),
+  microsoft_client_secret: exports_external.string().min(1).optional().describe("Microsoft OAuth client secret. Optional — public-client apps " + "(Mobile + Desktop platform with 'Allow public client flows' " + "enabled) work without a secret; confidential clients pass " + "one. Either literal or vault reference e.g. " + "'vault:microsoft-oauth-client-secret'."),
+  authority: exports_external.string().url().optional().describe("Microsoft authority endpoint. Defaults to " + "'https://login.microsoftonline.com/common' which accepts both " + "personal MSA and work/school tenants. Override only for " + "single-tenant deployments."),
+  org_mode: exports_external.boolean().optional().describe("Opt-in to Teams + SharePoint surfaces (RFC §6.4). When true, " + "the v1 scope set adds Sites.ReadWrite.All AND the launcher " + "spawns softeria with --org-mode. Defaults to false — personal " + "MSA + standard work surfaces only. Flipping for an existing " + "consented account requires re-running 'auth microsoft account " + "add --replace' to consent the additional scope.")
+}).optional();
 var AgentGoogleWorkspaceConfigSchema = exports_external.object({
   account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
     message: "google_workspace.account must be a Google account email like " + "'alice@example.com' (colons not allowed)"
@@ -11110,6 +11148,12 @@ var AgentGoogleWorkspaceConfigSchema = exports_external.object({
   approvers: exports_external.array(ApproverIdSchema).min(1).optional().describe("Per-agent approver override. When set, replaces (does not extend) " + "the top-level drive.approvers list for this agent's onboarding card."),
   tier: GoogleWorkspaceTierSchema.optional().describe("Per-agent tier override (RFC G Phase 1). When set, replaces the " + "top-level google_workspace.tier for this agent. Common case: most " + "agents on `core`, one specialist on `extended` for Slides access.")
 }).optional();
+var AgentMicrosoftWorkspaceConfigSchema = exports_external.object({
+  account: exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
+    message: "microsoft_workspace.account must be a Microsoft account email like " + "'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
+  }).transform((v) => v.trim().toLowerCase()).optional().describe("RFC #1873: the Microsoft account this agent uses for the M365 MCP. " + "Must be a key in top-level `microsoft_accounts:` with this agent " + "listed in its `enabled_for[]`. Read by the auth-broker " + "(get-credentials, provider=microsoft) and by the scaffold to " + "decide whether to emit the `ms-365` MCP entry. Normalized to " + "lowercase so it matches the microsoft_accounts key (which is " + "also normalized)."),
+  org_mode: exports_external.boolean().optional().describe("Per-agent org_mode override (RFC #1873 §6.4). When set, replaces " + "the top-level microsoft_workspace.org_mode for this agent. " + "Defaults to top-level value (which defaults to false).")
+}).optional();
 var ReactionsSchema = exports_external.object({
   enabled: exports_external.boolean().optional().describe("Master switch for the reaction-trigger path. When false, " + "reactions are still persisted via recordReaction but never " + "dispatched to the agent as synthetic inbound turns. Default true."),
   trigger_emojis: exports_external.array(exports_external.string()).optional().describe("Emoji allowlist that triggers a synthetic inbound when reacted " + "to a bot message. Default ['\uD83D\uDC4E', '❌', '\uD83D\uDC4D', '✅']. Cascade " + "mode: REPLACE (not union) — setting this at a layer replaces " + "lower layers entirely, so an operator can narrow to [] to " + "disable triggering without flipping `enabled`."),
@@ -11245,6 +11289,7 @@ var AgentSchema = exports_external.object({
   code_repos: exports_external.array(CodeRepoEntrySchema).optional().describe("Git repositories this agent is allowed to claim worktrees from. " + "Each entry provides a short name alias, a source path, and an " + "optional concurrency cap (default 5). When code_repos is set, " + "claim_worktree accepts the alias as the repo argument. " + "Absolute paths may always be passed regardless of this list."),
   drive: AgentGoogleWorkspaceConfigSchema.describe("RFC D legacy key — use `google_workspace:` instead. Per-agent " + "google_workspace overrides (currently approvers + tier). When set, " + "replaces the top-level approvers list for this agent. " + "google_client_id/secret are not per-agent — they live at the top level."),
   google_workspace: AgentGoogleWorkspaceConfigSchema.describe("RFC G canonical key. Per-agent Google Workspace overrides — currently " + "approvers (replaces, does not extend the top-level list) and tier " + "(`core` | `extended` | `complete`, replaces top-level default). " + "google_client_id/secret are not per-agent — they live at the top level. " + "Mutually exclusive with `drive:` on the same agent (loader fails fast " + "if both are set)."),
+  microsoft_workspace: AgentMicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Per-agent Microsoft Workspace " + "override — pins the Microsoft account this agent reads via the " + "auth-broker (must be a key in top-level `microsoft_accounts:` with " + "this agent in its `enabled_for[]`) and optionally overrides org_mode. " + "microsoft_client_id/secret are not per-agent."),
   repos: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Repo slug must be kebab-case ASCII: start with a lowercase letter or digit, contain only lowercase letters, digits, and hyphens"), exports_external.object({
     url: exports_external.string().min(1).describe("Git remote URL for the repo (e.g. 'git@github.com:org/repo.git' or " + "'https://github.com/org/repo.git'). Used verbatim for git clone."),
     branch_default: exports_external.string().optional().describe("Default branch to track (defaults to the remote's HEAD, typically 'main'). " + "The per-agent branch 'agent/<agentName>/main' fast-forwards to this branch " + "when the worktree is clean on session start.")
@@ -11259,6 +11304,33 @@ var AgentSchema = exports_external.object({
     pids_limit: exports_external.number().int().positive().optional(),
     cpus: exports_external.number().positive().optional()
   }).optional()
+}).superRefine((agent, ctx) => {
+  if (agent.dm_only !== true)
+    return;
+  const tg = agent.channels?.telegram;
+  if (tg == null)
+    return;
+  if (tg.chat_id != null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`dm_only: true` forbids `channels.telegram.chat_id` — DM-only agents have their own private chat, not a supergroup.",
+      path: ["channels", "telegram", "chat_id"]
+    });
+  }
+  if (tg.default_topic_id != null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`dm_only: true` forbids `channels.telegram.default_topic_id` — DMs don't have forum topics.",
+      path: ["channels", "telegram", "default_topic_id"]
+    });
+  }
+  if (tg.topic_aliases != null) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "`dm_only: true` forbids `channels.telegram.topic_aliases` — DMs don't have forum topics.",
+      path: ["channels", "telegram", "topic_aliases"]
+    });
+  }
 });
 var TelegramConfigSchema = exports_external.object({
   bot_token: exports_external.string().describe("Telegram bot token or vault reference (e.g., 'vault:telegram-bot-token')"),
@@ -11340,6 +11412,7 @@ var SwitchroomConfigSchema = exports_external.object({
   }).optional().describe("Switchroom-auth-broker configuration (RFC H). Fleet-wide active account, " + "fallback order, admin-agent ACL, and ephemeral-consumer surface. " + "Required from the v0.8+ schema onwards; pre-v0.8 fleets are migrated " + "in-place by `switchroom apply` (see src/auth/migrate-schema.ts)."),
   drive: GoogleWorkspaceConfigSchema.describe("RFC D legacy key — use `google_workspace:` instead. Optional Google " + "Workspace onboarding configuration. When set, supplies Google OAuth " + "client credentials, the approver allowlist for `switchroom drive " + "connect`, and the optional tier knob. Env vars " + "(SWITCHROOM_GOOGLE_CLIENT_ID, SWITCHROOM_GOOGLE_CLIENT_SECRET, " + "SWITCHROOM_APPROVER_USER_ID) take precedence over this block when " + "set, preserving back-compat with the env-only flow shipped in #766."),
   google_workspace: GoogleWorkspaceConfigSchema.describe("RFC G canonical key. Top-level Google Workspace configuration — " + "OAuth client credentials, approver allowlist, and tier knob (`core` " + "| `extended` | `complete`, default `core`). Mutually exclusive with " + "`drive:` at the top level (loader fails fast if both are set)."),
+  microsoft_workspace: MicrosoftWorkspaceConfigSchema.describe("RFC #1873 (Microsoft 365 integration). Top-level Microsoft Workspace " + "configuration — OAuth client credentials (Entra app), authority " + "endpoint (defaults to /common for personal MSA + work), and the " + "org_mode opt-in for Teams/SharePoint surfaces. Block is optional; " + "when omitted the broker does not register the Microsoft provider."),
   quota: QuotaConfigSchema.optional().describe("Optional weekly/monthly USD spend budgets rendered in the session " + "greeting. Usage is read from ccusage at runtime; no network calls."),
   host_control: HostControlConfigSchema.default({}).describe("Host-control daemon configuration. Defaults to enabled=true since " + "RFC C Phase 2 (docs/rfcs/host-control-daemon.md). Omit the block " + "to accept defaults; set `enabled: false` only on legacy systemd-" + "mode installs (removal tracked as RFC C Phase 3)."),
   hostd: HostdConfigSchema.default({}).describe("hostd verb-level knobs (RFC admin-agent-config-edit). Distinct " + "from `host_control:` which governs whether the daemon runs at " + "all. Currently scopes the opt-in flag and rate cap for the new " + "`config_propose_edit` verb (PR 1a — disabled by default)."),
@@ -11350,6 +11423,13 @@ var SwitchroomConfigSchema = exports_external.object({
       message: "Agent name must match the standard agent-name pattern"
     })).describe("Agent slugs that may read this account's vault slots " + "(`google:<account>:refresh_token` etc). Per-agent ACL is " + "enforced at the broker, not at the agent identity layer — " + "the agent still authenticates via socket-path-as-identity " + "per RFC D §4.1, broker just gates the cross-agent token share.")
   })).optional().describe("RFC G Phase 2: per-Google-account ACL for vault slots holding " + "OAuth refresh tokens. Maps account email → list of agents " + "permitted to read that account's slots. Written by `switchroom " + "auth google enable|disable` (Phase 3); read by the broker on " + "every Google slot access. Replaces RFC D's per-agent vault slot " + "scope (which can't express 'two agents share one Google account')."),
+  microsoft_accounts: exports_external.record(exports_external.string().regex(/^[^@\s:]+@[^@\s:]+\.[^@\s:]+$/, {
+    message: "Account key must be a Microsoft account email like 'alice@outlook.com' or 'alice@contoso.com' (colons not allowed)"
+  }).transform((v) => v.trim().toLowerCase()), exports_external.object({
+    enabled_for: exports_external.array(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,50}$/, {
+      message: "Agent name must match the standard agent-name pattern"
+    })).describe("Agent slugs that may read this Microsoft account's broker " + "credentials. Per-agent ACL enforced at the broker; agents " + "still authenticate via socket-path-as-identity, broker just " + "gates the cross-agent token share. Mirrors google_accounts.")
+  })).optional().describe("RFC #1873: per-Microsoft-account ACL. Maps account email → list of " + "agents permitted to use that account's broker credentials. Written " + "by `switchroom auth microsoft enable|disable`; read by the broker " + "on get-credentials with provider=microsoft."),
   defaults: AgentDefaultsSchema.describe("Implicit bottom-of-cascade profile applied to every agent before " + "per-agent config and `extends:` resolution. Tools, mcp_servers, and " + "schedule are unioned/concatenated; scalars and nested objects are " + "shallow-merged with per-agent values winning."),
   profiles: exports_external.record(exports_external.string(), ProfileSchema).optional().describe("Named profile definitions. Agents reference via `extends: <name>`. " + "Inline profiles declared here take priority over filesystem " + "profiles/<name>/ directories when both exist."),
   agents: exports_external.record(exports_external.string().regex(/^[a-z0-9][a-z0-9_-]{0,50}$/, {
@@ -11519,157 +11599,6 @@ function applyAgentOverlays(config) {
   return { config, warnings };
 }
 
-// src/config/loader.ts
-class ConfigError extends Error {
-  details;
-  constructor(message, details) {
-    super(message);
-    this.details = details;
-    this.name = "ConfigError";
-  }
-}
-function formatZodErrors(error) {
-  return error.errors.map((e) => {
-    const path = e.path.join(".");
-    return `  ${path}: ${e.message}`;
-  });
-}
-function coerceLegacyGoogleWorkspaceKeys(parsed, filePath) {
-  const stableStringify = (v) => {
-    if (v === null || typeof v !== "object")
-      return JSON.stringify(v);
-    if (Array.isArray(v))
-      return `[${v.map(stableStringify).join(",")}]`;
-    const obj = v;
-    const keys = Object.keys(obj).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
-  };
-  const aliasInPlace = (obj, where) => {
-    const a = obj.drive;
-    const b = obj.google_workspace;
-    if (a !== undefined && b !== undefined) {
-      if (stableStringify(a) !== stableStringify(b)) {
-        throw new ConfigError(`Both \`drive:\` and \`google_workspace:\` are set on ${where} in ${filePath} with different values.`, [
-          "  These are aliases — pick one and remove the other.",
-          "  `google_workspace:` is the RFC G canonical key; `drive:` is the legacy alias.",
-          "  Allowed during transition: setting both with identical values."
-        ]);
-      }
-      return;
-    }
-    if (a !== undefined && b === undefined)
-      obj.google_workspace = a;
-    if (b !== undefined && a === undefined)
-      obj.drive = b;
-  };
-  aliasInPlace(parsed, "the top level");
-  const agents = parsed.agents;
-  if (agents && typeof agents === "object" && !Array.isArray(agents)) {
-    for (const [name, agent] of Object.entries(agents)) {
-      if (agent && typeof agent === "object" && !Array.isArray(agent)) {
-        aliasInPlace(agent, `agent \`${name}\``);
-      }
-    }
-  }
-}
-function findConfigFile(startDir) {
-  const envPath = process.env.SWITCHROOM_CONFIG;
-  const home2 = homedir();
-  const userDir = resolve3(home2, ".switchroom");
-  const searchPaths = [
-    envPath ? resolve3(envPath) : null,
-    startDir ? resolve3(startDir, "switchroom.yaml") : null,
-    startDir ? resolve3(startDir, "switchroom.yml") : null,
-    startDir ? resolve3(startDir, "clerk.yaml") : null,
-    startDir ? resolve3(startDir, "clerk.yml") : null,
-    resolve3(process.cwd(), "switchroom.yaml"),
-    resolve3(process.cwd(), "switchroom.yml"),
-    resolve3(process.cwd(), "clerk.yaml"),
-    resolve3(process.cwd(), "clerk.yml"),
-    resolve3(userDir, "switchroom.yaml"),
-    resolve3(userDir, "switchroom.yml"),
-    resolve3(userDir, "clerk.yaml"),
-    resolve3(userDir, "clerk.yml")
-  ].filter(Boolean);
-  for (const path of searchPaths) {
-    if (existsSync3(path)) {
-      return path;
-    }
-  }
-  throw new ConfigError("No switchroom.yaml found", searchPaths.map((p) => `  Searched: ${p}`));
-}
-function loadConfig(configPath) {
-  const filePath = configPath ?? findConfigFile();
-  if (!existsSync3(filePath)) {
-    throw new ConfigError(`Config file not found: ${filePath}`);
-  }
-  let raw;
-  try {
-    raw = readFileSync2(filePath, "utf-8");
-  } catch (err) {
-    throw new ConfigError(`Failed to read config file: ${filePath}`, [
-      `  ${err.message}`
-    ]);
-  }
-  let parsed;
-  try {
-    parsed = $parse(raw);
-  } catch (err) {
-    throw new ConfigError(`Invalid YAML in ${filePath}`, [
-      `  ${err.message}`
-    ]);
-  }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.clerk !== undefined && parsed.switchroom === undefined) {
-    const obj = parsed;
-    obj.switchroom = obj.clerk;
-    delete obj.clerk;
-  }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    coerceLegacyGoogleWorkspaceKeys(parsed, filePath);
-  }
-  let config;
-  try {
-    config = SwitchroomConfigSchema.parse(parsed);
-  } catch (err) {
-    if (err instanceof ZodError) {
-      throw new ConfigError("Invalid switchroom.yaml configuration", formatZodErrors(err));
-    }
-    throw err;
-  }
-  applyAgentOverlays(config);
-  return config;
-}
-function resolveAgentsDir(config) {
-  const override = process.env.SWITCHROOM_AGENTS_DIR;
-  if (override && override.length > 0 && override.startsWith("/")) {
-    return override;
-  }
-  return resolveDualPath(config.switchroom.agents_dir);
-}
-
-// src/auth/broker/server.ts
-import * as net from "node:net";
-import {
-  chmodSync,
-  chownSync as chownSync2,
-  existsSync as existsSync6,
-  lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync5,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  statSync as statSync4,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-import { closeSync as closeSync2, openSync as openSync2, writeSync as writeSync2 } from "node:fs";
-import * as constants2 from "node:constants";
-import { createHash as createHash2 } from "node:crypto";
-import { dirname as dirname2, join as join3, resolve as resolve6 } from "node:path";
-
-// src/agents/compose.ts
-import { createHash } from "node:crypto";
-
 // src/config/merge.ts
 function dedupe(items) {
   const seen = new Set;
@@ -11698,6 +11627,20 @@ function deepMergeJson(base, override) {
   }
   return out;
 }
+function resolveAgentConfig(defaults, profiles, agent) {
+  if (!mergeAgentConfig.suppressDeprecationLogs && !mergeAgentConfig.notifiedWorkerIsolationMove && defaults?.subagents?.worker?.isolation === "worktree") {
+    mergeAgentConfig.notifiedWorkerIsolationMove = true;
+    console.warn("[switchroom] NOTICE: defaults.subagents.worker.isolation moved to the " + "`coding` profile in switchroom 0.6.6 (#682). Agents extending coding " + "still get worktree-isolated workers; other agents would have hard-failed " + "the first time they delegated. See CHANGELOG.");
+  }
+  const name = agent.extends;
+  const profile = name && profiles ? profiles[name] : undefined;
+  if (!profile) {
+    return mergeAgentConfig(defaults, agent);
+  }
+  const { extends: _unused, ...profileWithoutExtends } = profile;
+  const layered = mergeAgentConfig(defaults, profileWithoutExtends);
+  return mergeAgentConfig(layered, agent);
+}
 function foldDeprecatedTelegramFields(config) {
   const c = config;
   const root = c;
@@ -11965,6 +11908,183 @@ function mergeAgentConfig(defaultsIn, agentIn) {
   mergeAgentConfig.notifiedWorkerIsolationMove = false;
 })(mergeAgentConfig ||= {});
 
+// src/config/loader.ts
+class ConfigError extends Error {
+  details;
+  constructor(message, details) {
+    super(message);
+    this.details = details;
+    this.name = "ConfigError";
+  }
+}
+function formatZodErrors(error) {
+  return error.errors.map((e) => {
+    const path = e.path.join(".");
+    return `  ${path}: ${e.message}`;
+  });
+}
+function coerceLegacyGoogleWorkspaceKeys(parsed, filePath) {
+  const stableStringify = (v) => {
+    if (v === null || typeof v !== "object")
+      return JSON.stringify(v);
+    if (Array.isArray(v))
+      return `[${v.map(stableStringify).join(",")}]`;
+    const obj = v;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+  };
+  const aliasInPlace = (obj, where) => {
+    const a = obj.drive;
+    const b = obj.google_workspace;
+    if (a !== undefined && b !== undefined) {
+      if (stableStringify(a) !== stableStringify(b)) {
+        throw new ConfigError(`Both \`drive:\` and \`google_workspace:\` are set on ${where} in ${filePath} with different values.`, [
+          "  These are aliases — pick one and remove the other.",
+          "  `google_workspace:` is the RFC G canonical key; `drive:` is the legacy alias.",
+          "  Allowed during transition: setting both with identical values."
+        ]);
+      }
+      return;
+    }
+    if (a !== undefined && b === undefined)
+      obj.google_workspace = a;
+    if (b !== undefined && a === undefined)
+      obj.drive = b;
+  };
+  aliasInPlace(parsed, "the top level");
+  const agents = parsed.agents;
+  if (agents && typeof agents === "object" && !Array.isArray(agents)) {
+    for (const [name, agent] of Object.entries(agents)) {
+      if (agent && typeof agent === "object" && !Array.isArray(agent)) {
+        aliasInPlace(agent, `agent \`${name}\``);
+      }
+    }
+  }
+}
+function findConfigFile(startDir) {
+  const envPath = process.env.SWITCHROOM_CONFIG;
+  const home2 = homedir();
+  const userDir = resolve3(home2, ".switchroom");
+  const searchPaths = [
+    envPath ? resolve3(envPath) : null,
+    startDir ? resolve3(startDir, "switchroom.yaml") : null,
+    startDir ? resolve3(startDir, "switchroom.yml") : null,
+    startDir ? resolve3(startDir, "clerk.yaml") : null,
+    startDir ? resolve3(startDir, "clerk.yml") : null,
+    resolve3(process.cwd(), "switchroom.yaml"),
+    resolve3(process.cwd(), "switchroom.yml"),
+    resolve3(process.cwd(), "clerk.yaml"),
+    resolve3(process.cwd(), "clerk.yml"),
+    resolve3(userDir, "switchroom.yaml"),
+    resolve3(userDir, "switchroom.yml"),
+    resolve3(userDir, "clerk.yaml"),
+    resolve3(userDir, "clerk.yml")
+  ].filter(Boolean);
+  for (const path of searchPaths) {
+    if (existsSync3(path)) {
+      return path;
+    }
+  }
+  throw new ConfigError("No switchroom.yaml found", searchPaths.map((p) => `  Searched: ${p}`));
+}
+function loadConfig(configPath) {
+  const filePath = configPath ?? findConfigFile();
+  if (!existsSync3(filePath)) {
+    throw new ConfigError(`Config file not found: ${filePath}`);
+  }
+  let raw;
+  try {
+    raw = readFileSync2(filePath, "utf-8");
+  } catch (err) {
+    throw new ConfigError(`Failed to read config file: ${filePath}`, [
+      `  ${err.message}`
+    ]);
+  }
+  let parsed;
+  try {
+    parsed = $parse(raw);
+  } catch (err) {
+    throw new ConfigError(`Invalid YAML in ${filePath}`, [
+      `  ${err.message}`
+    ]);
+  }
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.clerk !== undefined && parsed.switchroom === undefined) {
+    const obj = parsed;
+    obj.switchroom = obj.clerk;
+    delete obj.clerk;
+  }
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    coerceLegacyGoogleWorkspaceKeys(parsed, filePath);
+  }
+  let config;
+  try {
+    config = SwitchroomConfigSchema.parse(parsed);
+  } catch (err) {
+    if (err instanceof ZodError) {
+      throw new ConfigError("Invalid switchroom.yaml configuration", formatZodErrors(err));
+    }
+    throw err;
+  }
+  applyAgentOverlays(config);
+  validateAllCronTopicAliases(config, filePath);
+  return config;
+}
+function validateAllCronTopicAliases(config, filePath) {
+  const issues = [];
+  for (const [agentName, agentRaw] of Object.entries(config.agents)) {
+    if (!agentRaw)
+      continue;
+    const resolved = resolveAgentConfig(config.defaults, config.profiles, agentRaw);
+    const schedule = resolved.schedule ?? [];
+    if (schedule.length === 0)
+      continue;
+    const tg = resolved.channels?.telegram;
+    const aliases = new Set(Object.keys(tg?.topic_aliases ?? {}));
+    for (const entry of schedule) {
+      if (entry.topic == null)
+        continue;
+      if (typeof entry.topic === "number")
+        continue;
+      if (!aliases.has(entry.topic)) {
+        issues.push(`  agents.${agentName}.schedule cron \`${entry.cron}\`: ` + `topic alias "${entry.topic}" is not defined in ` + `channels.telegram.topic_aliases.`);
+      }
+    }
+  }
+  if (issues.length > 0) {
+    throw new ConfigError(`Cron \`topic:\` alias references unknown topic_aliases in ${filePath}`, issues);
+  }
+}
+function resolveAgentsDir(config) {
+  const override = process.env.SWITCHROOM_AGENTS_DIR;
+  if (override && override.length > 0 && override.startsWith("/")) {
+    return override;
+  }
+  return resolveDualPath(config.switchroom.agents_dir);
+}
+
+// src/auth/broker/server.ts
+import * as net from "node:net";
+import {
+  chmodSync,
+  chownSync as chownSync2,
+  existsSync as existsSync6,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  renameSync as renameSync3,
+  rmSync as rmSync4,
+  statSync as statSync4,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, writeSync as writeSync2 } from "node:fs";
+import * as constants2 from "node:constants";
+import { createHash as createHash2 } from "node:crypto";
+import { dirname as dirname2, join as join3, resolve as resolve6 } from "node:path";
+
+// src/agents/compose.ts
+import { createHash } from "node:crypto";
+
 // src/vault/broker/peercred.ts
 var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
 function isReservedAgentName(name) {
@@ -12552,6 +12672,202 @@ function classifyAsyncError(err) {
   return { ok: false, kind: "provider_error", detail: msg };
 }
 
+// src/microsoft/oauth.ts
+var MICROSOFT_OAUTH_BASE = "https://login.microsoftonline.com/common/oauth2/v2.0";
+var PERSONAL_MSA_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
+
+class MicrosoftInvalidGrantError extends Error {
+  detail;
+  constructor(detail) {
+    super(`invalid_grant: ${detail}`);
+    this.detail = detail;
+    this.name = "MicrosoftInvalidGrantError";
+  }
+}
+async function refreshMicrosoftAccessToken(cfg, refreshToken, fetchImpl = fetch) {
+  const body = new URLSearchParams({
+    client_id: cfg.client_id,
+    refresh_token: refreshToken,
+    grant_type: "refresh_token"
+  });
+  if (cfg.client_secret !== undefined && cfg.client_secret.length > 0) {
+    body.set("client_secret", cfg.client_secret);
+  }
+  if (cfg.scopes && cfg.scopes.length > 0) {
+    body.set("scope", cfg.scopes.join(" "));
+  }
+  const res = await fetchImpl(`${MICROSOFT_OAUTH_BASE}/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  const json = await res.json();
+  if (!res.ok) {
+    if (typeof json.error === "string" && json.error === "invalid_grant") {
+      throw new MicrosoftInvalidGrantError(typeof json.error_description === "string" ? json.error_description : "refresh token rejected by Microsoft");
+    }
+    throw new Error(`refresh failed (${res.status}): ${JSON.stringify(json)}`);
+  }
+  return json;
+}
+function decodeJwtPayloadUnsafe(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    return null;
+  try {
+    const padded = parts[1] + "===".slice((parts[1].length + 3) % 4);
+    const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+    const buf = Buffer.from(base64, "base64");
+    const json = JSON.parse(buf.toString("utf-8"));
+    if (json && typeof json === "object") {
+      return json;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function classifyAccountType(tenantId) {
+  return tenantId === PERSONAL_MSA_TENANT_ID ? "personal" : "work";
+}
+
+// src/auth/broker/microsoft-provider.ts
+class MicrosoftProvider {
+  opts;
+  name = "microsoft";
+  constructor(opts) {
+    this.opts = opts;
+  }
+  async refresh(req) {
+    if (!req.refreshToken) {
+      return {
+        ok: false,
+        kind: "provider_error",
+        detail: "MicrosoftProvider.refresh: refreshToken is required"
+      };
+    }
+    const cfg = {
+      client_id: this.opts.clientId,
+      client_secret: this.opts.clientSecret,
+      scopes: []
+    };
+    let token;
+    try {
+      token = await refreshMicrosoftAccessToken(cfg, req.refreshToken, this.opts.fetcher ?? fetch);
+    } catch (err) {
+      if (err instanceof MicrosoftInvalidGrantError) {
+        return {
+          ok: false,
+          kind: "invalid_grant",
+          detail: err.message
+        };
+      }
+      return classifyAsyncError2(err);
+    }
+    const expiresAt = Date.now() + token.expires_in * 1000;
+    const prior = req.priorCredentials?.microsoftOauth;
+    let tenantId = prior?.tenantId ?? "";
+    let accountType = prior?.accountType ?? "work";
+    let homeAccountId = prior?.homeAccountId ?? "";
+    let accountEmail = req.accountEmail ?? prior?.accountEmail ?? "";
+    if (token.id_token) {
+      const claims = decodeJwtPayloadUnsafe(token.id_token);
+      if (claims) {
+        if (typeof claims.tid === "string")
+          tenantId = claims.tid;
+        if (tenantId)
+          accountType = classifyAccountType(tenantId);
+        if (typeof claims.oid === "string" && typeof claims.tid === "string") {
+          homeAccountId = `${claims.oid}.${claims.tid}`;
+        }
+        if (typeof claims.preferred_username === "string") {
+          accountEmail = claims.preferred_username;
+        } else if (typeof claims.email === "string") {
+          accountEmail = claims.email;
+        }
+      }
+    }
+    const rawCredentials = {
+      microsoftOauth: {
+        accessToken: token.access_token,
+        refreshToken: token.refresh_token ?? req.refreshToken,
+        expiresAt,
+        scope: token.scope ?? "",
+        clientId: this.opts.clientId,
+        accountEmail,
+        tokenType: "Bearer",
+        tenantId,
+        accountType,
+        homeAccountId
+      }
+    };
+    return {
+      ok: true,
+      accessToken: token.access_token,
+      expiresAt,
+      newRefreshToken: token.refresh_token,
+      rawCredentials
+    };
+  }
+  extractExpiresAt(credentials) {
+    const c = credentials;
+    return c?.microsoftOauth?.expiresAt;
+  }
+  validateCredentialShape(credentials) {
+    if (!credentials || typeof credentials !== "object") {
+      return "Microsoft credentials must be an object";
+    }
+    const c = credentials;
+    if (!c.microsoftOauth || typeof c.microsoftOauth !== "object") {
+      return "Microsoft credentials must have a microsoftOauth object";
+    }
+    const oauth = c.microsoftOauth;
+    const required = [
+      "accessToken",
+      "refreshToken",
+      "expiresAt",
+      "scope",
+      "clientId",
+      "accountEmail",
+      "tenantId",
+      "accountType",
+      "homeAccountId"
+    ];
+    for (const field of required) {
+      if (oauth[field] === undefined || oauth[field] === null) {
+        return `Microsoft microsoftOauth.${field} is required`;
+      }
+    }
+    if (typeof oauth.accessToken !== "string" || oauth.accessToken.length === 0) {
+      return "Microsoft microsoftOauth.accessToken must be a non-empty string";
+    }
+    if (typeof oauth.refreshToken !== "string" || oauth.refreshToken.length === 0) {
+      return "Microsoft microsoftOauth.refreshToken must be a non-empty string";
+    }
+    if (typeof oauth.expiresAt !== "number" || oauth.expiresAt <= 0) {
+      return "Microsoft microsoftOauth.expiresAt must be a positive unix-ms timestamp";
+    }
+    if (oauth.tokenType !== "Bearer") {
+      return "Microsoft microsoftOauth.tokenType must be 'Bearer'";
+    }
+    if (oauth.accountType !== "personal" && oauth.accountType !== "work") {
+      return "Microsoft microsoftOauth.accountType must be 'personal' or 'work'";
+    }
+    return null;
+  }
+}
+function classifyAsyncError2(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const lower = msg.toLowerCase();
+  if (lower.includes("etimedout") || lower.includes("econnreset") || lower.includes("network") || lower.includes("fetch failed") || lower.includes("getaddrinfo")) {
+    return { ok: false, kind: "network", detail: msg };
+  }
+  if (lower.includes("429") || lower.includes("rate") || lower.includes("quota") || lower.includes("too many requests") || lower.includes("aadsts50196")) {
+    return { ok: false, kind: "quota_exceeded", detail: msg };
+  }
+  return { ok: false, kind: "provider_error", detail: msg };
+}
+
 // src/auth/broker/google-storage.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync as readdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, statSync as statSync3 } from "node:fs";
 import { dirname, join as join2, resolve as resolve5 } from "node:path";
@@ -12694,7 +13010,7 @@ function validateConsumerNames(config) {
 // src/auth/broker/protocol.ts
 var MAX_FRAME_BYTES = 64 * 1024;
 var PROTOCOL_VERSION = 1;
-var ProviderNameSchema = exports_external.enum(["anthropic", "google"]);
+var ProviderNameSchema = exports_external.enum(["anthropic", "google", "microsoft"]);
 var GetCredentialsRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
   op: exports_external.literal("get-credentials"),
@@ -12747,9 +13063,24 @@ var GoogleCredentialsSchema = exports_external.object({
     tokenType: exports_external.literal("Bearer")
   })
 });
+var MicrosoftCredentialsSchema = exports_external.object({
+  microsoftOauth: exports_external.object({
+    accessToken: exports_external.string(),
+    refreshToken: exports_external.string(),
+    expiresAt: exports_external.number(),
+    scope: exports_external.string(),
+    clientId: exports_external.string(),
+    accountEmail: exports_external.string(),
+    tokenType: exports_external.literal("Bearer"),
+    tenantId: exports_external.string(),
+    accountType: exports_external.enum(["personal", "work"]),
+    homeAccountId: exports_external.string()
+  })
+});
 var ProviderCredentialsSchema = exports_external.union([
   AnthropicCredentialsSchema,
-  GoogleCredentialsSchema
+  GoogleCredentialsSchema,
+  MicrosoftCredentialsSchema
 ]);
 var AddAccountRequestSchema = exports_external.object({
   v: exports_external.literal(PROTOCOL_VERSION),
@@ -13001,6 +13332,14 @@ class AuthBroker {
         fetcher: opts.fetcher
       }));
     }
+    const microsoftClientId = config.microsoft_workspace?.microsoft_client_id;
+    if (microsoftClientId !== undefined) {
+      this.providers.register(new MicrosoftProvider({
+        clientId: microsoftClientId,
+        clientSecret: config.microsoft_workspace?.microsoft_client_secret,
+        fetcher: opts.fetcher
+      }));
+    }
     this.assertConfigConsistent(config);
   }
   homeRoot() {