@vellumai/assistant 0.4.41 → 0.4.43

package/src/config/bundled-skills/sms-setup/SKILL.md

@@ -1,210 +0,0 @@
----
-name: "SMS Setup"
-description: "Set up and troubleshoot SMS messaging with guided Twilio configuration, compliance, and verification"
-user-invocable: true
-metadata: { "vellum": { "emoji": "\ud83d\udce8" } }
----
-
-You are helping your user set up SMS messaging. This skill orchestrates Twilio setup, SMS-specific compliance, and end-to-end testing through a conversational flow.
-
-## Step 1: Check Channel Readiness
-
-First, check the current SMS channel readiness state via Vellum CLI:
-
-```bash
-assistant integrations twilio config --json
-```
-
-Inspect the response for `hasCredentials` and `phoneNumber`.
-
-- If both are present and all baseline requirements are met, skip to Step 3.
-- If credentials or phone number are missing, proceed to Step 2 to fix the baseline.
-
-## Step 2: Establish Baseline (Twilio Setup)
-
-If SMS baseline is not ready (missing credentials, phone number, or ingress), load the `twilio-setup` skill to walk the user through the basics:
-
-```
-skill_load skill=twilio-setup
-```
-
-Tell the user: _"SMS needs Twilio configured first. I've loaded the Twilio setup guide — let's walk through it."_
-
-After twilio-setup completes, re-check readiness:
-
-```bash
-assistant integrations twilio config --json
-```
-
-If baseline is still not ready, report the specific failures and ask the user to address them before continuing.
-
-## Step 3: Remote Compliance Check
-
-Once baseline is ready, check SMS compliance status including remote (Twilio API) checks:
-
-```bash
-assistant integrations twilio sms compliance --json
-```
-
-Examine the compliance results:
-
-- If all checks pass, proceed to Step 4.
-- If compliance issues are found (e.g., toll-free verification needed), guide the user through the compliance flow.
-
-### Toll-Free Verification Submission
-
-When the compliance check returns a toll-free verification requirement, use the gateway's compliance endpoints. These handle credential lookup, phone number SID resolution, field validation, and Twilio API calls internally.
-
-**Step 3a: Check compliance status.** First check if a verification already exists (use the response from the compliance check above):
-
-The response includes a `compliance` object with `numberType`, `tollfreePhoneNumberSid`, `verificationSid`, `verificationStatus`, `rejectionReason`, `rejectionReasons`, `editAllowed`, and `editExpiration` fields. For toll-free numbers, `tollfreePhoneNumberSid` contains the Twilio phone number SID needed for verification submission.
-
-- If `verificationStatus` is `PENDING_REVIEW` or `IN_REVIEW`, tell the user verification is already in progress and skip submission.
-- If `verificationStatus` is `TWILIO_APPROVED`, compliance is complete — proceed to Step 4.
-- If `verificationStatus` is `TWILIO_REJECTED` and `editAllowed` is true, offer to update the existing verification (Step 3d) instead of resubmitting.
-- If no verification exists (`verificationSid` is absent), proceed to collect information and submit.
-
-**Step 3b: Collect user information.** Collect the following from the user (assume individual/sole proprietor by default):
-
-| Field              | `verificationParams` key  | Notes                                                                                                                                 |
-| ------------------ | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Name               | `businessName`            | Can be personal name                                                                                                                  |
-| Business type      | `businessType`            | Use `SOLE_PROPRIETOR` for individuals. Valid values: `PRIVATE_PROFIT`, `PUBLIC_PROFIT`, `SOLE_PROPRIETOR`, `NON_PROFIT`, `GOVERNMENT` |
-| Website            | `businessWebsite`         | LinkedIn or personal site is fine                                                                                                     |
-| Notification email | `notificationEmail`       | Where Twilio sends status updates                                                                                                     |
-| Use case category  | `useCaseCategories`       | Array, e.g. `["ACCOUNT_NOTIFICATIONS"]`                                                                                               |
-| Use case summary   | `useCaseSummary`          | Plain English description                                                                                                             |
-| Message volume     | `messageVolume`           | Must be one of: `10`, `100`, `1,000`, `10,000`, `100,000`, `250,000`, `500,000`, `750,000`, `1,000,000`, `5,000,000`, `10,000,000+`   |
-| Sample message     | `productionMessageSample` | A realistic example message                                                                                                           |
-| Opt-in type        | `optInType`               | `VERBAL`, `WEB_FORM`, `PAPER_FORM`, `VIA_TEXT`, `MOBILE_QR_CODE`                                                                      |
-| Opt-in image URL   | `optInImageUrls`          | Array of URLs showing opt-in mechanism (can be website URL)                                                                           |
-
-The `tollfreePhoneNumberSid` is returned by the compliance status response in the `compliance` object. Use `compliance.tollfreePhoneNumberSid` from the Step 3a response as the value for `tollfreePhoneNumberSid` when submitting. Do NOT ask for EIN, business registration number, or business registration authority. Explain that Twilio labels some fields as "business" fields even for individual submitters.
-
-**Step 3c: Submit verification:**
-
-```bash
-curl -s -X POST "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/twilio/sms/compliance/tollfree" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "tollfreePhoneNumberSid": "<compliance.tollfreePhoneNumberSid from Step 3a>",
-    "businessName": "...",
-    "businessWebsite": "...",
-    "notificationEmail": "...",
-    "useCaseCategories": ["ACCOUNT_NOTIFICATIONS"],
-    "useCaseSummary": "...",
-    "productionMessageSample": "...",
-    "optInImageUrls": ["..."],
-    "optInType": "VERBAL",
-    "messageVolume": "100",
-    "businessType": "SOLE_PROPRIETOR"
-  }'
-```
-
-The endpoint validates all fields before submitting to Twilio and returns clear error messages for invalid values.
-
-**On success:** The response contains `compliance.verificationSid` and `compliance.verificationStatus` (typically `PENDING_REVIEW`). Tell the user Twilio typically reviews within 1-5 business days.
-
-**On failure:** Report the exact error from the response and guide the user through resolution.
-
-**Step 3d: Update a rejected verification** (if `editAllowed` is true):
-
-```bash
-curl -s -X PATCH "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/twilio/sms/compliance/tollfree/<verificationSid>" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "businessName": "updated value",
-    "useCaseSummary": "updated value"
-  }'
-```
-
-Only include fields that need to change. The endpoint checks edit eligibility and expiration before attempting the update.
-
-**Step 3e: Delete and resubmit** (if editing is not allowed):
-
-```bash
-curl -s -X DELETE "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/twilio/sms/compliance/tollfree/<verificationSid>" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN"
-```
-
-After deletion, return to Step 3b to collect information and resubmit. Warn the user that deleting resets their position in the review queue.
-
-**Common errors:**
-
-- `"Customer profiles submitted with verifications must be either ISV Starters or Secondary Customer Profiles"` — The number is linked to a Primary Customer Profile in Trust Hub, which blocks toll-free verification. Tell the user and suggest they resolve the profile assignment in the Twilio Console.
-- Missing required fields — The endpoint validates and reports which fields are missing.
-- Invalid enum values — The endpoint validates `optInType`, `messageVolume`, and `useCaseCategories` and reports valid values.
-
-**On success:** Tell the user the verification has been submitted and is now `PENDING_REVIEW`. Twilio typically reviews within 1-5 business days. They'll receive status updates at the notification email provided.
-
-**On failure:** Report the exact error message and guide the user through resolution.
-
-## Step 4: Test Send
-
-Run a test SMS to verify end-to-end delivery:
-
-Tell the user: _"Let's send a test SMS to verify everything works. What phone number should I send the test to?"_
-
-**Important:** If toll-free verification is pending (not yet approved), inform the user that test messages may be silently dropped by carriers even though Twilio accepts them. Offer to attempt the test anyway, but set expectations.
-
-**Trial account limitation:** On Twilio trial accounts, SMS can only be sent to verified phone numbers. If the send fails with a "not verified" error, tell the user to verify the recipient number in the Twilio Console under Verified Caller IDs, or upgrade their account.
-
-After the user provides a number, send a test message via the gateway:
-
-```bash
-curl -s -X POST "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/twilio/sms/test" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"phoneNumber":"<recipient phone number>","text":"Test SMS from your Vellum assistant."}'
-```
-
-Report the result honestly:
-
-- If the send succeeds: _"The message was accepted by Twilio. Note: 'accepted' means Twilio received it for delivery, not that it reached the handset yet. Delivery can take a few seconds to a few minutes. If verification is still pending, carriers may silently drop the message."_
-- If the send fails: report the error and suggest troubleshooting steps
-
-### SMS Diagnostics
-
-If the test fails or the user reports SMS issues, run the SMS doctor:
-
-```bash
-curl -s -X POST "$INTERNAL_GATEWAY_BASE_URL/v1/integrations/twilio/sms/doctor" \
-  -H "Authorization: Bearer $GATEWAY_AUTH_TOKEN"
-```
-
-This runs a comprehensive health diagnostic, checking channel readiness, compliance/toll-free verification status, and the last test result. Report the diagnostics and actionable items to the user.
-
-## Step 5: Final Status Report
-
-After completing (or skipping) the test, present a clear summary:
-
-**If everything passed:**
-_"SMS is ready! Here's your setup status:"_
-
-- Twilio credentials: configured
-- Phone number: {number}
-- Ingress: configured
-- Compliance: {status}
-- Test send: {result}
-
-**If there are blockers:**
-_"SMS setup is partially complete. Here's what still needs attention:"_
-
-- List each blocker with the specific next action
-
-## Troubleshooting
-
-If the user returns to this skill after initial setup:
-
-1. Always start with Step 1 (readiness check) to assess current state
-2. Skip steps that are already complete
-3. Focus on the specific issue the user is experiencing
-
-Common issues:
-
-- **"Messages not delivering"** — Check compliance status (toll-free verification), verify the number isn't flagged
-- **"Twilio error on send"** — Check credentials, phone number assignment, and ingress
-- **"Trial account limitations"** — Explain that trial accounts can only send to verified numbers
-- **"Customer profiles must be ISV Starters or Secondary"** — The toll-free number is linked to a Primary Customer Profile in Trust Hub. Must be unlinked or reassigned before verification can be submitted.

package/src/config/core-schema.ts

@@ -1,434 +0,0 @@
-import { z } from "zod";
-
-const VALID_SECRET_ACTIONS = ["redact", "warn", "block", "prompt"] as const;
-const VALID_PERMISSIONS_MODES = ["strict", "workspace"] as const;
-const VALID_SMS_PROVIDERS = ["twilio"] as const;
-
-export const TimeoutConfigSchema = z.object({
-  shellMaxTimeoutSec: z
-    .number({ error: "timeouts.shellMaxTimeoutSec must be a number" })
-    .finite("timeouts.shellMaxTimeoutSec must be finite")
-    .positive("timeouts.shellMaxTimeoutSec must be a positive number")
-    .default(600),
-  shellDefaultTimeoutSec: z
-    .number({ error: "timeouts.shellDefaultTimeoutSec must be a number" })
-    .finite("timeouts.shellDefaultTimeoutSec must be finite")
-    .positive("timeouts.shellDefaultTimeoutSec must be a positive number")
-    .default(120),
-  permissionTimeoutSec: z
-    .number({ error: "timeouts.permissionTimeoutSec must be a number" })
-    .finite("timeouts.permissionTimeoutSec must be finite")
-    .positive("timeouts.permissionTimeoutSec must be a positive number")
-    .default(300),
-  toolExecutionTimeoutSec: z
-    .number({ error: "timeouts.toolExecutionTimeoutSec must be a number" })
-    .finite("timeouts.toolExecutionTimeoutSec must be finite")
-    .positive("timeouts.toolExecutionTimeoutSec must be a positive number")
-    .default(120),
-  providerStreamTimeoutSec: z
-    .number({ error: "timeouts.providerStreamTimeoutSec must be a number" })
-    .finite("timeouts.providerStreamTimeoutSec must be finite")
-    .positive("timeouts.providerStreamTimeoutSec must be a positive number")
-    .default(300),
-});
-
-export const RateLimitConfigSchema = z.object({
-  maxRequestsPerMinute: z
-    .number({ error: "rateLimit.maxRequestsPerMinute must be a number" })
-    .int("rateLimit.maxRequestsPerMinute must be an integer")
-    .nonnegative(
-      "rateLimit.maxRequestsPerMinute must be a non-negative integer",
-    )
-    .default(0),
-  maxTokensPerSession: z
-    .number({ error: "rateLimit.maxTokensPerSession must be a number" })
-    .int("rateLimit.maxTokensPerSession must be an integer")
-    .nonnegative("rateLimit.maxTokensPerSession must be a non-negative integer")
-    .default(0),
-});
-
-export const CustomSecretPatternSchema = z.object({
-  label: z.string({
-    error: "secretDetection.customPatterns[].label must be a string",
-  }),
-  pattern: z.string({
-    error: "secretDetection.customPatterns[].pattern must be a string",
-  }),
-});
-
-export const SecretDetectionConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "secretDetection.enabled must be a boolean" })
-    .default(true),
-  action: z
-    .enum(VALID_SECRET_ACTIONS, {
-      error: `secretDetection.action must be one of: ${VALID_SECRET_ACTIONS.join(
-        ", ",
-      )}`,
-    })
-    .default("redact"),
-  entropyThreshold: z
-    .number({ error: "secretDetection.entropyThreshold must be a number" })
-    .finite("secretDetection.entropyThreshold must be finite")
-    .positive("secretDetection.entropyThreshold must be a positive number")
-    .default(4.0),
-  allowOneTimeSend: z
-    .boolean({ error: "secretDetection.allowOneTimeSend must be a boolean" })
-    .default(false),
-  blockIngress: z
-    .boolean({ error: "secretDetection.blockIngress must be a boolean" })
-    .default(true),
-  customPatterns: z.array(CustomSecretPatternSchema).optional(),
-});
-
-export const PermissionsConfigSchema = z.object({
-  mode: z
-    .enum(VALID_PERMISSIONS_MODES, {
-      error: `permissions.mode must be one of: ${VALID_PERMISSIONS_MODES.join(
-        ", ",
-      )}`,
-    })
-    .default("workspace"),
-});
-
-export const AuditLogConfigSchema = z.object({
-  retentionDays: z
-    .number({ error: "auditLog.retentionDays must be a number" })
-    .int("auditLog.retentionDays must be an integer")
-    .nonnegative("auditLog.retentionDays must be a non-negative integer")
-    .default(0),
-});
-
-export const LogFileConfigSchema = z.object({
-  dir: z.string({ error: "logFile.dir must be a string" }).optional(),
-  retentionDays: z
-    .number({ error: "logFile.retentionDays must be a number" })
-    .int("logFile.retentionDays must be an integer")
-    .positive("logFile.retentionDays must be a positive integer")
-    .default(30),
-});
-
-export const ThinkingConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "thinking.enabled must be a boolean" })
-    .default(false),
-  streamThinking: z
-    .boolean({ error: "thinking.streamThinking must be a boolean" })
-    .default(false),
-});
-
-export const EffortSchema = z
-  .enum(["low", "medium", "high"], {
-    error: 'effort must be "low", "medium", or "high"',
-  })
-  .default("high");
-
-export type Effort = z.infer<typeof EffortSchema>;
-
-const VALID_LATEST_TURN_COMPRESSION_POLICIES = [
-  "truncate",
-  "summarize",
-  "drop",
-] as const;
-
-export const ContextOverflowRecoveryConfigSchema = z.object({
-  enabled: z
-    .boolean({
-      error: "contextWindow.overflowRecovery.enabled must be a boolean",
-    })
-    .default(true),
-  safetyMarginRatio: z
-    .number({
-      error:
-        "contextWindow.overflowRecovery.safetyMarginRatio must be a number",
-    })
-    .finite("contextWindow.overflowRecovery.safetyMarginRatio must be finite")
-    .gt(
-      0,
-      "contextWindow.overflowRecovery.safetyMarginRatio must be greater than 0",
-    )
-    .lt(
-      1,
-      "contextWindow.overflowRecovery.safetyMarginRatio must be less than 1",
-    )
-    .default(0.05),
-  maxAttempts: z
-    .number({
-      error: "contextWindow.overflowRecovery.maxAttempts must be a number",
-    })
-    .int("contextWindow.overflowRecovery.maxAttempts must be an integer")
-    .positive(
-      "contextWindow.overflowRecovery.maxAttempts must be a positive integer",
-    )
-    .default(3),
-  interactiveLatestTurnCompression: z
-    .enum(VALID_LATEST_TURN_COMPRESSION_POLICIES, {
-      error: `contextWindow.overflowRecovery.interactiveLatestTurnCompression must be one of: ${VALID_LATEST_TURN_COMPRESSION_POLICIES.join(
-        ", ",
-      )}`,
-    })
-    .default("summarize"),
-  nonInteractiveLatestTurnCompression: z
-    .enum(VALID_LATEST_TURN_COMPRESSION_POLICIES, {
-      error: `contextWindow.overflowRecovery.nonInteractiveLatestTurnCompression must be one of: ${VALID_LATEST_TURN_COMPRESSION_POLICIES.join(
-        ", ",
-      )}`,
-    })
-    .default("truncate"),
-});
-
-export const ContextWindowConfigSchema = z.object({
-  enabled: z
-    .boolean({ error: "contextWindow.enabled must be a boolean" })
-    .default(true),
-  maxInputTokens: z
-    .number({ error: "contextWindow.maxInputTokens must be a number" })
-    .int("contextWindow.maxInputTokens must be an integer")
-    .positive("contextWindow.maxInputTokens must be a positive integer")
-    .default(200000),
-  targetInputTokens: z
-    .number({ error: "contextWindow.targetInputTokens must be a number" })
-    .int("contextWindow.targetInputTokens must be an integer")
-    .positive("contextWindow.targetInputTokens must be a positive integer")
-    .default(110000),
-  compactThreshold: z
-    .number({ error: "contextWindow.compactThreshold must be a number" })
-    .finite("contextWindow.compactThreshold must be finite")
-    .gt(0, "contextWindow.compactThreshold must be greater than 0")
-    .lte(1, "contextWindow.compactThreshold must be less than or equal to 1")
-    .default(0.8),
-  preserveRecentUserTurns: z
-    .number({ error: "contextWindow.preserveRecentUserTurns must be a number" })
-    .int("contextWindow.preserveRecentUserTurns must be an integer")
-    .positive(
-      "contextWindow.preserveRecentUserTurns must be a positive integer",
-    )
-    .default(8),
-  summaryMaxTokens: z
-    .number({ error: "contextWindow.summaryMaxTokens must be a number" })
-    .int("contextWindow.summaryMaxTokens must be an integer")
-    .positive("contextWindow.summaryMaxTokens must be a positive integer")
-    .default(1200),
-  chunkTokens: z
-    .number({ error: "contextWindow.chunkTokens must be a number" })
-    .int("contextWindow.chunkTokens must be an integer")
-    .positive("contextWindow.chunkTokens must be a positive integer")
-    .default(12000),
-  overflowRecovery: ContextOverflowRecoveryConfigSchema.default(
-    ContextOverflowRecoveryConfigSchema.parse({}),
-  ),
-});
-
-export const ModelPricingOverrideSchema = z.object({
-  provider: z.string({ error: "pricingOverrides[].provider must be a string" }),
-  modelPattern: z.string({
-    error: "pricingOverrides[].modelPattern must be a string",
-  }),
-  inputPer1M: z
-    .number({ error: "pricingOverrides[].inputPer1M must be a number" })
-    .nonnegative("pricingOverrides[].inputPer1M must be a non-negative number"),
-  outputPer1M: z
-    .number({ error: "pricingOverrides[].outputPer1M must be a number" })
-    .nonnegative(
-      "pricingOverrides[].outputPer1M must be a non-negative number",
-    ),
-});
-
-export const TwilioConfigSchema = z.object({
-  accountSid: z
-    .string({ error: "twilio.accountSid must be a string" })
-    .default(""),
-  phoneNumber: z
-    .string({ error: "twilio.phoneNumber must be a string" })
-    .default(""),
-});
-
-export const SmsConfigSchema = z.object({
-  enabled: z.boolean({ error: "sms.enabled must be a boolean" }).default(false),
-  provider: z
-    .enum(VALID_SMS_PROVIDERS, {
-      error: `sms.provider must be one of: ${VALID_SMS_PROVIDERS.join(", ")}`,
-    })
-    .default("twilio"),
-  phoneNumber: z
-    .string({ error: "sms.phoneNumber must be a string" })
-    .default(""),
-  assistantPhoneNumbers: z
-    .record(
-      z.string(),
-      z.string({ error: "sms.assistantPhoneNumbers values must be strings" }),
-    )
-    .optional(),
-});
-
-export const WhatsAppConfigSchema = z.object({
-  phoneNumber: z
-    .string({ error: "whatsapp.phoneNumber must be a string" })
-    .default(""),
-});
-
-export const IngressWebhookConfigSchema = z.object({
-  secret: z
-    .string({ error: "ingress.webhook.secret must be a string" })
-    .default(""),
-  timeoutMs: z
-    .number({ error: "ingress.webhook.timeoutMs must be a number" })
-    .int("ingress.webhook.timeoutMs must be an integer")
-    .positive("ingress.webhook.timeoutMs must be a positive integer")
-    .default(30_000),
-  maxRetries: z
-    .number({ error: "ingress.webhook.maxRetries must be a number" })
-    .int("ingress.webhook.maxRetries must be an integer")
-    .nonnegative("ingress.webhook.maxRetries must be a non-negative integer")
-    .default(2),
-  initialBackoffMs: z
-    .number({ error: "ingress.webhook.initialBackoffMs must be a number" })
-    .int("ingress.webhook.initialBackoffMs must be an integer")
-    .positive("ingress.webhook.initialBackoffMs must be a positive integer")
-    .default(500),
-  maxPayloadBytes: z
-    .number({ error: "ingress.webhook.maxPayloadBytes must be a number" })
-    .int("ingress.webhook.maxPayloadBytes must be an integer")
-    .positive("ingress.webhook.maxPayloadBytes must be a positive integer")
-    .default(1_048_576),
-});
-
-export const IngressRateLimitConfigSchema = z.object({
-  maxRequestsPerMinute: z
-    .number({
-      error: "ingress.rateLimit.maxRequestsPerMinute must be a number",
-    })
-    .int("ingress.rateLimit.maxRequestsPerMinute must be an integer")
-    .nonnegative(
-      "ingress.rateLimit.maxRequestsPerMinute must be a non-negative integer",
-    )
-    .default(0),
-  maxRequestsPerHour: z
-    .number({ error: "ingress.rateLimit.maxRequestsPerHour must be a number" })
-    .int("ingress.rateLimit.maxRequestsPerHour must be an integer")
-    .nonnegative(
-      "ingress.rateLimit.maxRequestsPerHour must be a non-negative integer",
-    )
-    .default(0),
-});
-
-const IngressBaseSchema = z.object({
-  enabled: z.boolean({ error: "ingress.enabled must be a boolean" }).optional(),
-  publicBaseUrl: z
-    .string({ error: "ingress.publicBaseUrl must be a string" })
-    .refine(
-      (val) => val === "" || /^https?:\/\//i.test(val),
-      "ingress.publicBaseUrl must be an absolute URL starting with http:// or https://",
-    )
-    .default(""),
-  webhook: IngressWebhookConfigSchema.default(
-    IngressWebhookConfigSchema.parse({}),
-  ),
-  rateLimit: IngressRateLimitConfigSchema.default(
-    IngressRateLimitConfigSchema.parse({}),
-  ),
-  shutdownDrainMs: z
-    .number({ error: "ingress.shutdownDrainMs must be a number" })
-    .int("ingress.shutdownDrainMs must be an integer")
-    .nonnegative("ingress.shutdownDrainMs must be a non-negative integer")
-    .default(5_000),
-});
-
-export const IngressConfigSchema = IngressBaseSchema.default(
-  IngressBaseSchema.parse({}),
-).transform((val) => ({
-  ...val,
-  // Backward compatibility: if `enabled` was never explicitly set (undefined),
-  // infer it from whether a publicBaseUrl is configured. Existing users who
-  // have a URL but predate the `enabled` field should not have their webhooks
-  // silently disabled on upgrade.
-  //
-  // When publicBaseUrl is empty and enabled is unset, leave enabled as
-  // undefined so getPublicBaseUrl() can still fall through to the
-  // INGRESS_PUBLIC_BASE_URL env-var fallback (env-only setups).
-  enabled: val.enabled ?? (val.publicBaseUrl ? true : undefined),
-}));
-
-export const VALID_AVATAR_STRATEGIES = [
-  "managed_required",
-  "managed_prefer",
-  "local_only",
-] as const;
-
-export const AvatarConfigSchema = z.object({
-  generationStrategy: z
-    .enum(VALID_AVATAR_STRATEGIES, {
-      error: `avatar.generationStrategy must be one of: ${VALID_AVATAR_STRATEGIES.join(", ")}`,
-    })
-    .default("local_only"),
-});
-
-export type AvatarConfig = z.infer<typeof AvatarConfigSchema>;
-
-export const PlatformConfigSchema = z.object({
-  baseUrl: z
-    .string({ error: "platform.baseUrl must be a string" })
-    .refine(
-      (val) => val === "" || /^https?:\/\//i.test(val),
-      "platform.baseUrl must be an absolute URL starting with http:// or https://",
-    )
-    .default(""),
-});
-
-export type PlatformConfig = z.infer<typeof PlatformConfigSchema>;
-
-export const DaemonConfigSchema = z.object({
-  startupSocketWaitMs: z
-    .number({ error: "daemon.startupSocketWaitMs must be a number" })
-    .int("daemon.startupSocketWaitMs must be an integer")
-    .positive("daemon.startupSocketWaitMs must be a positive integer")
-    .default(5000),
-  stopTimeoutMs: z
-    .number({ error: "daemon.stopTimeoutMs must be a number" })
-    .int("daemon.stopTimeoutMs must be an integer")
-    .positive("daemon.stopTimeoutMs must be a positive integer")
-    .default(5000),
-  sigkillGracePeriodMs: z
-    .number({ error: "daemon.sigkillGracePeriodMs must be a number" })
-    .int("daemon.sigkillGracePeriodMs must be an integer")
-    .positive("daemon.sigkillGracePeriodMs must be a positive integer")
-    .default(2000),
-  titleGenerationMaxTokens: z
-    .number({ error: "daemon.titleGenerationMaxTokens must be a number" })
-    .int("daemon.titleGenerationMaxTokens must be an integer")
-    .positive("daemon.titleGenerationMaxTokens must be a positive integer")
-    .default(30),
-  standaloneRecording: z
-    .boolean({ error: "daemon.standaloneRecording must be a boolean" })
-    .default(true),
-});
-
-export const UiConfigSchema = z.object({
-  userTimezone: z
-    .string({ error: "ui.userTimezone must be a string" })
-    .optional(),
-});
-
-export type TimeoutConfig = z.infer<typeof TimeoutConfigSchema>;
-export type RateLimitConfig = z.infer<typeof RateLimitConfigSchema>;
-export type CustomSecretPattern = z.infer<typeof CustomSecretPatternSchema>;
-export type SecretDetectionConfig = z.infer<typeof SecretDetectionConfigSchema>;
-export type PermissionsConfig = z.infer<typeof PermissionsConfigSchema>;
-export type AuditLogConfig = z.infer<typeof AuditLogConfigSchema>;
-export type LogFileConfig = z.infer<typeof LogFileConfigSchema>;
-export type ThinkingConfig = z.infer<typeof ThinkingConfigSchema>;
-export type ContextOverflowRecoveryConfig = z.infer<
-  typeof ContextOverflowRecoveryConfigSchema
->;
-export type ContextWindowConfig = z.infer<typeof ContextWindowConfigSchema>;
-export type ModelPricingOverride = z.infer<typeof ModelPricingOverrideSchema>;
-export type TwilioConfig = z.infer<typeof TwilioConfigSchema>;
-export type SmsConfig = z.infer<typeof SmsConfigSchema>;
-export type WhatsAppConfig = z.infer<typeof WhatsAppConfigSchema>;
-export type IngressWebhookConfig = z.infer<typeof IngressWebhookConfigSchema>;
-export type IngressRateLimitConfig = z.infer<
-  typeof IngressRateLimitConfigSchema
->;
-export type DaemonConfig = z.infer<typeof DaemonConfigSchema>;
-export type IngressConfig = z.infer<typeof IngressConfigSchema>;
-export type UiConfig = z.infer<typeof UiConfigSchema>;