@vellumai/assistant 0.4.41 → 0.4.43

package/src/config/schema.ts

@@ -3,16 +3,6 @@ import { z } from "zod";
 import { getDataDir } from "../util/platform.js";
 
 // Re-export all domain schemas
-export type {
-  HeartbeatConfig,
-  SwarmConfig,
-  WorkspaceGitConfig,
-} from "./agent-schema.js";
-export {
-  HeartbeatConfigSchema,
-  SwarmConfigSchema,
-  WorkspaceGitConfigSchema,
-} from "./agent-schema.js";
 export type {
   CallerIdentityConfig,
   CallsConfig,
@@ -20,7 +10,7 @@ export type {
   CallsSafetyConfig,
   CallsVerificationConfig,
   CallsVoiceConfig,
-} from "./calls-schema.js";
+} from "./schemas/calls.js";
 export {
   CallerIdentityConfigSchema,
   CallsConfigSchema,
@@ -29,102 +19,136 @@ export {
   CallsVerificationConfigSchema,
   CallsVoiceConfigSchema,
   VALID_CALLER_IDENTITY_MODES,
-} from "./calls-schema.js";
+} from "./schemas/calls.js";
+export type {
+  SlackConfig,
+  TelegramConfig,
+  TwilioConfig,
+  WhatsAppConfig,
+} from "./schemas/channels.js";
+export {
+  SlackConfigSchema,
+  TelegramConfigSchema,
+  TwilioConfigSchema,
+  WhatsAppConfigSchema,
+} from "./schemas/channels.js";
+export type { ElevenLabsConfig } from "./schemas/elevenlabs.js";
+export {
+  DEFAULT_ELEVENLABS_VOICE_ID,
+  ElevenLabsConfigSchema,
+} from "./schemas/elevenlabs.js";
+export type { HeartbeatConfig } from "./schemas/heartbeat.js";
+export { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 export type {
-  AuditLogConfig,
-  AvatarConfig,
   ContextOverflowRecoveryConfig,
   ContextWindowConfig,
-  DaemonConfig,
   Effort,
-  IngressConfig,
-  IngressRateLimitConfig,
-  IngressWebhookConfig,
-  LogFileConfig,
   ModelPricingOverride,
-  PermissionsConfig,
-  PlatformConfig,
-  RateLimitConfig,
-  SecretDetectionConfig,
-  SmsConfig,
   ThinkingConfig,
-  TimeoutConfig,
-  TwilioConfig,
-  UiConfig,
-  WhatsAppConfig,
-} from "./core-schema.js";
+} from "./schemas/inference.js";
 export {
-  AuditLogConfigSchema,
-  AvatarConfigSchema,
   ContextOverflowRecoveryConfigSchema,
   ContextWindowConfigSchema,
-  DaemonConfigSchema,
   EffortSchema,
+  ModelPricingOverrideSchema,
+  ThinkingConfigSchema,
+} from "./schemas/inference.js";
+export type {
+  IngressConfig,
+  IngressRateLimitConfig,
+  IngressWebhookConfig,
+} from "./schemas/ingress.js";
+export {
   IngressConfigSchema,
   IngressRateLimitConfigSchema,
   IngressWebhookConfigSchema,
-  LogFileConfigSchema,
-  ModelPricingOverrideSchema,
-  PermissionsConfigSchema,
-  PlatformConfigSchema,
-  RateLimitConfigSchema,
-  SecretDetectionConfigSchema,
-  SmsConfigSchema,
-  ThinkingConfigSchema,
-  TimeoutConfigSchema,
-  TwilioConfigSchema,
-  UiConfigSchema,
-  WhatsAppConfigSchema,
-} from "./core-schema.js";
-export type { ElevenLabsConfig } from "./elevenlabs-schema.js";
+} from "./schemas/ingress.js";
+export type { AuditLogConfig, LogFileConfig } from "./schemas/logging.js";
 export {
-  DEFAULT_ELEVENLABS_VOICE_ID,
-  ElevenLabsConfigSchema,
-} from "./elevenlabs-schema.js";
-export type { McpConfig, McpServerConfig, McpTransport } from "./mcp-schema.js";
+  AuditLogConfigSchema,
+  LogFileConfigSchema,
+} from "./schemas/logging.js";
+export type {
+  McpConfig,
+  McpServerConfig,
+  McpTransport,
+} from "./schemas/mcp.js";
 export {
   McpConfigSchema,
   McpServerConfigSchema,
   McpTransportSchema,
-} from "./mcp-schema.js";
+} from "./schemas/mcp.js";
+export type { MemoryConfig } from "./schemas/memory.js";
+export { MemoryConfigSchema } from "./schemas/memory.js";
 export type {
   MemoryCleanupConfig,
-  MemoryConfig,
+  MemoryJobsConfig,
+  MemoryRetentionConfig,
+} from "./schemas/memory-lifecycle.js";
+export {
+  MemoryCleanupConfigSchema,
+  MemoryJobsConfigSchema,
+  MemoryRetentionConfigSchema,
+} from "./schemas/memory-lifecycle.js";
+export type {
   MemoryConflictsConfig,
-  MemoryEmbeddingsConfig,
   MemoryEntityConfig,
   MemoryExtractionConfig,
-  MemoryJobsConfig,
   MemoryProfileConfig,
-  MemoryRerankingConfig,
-  MemoryRetentionConfig,
-  MemoryRetrievalConfig,
-  MemorySegmentationConfig,
   MemorySummarizationConfig,
-  QdrantConfig,
-} from "./memory-schema.js";
+} from "./schemas/memory-processing.js";
 export {
-  MemoryCleanupConfigSchema,
-  MemoryConfigSchema,
   MemoryConflictsConfigSchema,
-  MemoryDynamicBudgetConfigSchema,
-  MemoryEarlyTerminationConfigSchema,
-  MemoryEmbeddingsConfigSchema,
   MemoryEntityConfigSchema,
   MemoryExtractionConfigSchema,
-  MemoryJobsConfigSchema,
   MemoryProfileConfigSchema,
+  MemorySummarizationConfigSchema,
+} from "./schemas/memory-processing.js";
+export type {
+  MemoryRerankingConfig,
+  MemoryRetrievalConfig,
+} from "./schemas/memory-retrieval.js";
+export {
+  MemoryDynamicBudgetConfigSchema,
+  MemoryEarlyTerminationConfigSchema,
   MemoryRerankingConfigSchema,
-  MemoryRetentionConfigSchema,
   MemoryRetrievalConfigSchema,
+} from "./schemas/memory-retrieval.js";
+export type {
+  MemoryEmbeddingsConfig,
+  MemorySegmentationConfig,
+  QdrantConfig,
+} from "./schemas/memory-storage.js";
+export {
+  MemoryEmbeddingsConfigSchema,
   MemorySegmentationConfigSchema,
-  MemorySummarizationConfigSchema,
   QdrantConfigSchema,
-} from "./memory-schema.js";
-export type { NotificationsConfig } from "./notifications-schema.js";
-export { NotificationsConfigSchema } from "./notifications-schema.js";
-export type { SandboxConfig } from "./sandbox-schema.js";
-export { SandboxConfigSchema } from "./sandbox-schema.js";
+} from "./schemas/memory-storage.js";
+export type { NotificationsConfig } from "./schemas/notifications.js";
+export { NotificationsConfigSchema } from "./schemas/notifications.js";
+export type {
+  AvatarConfig,
+  DaemonConfig,
+  PlatformConfig,
+  UiConfig,
+} from "./schemas/platform.js";
+export {
+  AvatarConfigSchema,
+  DaemonConfigSchema,
+  PlatformConfigSchema,
+  UiConfigSchema,
+  VALID_AVATAR_STRATEGIES,
+} from "./schemas/platform.js";
+export type { SandboxConfig } from "./schemas/sandbox.js";
+export { SandboxConfigSchema } from "./schemas/sandbox.js";
+export type {
+  PermissionsConfig,
+  SecretDetectionConfig,
+} from "./schemas/security.js";
+export {
+  PermissionsConfigSchema,
+  SecretDetectionConfigSchema,
+} from "./schemas/security.js";
 export type {
   RemotePolicyConfig,
   RemoteProviderConfig,
@@ -133,7 +157,7 @@ export type {
   SkillsConfig,
   SkillsInstallConfig,
   SkillsLoadConfig,
-} from "./skills-schema.js";
+} from "./schemas/skills.js";
 export {
   RemotePolicyConfigSchema,
   RemoteProviderConfigSchema,
@@ -142,41 +166,59 @@ export {
   SkillsConfigSchema,
   SkillsInstallConfigSchema,
   SkillsLoadConfigSchema,
-} from "./skills-schema.js";
+} from "./schemas/skills.js";
+export type { SwarmConfig } from "./schemas/swarm.js";
+export { SwarmConfigSchema } from "./schemas/swarm.js";
+export type { RateLimitConfig, TimeoutConfig } from "./schemas/timeouts.js";
+export {
+  RateLimitConfigSchema,
+  TimeoutConfigSchema,
+} from "./schemas/timeouts.js";
+export type { WorkspaceGitConfig } from "./schemas/workspace-git.js";
+export { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
 // Imports for AssistantConfigSchema composition
+import { CallsConfigSchema } from "./schemas/calls.js";
 import {
-  HeartbeatConfigSchema,
-  SwarmConfigSchema,
-  WorkspaceGitConfigSchema,
-} from "./agent-schema.js";
-import { CallsConfigSchema } from "./calls-schema.js";
+  SlackConfigSchema,
+  TelegramConfigSchema,
+  TwilioConfigSchema,
+  WhatsAppConfigSchema,
+} from "./schemas/channels.js";
+import { ElevenLabsConfigSchema } from "./schemas/elevenlabs.js";
+import { HeartbeatConfigSchema } from "./schemas/heartbeat.js";
 import {
-  AuditLogConfigSchema,
-  AvatarConfigSchema,
   ContextWindowConfigSchema,
-  DaemonConfigSchema,
   EffortSchema,
-  IngressConfigSchema,
-  LogFileConfigSchema,
   ModelPricingOverrideSchema,
-  PermissionsConfigSchema,
+  ThinkingConfigSchema,
+} from "./schemas/inference.js";
+import { IngressConfigSchema } from "./schemas/ingress.js";
+import {
+  AuditLogConfigSchema,
+  LogFileConfigSchema,
+} from "./schemas/logging.js";
+import { McpConfigSchema } from "./schemas/mcp.js";
+import { MemoryConfigSchema } from "./schemas/memory.js";
+import { NotificationsConfigSchema } from "./schemas/notifications.js";
+import {
+  AvatarConfigSchema,
+  DaemonConfigSchema,
   PlatformConfigSchema,
-  RateLimitConfigSchema,
+  UiConfigSchema,
+} from "./schemas/platform.js";
+import { SandboxConfigSchema } from "./schemas/sandbox.js";
+import {
+  PermissionsConfigSchema,
   SecretDetectionConfigSchema,
-  SmsConfigSchema,
-  ThinkingConfigSchema,
+} from "./schemas/security.js";
+import { SkillsConfigSchema } from "./schemas/skills.js";
+import { SwarmConfigSchema } from "./schemas/swarm.js";
+import {
+  RateLimitConfigSchema,
   TimeoutConfigSchema,
-  TwilioConfigSchema,
-  UiConfigSchema,
-  WhatsAppConfigSchema,
-} from "./core-schema.js";
-import { ElevenLabsConfigSchema } from "./elevenlabs-schema.js";
-import { McpConfigSchema } from "./mcp-schema.js";
-import { MemoryConfigSchema } from "./memory-schema.js";
-import { NotificationsConfigSchema } from "./notifications-schema.js";
-import { SandboxConfigSchema } from "./sandbox-schema.js";
-import { SkillsConfigSchema } from "./skills-schema.js";
+} from "./schemas/timeouts.js";
+import { WorkspaceGitConfigSchema } from "./schemas/workspace-git.js";
 
 const VALID_PROVIDERS = [
   "anthropic",
@@ -270,8 +312,9 @@ export const AssistantConfigSchema = z
     elevenlabs: ElevenLabsConfigSchema.default(
       ElevenLabsConfigSchema.parse({}),
     ),
-    sms: SmsConfigSchema.default(SmsConfigSchema.parse({})),
     whatsapp: WhatsAppConfigSchema.default(WhatsAppConfigSchema.parse({})),
+    telegram: TelegramConfigSchema.default(TelegramConfigSchema.parse({})),
+    slack: SlackConfigSchema.default(SlackConfigSchema.parse({})),
     ingress: IngressConfigSchema,
     platform: PlatformConfigSchema.default(PlatformConfigSchema.parse({})),
     daemon: DaemonConfigSchema.default(DaemonConfigSchema.parse({})),
@@ -280,12 +323,6 @@ export const AssistantConfigSchema = z
     ),
     avatar: AvatarConfigSchema.default(AvatarConfigSchema.parse({})),
     ui: UiConfigSchema.default(UiConfigSchema.parse({})),
-    featureFlags: z
-      .record(
-        z.string(),
-        z.boolean({ error: "featureFlags values must be booleans" }),
-      )
-      .default({} as Record<string, boolean>),
     assistantFeatureFlagValues: z
       .record(
         z.string(),

package/src/config/schemas/channels.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+
+export const TwilioConfigSchema = z.object({
+  accountSid: z
+    .string({ error: "twilio.accountSid must be a string" })
+    .default(""),
+  phoneNumber: z
+    .string({ error: "twilio.phoneNumber must be a string" })
+    .default(""),
+});
+
+export const WhatsAppConfigSchema = z.object({
+  phoneNumber: z
+    .string({ error: "whatsapp.phoneNumber must be a string" })
+    .default(""),
+  deliverAuthBypass: z
+    .boolean({ error: "whatsapp.deliverAuthBypass must be a boolean" })
+    .default(false),
+  timeoutMs: z
+    .number({ error: "whatsapp.timeoutMs must be a number" })
+    .int("whatsapp.timeoutMs must be an integer")
+    .positive("whatsapp.timeoutMs must be a positive integer")
+    .default(15_000),
+  maxRetries: z
+    .number({ error: "whatsapp.maxRetries must be a number" })
+    .int("whatsapp.maxRetries must be an integer")
+    .nonnegative("whatsapp.maxRetries must be a non-negative integer")
+    .default(3),
+  initialBackoffMs: z
+    .number({ error: "whatsapp.initialBackoffMs must be a number" })
+    .int("whatsapp.initialBackoffMs must be an integer")
+    .positive("whatsapp.initialBackoffMs must be a positive integer")
+    .default(1_000),
+});
+
+export const TelegramConfigSchema = z.object({
+  botUsername: z
+    .string({ error: "telegram.botUsername must be a string" })
+    .default(""),
+  apiBaseUrl: z
+    .string({ error: "telegram.apiBaseUrl must be a string" })
+    .default("https://api.telegram.org"),
+  deliverAuthBypass: z
+    .boolean({ error: "telegram.deliverAuthBypass must be a boolean" })
+    .default(false),
+  timeoutMs: z
+    .number({ error: "telegram.timeoutMs must be a number" })
+    .int("telegram.timeoutMs must be an integer")
+    .positive("telegram.timeoutMs must be a positive integer")
+    .default(15_000),
+  maxRetries: z
+    .number({ error: "telegram.maxRetries must be a number" })
+    .int("telegram.maxRetries must be an integer")
+    .nonnegative("telegram.maxRetries must be a non-negative integer")
+    .default(3),
+  initialBackoffMs: z
+    .number({ error: "telegram.initialBackoffMs must be a number" })
+    .int("telegram.initialBackoffMs must be an integer")
+    .positive("telegram.initialBackoffMs must be a positive integer")
+    .default(1_000),
+});
+
+export const SlackConfigSchema = z.object({
+  deliverAuthBypass: z
+    .boolean({ error: "slack.deliverAuthBypass must be a boolean" })
+    .default(false),
+  teamId: z.string({ error: "slack.teamId must be a string" }).default(""),
+  teamName: z.string({ error: "slack.teamName must be a string" }).default(""),
+  botUserId: z
+    .string({ error: "slack.botUserId must be a string" })
+    .default(""),
+  botUsername: z
+    .string({ error: "slack.botUsername must be a string" })
+    .default(""),
+});
+
+export type TwilioConfig = z.infer<typeof TwilioConfigSchema>;
+export type WhatsAppConfig = z.infer<typeof WhatsAppConfigSchema>;
+export type TelegramConfig = z.infer<typeof TelegramConfigSchema>;
+export type SlackConfig = z.infer<typeof SlackConfigSchema>;

package/src/config/schemas/heartbeat.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+
+export const HeartbeatConfigSchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "heartbeat.enabled must be a boolean" })
+      .default(false),
+    intervalMs: z
+      .number({ error: "heartbeat.intervalMs must be a number" })
+      .int("heartbeat.intervalMs must be an integer")
+      .positive("heartbeat.intervalMs must be a positive integer")
+      .default(3_600_000),
+    activeHoursStart: z
+      .number({ error: "heartbeat.activeHoursStart must be a number" })
+      .int("heartbeat.activeHoursStart must be an integer")
+      .min(0, "heartbeat.activeHoursStart must be >= 0")
+      .max(23, "heartbeat.activeHoursStart must be <= 23")
+      .optional(),
+    activeHoursEnd: z
+      .number({ error: "heartbeat.activeHoursEnd must be a number" })
+      .int("heartbeat.activeHoursEnd must be an integer")
+      .min(0, "heartbeat.activeHoursEnd must be >= 0")
+      .max(23, "heartbeat.activeHoursEnd must be <= 23")
+      .optional(),
+  })
+  .superRefine((config, ctx) => {
+    const hasStart = config.activeHoursStart != null;
+    const hasEnd = config.activeHoursEnd != null;
+    if (hasStart !== hasEnd) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [hasStart ? "activeHoursEnd" : "activeHoursStart"],
+        message:
+          "heartbeat.activeHoursStart and heartbeat.activeHoursEnd must both be set or both be omitted",
+      });
+    }
+    if (
+      hasStart &&
+      hasEnd &&
+      config.activeHoursStart === config.activeHoursEnd
+    ) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["activeHoursEnd"],
+        message:
+          "heartbeat.activeHoursStart and heartbeat.activeHoursEnd must not be equal (would create an empty window)",
+      });
+    }
+  });
+
+export type HeartbeatConfig = z.infer<typeof HeartbeatConfigSchema>;

package/src/config/schemas/inference.ts

@@ -0,0 +1,136 @@
+import { z } from "zod";
+
+const VALID_LATEST_TURN_COMPRESSION_POLICIES = [
+  "truncate",
+  "summarize",
+  "drop",
+] as const;
+
+export { VALID_LATEST_TURN_COMPRESSION_POLICIES };
+
+export const ThinkingConfigSchema = z.object({
+  enabled: z
+    .boolean({ error: "thinking.enabled must be a boolean" })
+    .default(false),
+  streamThinking: z
+    .boolean({ error: "thinking.streamThinking must be a boolean" })
+    .default(false),
+});
+
+export const EffortSchema = z
+  .enum(["low", "medium", "high"], {
+    error: 'effort must be "low", "medium", or "high"',
+  })
+  .default("high");
+
+export type Effort = z.infer<typeof EffortSchema>;
+
+export const ContextOverflowRecoveryConfigSchema = z.object({
+  enabled: z
+    .boolean({
+      error: "contextWindow.overflowRecovery.enabled must be a boolean",
+    })
+    .default(true),
+  safetyMarginRatio: z
+    .number({
+      error:
+        "contextWindow.overflowRecovery.safetyMarginRatio must be a number",
+    })
+    .finite("contextWindow.overflowRecovery.safetyMarginRatio must be finite")
+    .gt(
+      0,
+      "contextWindow.overflowRecovery.safetyMarginRatio must be greater than 0",
+    )
+    .lt(
+      1,
+      "contextWindow.overflowRecovery.safetyMarginRatio must be less than 1",
+    )
+    .default(0.05),
+  maxAttempts: z
+    .number({
+      error: "contextWindow.overflowRecovery.maxAttempts must be a number",
+    })
+    .int("contextWindow.overflowRecovery.maxAttempts must be an integer")
+    .positive(
+      "contextWindow.overflowRecovery.maxAttempts must be a positive integer",
+    )
+    .default(3),
+  interactiveLatestTurnCompression: z
+    .enum(VALID_LATEST_TURN_COMPRESSION_POLICIES, {
+      error: `contextWindow.overflowRecovery.interactiveLatestTurnCompression must be one of: ${VALID_LATEST_TURN_COMPRESSION_POLICIES.join(
+        ", ",
+      )}`,
+    })
+    .default("summarize"),
+  nonInteractiveLatestTurnCompression: z
+    .enum(VALID_LATEST_TURN_COMPRESSION_POLICIES, {
+      error: `contextWindow.overflowRecovery.nonInteractiveLatestTurnCompression must be one of: ${VALID_LATEST_TURN_COMPRESSION_POLICIES.join(
+        ", ",
+      )}`,
+    })
+    .default("truncate"),
+});
+
+export const ContextWindowConfigSchema = z.object({
+  enabled: z
+    .boolean({ error: "contextWindow.enabled must be a boolean" })
+    .default(true),
+  maxInputTokens: z
+    .number({ error: "contextWindow.maxInputTokens must be a number" })
+    .int("contextWindow.maxInputTokens must be an integer")
+    .positive("contextWindow.maxInputTokens must be a positive integer")
+    .default(200000),
+  targetInputTokens: z
+    .number({ error: "contextWindow.targetInputTokens must be a number" })
+    .int("contextWindow.targetInputTokens must be an integer")
+    .positive("contextWindow.targetInputTokens must be a positive integer")
+    .default(110000),
+  compactThreshold: z
+    .number({ error: "contextWindow.compactThreshold must be a number" })
+    .finite("contextWindow.compactThreshold must be finite")
+    .gt(0, "contextWindow.compactThreshold must be greater than 0")
+    .lte(1, "contextWindow.compactThreshold must be less than or equal to 1")
+    .default(0.8),
+  preserveRecentUserTurns: z
+    .number({ error: "contextWindow.preserveRecentUserTurns must be a number" })
+    .int("contextWindow.preserveRecentUserTurns must be an integer")
+    .positive(
+      "contextWindow.preserveRecentUserTurns must be a positive integer",
+    )
+    .default(8),
+  summaryMaxTokens: z
+    .number({ error: "contextWindow.summaryMaxTokens must be a number" })
+    .int("contextWindow.summaryMaxTokens must be an integer")
+    .positive("contextWindow.summaryMaxTokens must be a positive integer")
+    .default(1200),
+  chunkTokens: z
+    .number({ error: "contextWindow.chunkTokens must be a number" })
+    .int("contextWindow.chunkTokens must be an integer")
+    .positive("contextWindow.chunkTokens must be a positive integer")
+    .default(12000),
+  overflowRecovery: ContextOverflowRecoveryConfigSchema.default(
+    ContextOverflowRecoveryConfigSchema.parse({}),
+  ),
+});
+
+export const ModelPricingOverrideSchema = z.object({
+  provider: z.string({ error: "pricingOverrides[].provider must be a string" }),
+  modelPattern: z.string({
+    error: "pricingOverrides[].modelPattern must be a string",
+  }),
+  inputPer1M: z
+    .number({ error: "pricingOverrides[].inputPer1M must be a number" })
+    .nonnegative("pricingOverrides[].inputPer1M must be a non-negative number"),
+  outputPer1M: z
+    .number({ error: "pricingOverrides[].outputPer1M must be a number" })
+    .nonnegative(
+      "pricingOverrides[].outputPer1M must be a non-negative number",
+    ),
+});
+
+export type ThinkingConfig = z.infer<typeof ThinkingConfigSchema>;
+export type ContextOverflowRecoveryConfig = z.infer<
+  typeof ContextOverflowRecoveryConfigSchema
+>;
+export type ContextWindowConfig = z.infer<typeof ContextWindowConfigSchema>;
+export type ModelPricingOverride = z.infer<typeof ModelPricingOverrideSchema>;

package/src/config/schemas/ingress.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+
+export const IngressWebhookConfigSchema = z.object({
+  secret: z
+    .string({ error: "ingress.webhook.secret must be a string" })
+    .default(""),
+  timeoutMs: z
+    .number({ error: "ingress.webhook.timeoutMs must be a number" })
+    .int("ingress.webhook.timeoutMs must be an integer")
+    .positive("ingress.webhook.timeoutMs must be a positive integer")
+    .default(30_000),
+  maxRetries: z
+    .number({ error: "ingress.webhook.maxRetries must be a number" })
+    .int("ingress.webhook.maxRetries must be an integer")
+    .nonnegative("ingress.webhook.maxRetries must be a non-negative integer")
+    .default(2),
+  initialBackoffMs: z
+    .number({ error: "ingress.webhook.initialBackoffMs must be a number" })
+    .int("ingress.webhook.initialBackoffMs must be an integer")
+    .positive("ingress.webhook.initialBackoffMs must be a positive integer")
+    .default(500),
+  maxPayloadBytes: z
+    .number({ error: "ingress.webhook.maxPayloadBytes must be a number" })
+    .int("ingress.webhook.maxPayloadBytes must be an integer")
+    .positive("ingress.webhook.maxPayloadBytes must be a positive integer")
+    .default(1_048_576),
+});
+
+export const IngressRateLimitConfigSchema = z.object({
+  maxRequestsPerMinute: z
+    .number({
+      error: "ingress.rateLimit.maxRequestsPerMinute must be a number",
+    })
+    .int("ingress.rateLimit.maxRequestsPerMinute must be an integer")
+    .nonnegative(
+      "ingress.rateLimit.maxRequestsPerMinute must be a non-negative integer",
+    )
+    .default(0),
+  maxRequestsPerHour: z
+    .number({ error: "ingress.rateLimit.maxRequestsPerHour must be a number" })
+    .int("ingress.rateLimit.maxRequestsPerHour must be an integer")
+    .nonnegative(
+      "ingress.rateLimit.maxRequestsPerHour must be a non-negative integer",
+    )
+    .default(0),
+});
+
+const IngressBaseSchema = z.object({
+  enabled: z.boolean({ error: "ingress.enabled must be a boolean" }).optional(),
+  publicBaseUrl: z
+    .string({ error: "ingress.publicBaseUrl must be a string" })
+    .refine(
+      (val) => val === "" || /^https?:\/\//i.test(val),
+      "ingress.publicBaseUrl must be an absolute URL starting with http:// or https://",
+    )
+    .default(""),
+  webhook: IngressWebhookConfigSchema.default(
+    IngressWebhookConfigSchema.parse({}),
+  ),
+  rateLimit: IngressRateLimitConfigSchema.default(
+    IngressRateLimitConfigSchema.parse({}),
+  ),
+  shutdownDrainMs: z
+    .number({ error: "ingress.shutdownDrainMs must be a number" })
+    .int("ingress.shutdownDrainMs must be an integer")
+    .nonnegative("ingress.shutdownDrainMs must be a non-negative integer")
+    .default(5_000),
+});
+
+export const IngressConfigSchema = IngressBaseSchema.default(
+  IngressBaseSchema.parse({}),
+).transform((val) => ({
+  ...val,
+  enabled: val.enabled,
+}));
+
+export type IngressWebhookConfig = z.infer<typeof IngressWebhookConfigSchema>;
+export type IngressRateLimitConfig = z.infer<
+  typeof IngressRateLimitConfigSchema
+>;
+export type IngressConfig = z.infer<typeof IngressConfigSchema>;