@exulu/backend 1.59.0 → 1.61.0

package/dist/index.cjs

@@ -429,7 +429,8 @@ var init_supervisor = __esm({
       log(
         `Spawning LiteLLM: ${cfg.litellmBin} --config ${cfg.configPath} --port ${cfg.port} --host ${cfg.host}`
       );
-      const { DEBUG: _debug, ...envWithoutDebug } = process.env;
+      const { DEBUG: _debug, ...rest } = process.env;
+      const childEnv = { ...rest, DEBUG: "false" };
       const child = (0, import_node_child_process.spawn)(
         cfg.litellmBin,
         [
@@ -442,7 +443,7 @@ var init_supervisor = __esm({
         ],
         {
           stdio: ["ignore", "pipe", "pipe"],
-          env: envWithoutDebug
+          env: childEnv
         }
       );
       child.stdout?.on("data", (chunk) => {
@@ -605,15 +606,15 @@ var init_check_record_access = __esm({
     "use strict";
     init_cjs_shims();
     checkRecordAccessCache = /* @__PURE__ */ new Map();
-    checkRecordAccess = async (record, request, user) => {
+    checkRecordAccess = async (record, request2, user) => {
       const setRecordAccessCache = (hasAccess2) => {
-        checkRecordAccessCache.set(`${record.id}-${request}-${user?.id}`, {
+        checkRecordAccessCache.set(`${record.id}-${request2}-${user?.id}`, {
           hasAccess: hasAccess2,
           expiresAt: new Date(Date.now() + 1e3 * 60 * 1)
           // 1 minute
         });
       };
-      const cachedAccess = checkRecordAccessCache.get(`${record.id}-${request}-${user?.id}`);
+      const cachedAccess = checkRecordAccessCache.get(`${record.id}-${request2}-${user?.id}`);
       if (cachedAccess && cachedAccess.expiresAt > /* @__PURE__ */ new Date()) {
         return cachedAccess.hasAccess;
       }
@@ -625,7 +626,7 @@ var init_check_record_access = __esm({
       const isAdmin = user ? user.super_admin : false;
       const isApi = user ? user.type === "api" : false;
       const isAdminApi = isApi && (!user.scope_mode || user.scope_mode === "admin");
-      const isAgentsScopedApi = isApi && user.scope_mode === "agents" && request === "read" && Array.isArray(user.agent_ids) && user.agent_ids.includes(String(record.id));
+      const isAgentsScopedApi = isApi && user.scope_mode === "agents" && request2 === "read" && Array.isArray(user.agent_ids) && user.agent_ids.includes(String(record.id));
       let hasAccess = "none";
       if (isPublic || isCreator || isAdmin || isAdminApi || isAgentsScopedApi) {
         setRecordAccessCache(true);
@@ -637,7 +638,7 @@ var init_check_record_access = __esm({
           return false;
         }
         hasAccess = record.RBAC?.users?.find((x) => x.id === user.id)?.rights || "none";
-        if (!hasAccess || hasAccess === "none" || hasAccess !== request) {
+        if (!hasAccess || hasAccess === "none" || hasAccess !== request2) {
           console.error(
             `[EXULU] Your current user ${user.id} does not have access to this record, current access type is: ${hasAccess}.`
           );
@@ -654,7 +655,7 @@ var init_check_record_access = __esm({
           return false;
         }
         hasAccess = record.RBAC?.roles?.find((x) => x.id === user.role?.id)?.rights || "none";
-        if (!hasAccess || hasAccess === "none" || hasAccess !== request) {
+        if (!hasAccess || hasAccess === "none" || hasAccess !== request2) {
           console.error(
             `[EXULU] Your current role ${user.role?.name} does not have access to this record, current access type is: ${hasAccess}.`
           );
@@ -1519,7 +1520,7 @@ var init_uppy = __esm({
           if (error.name === "SignatureDoesNotMatch" || error.name === "InvalidAccessKeyId" || error.name === "AccessDenied") {
             if (attempt < maxRetries) {
               const backoffMs = Math.pow(2, attempt) * 1e3;
-              await new Promise((resolve6) => setTimeout(resolve6, backoffMs));
+              await new Promise((resolve7) => setTimeout(resolve7, backoffMs));
               s3Client = void 0;
               getS3Client(config);
               continue;
@@ -3290,7 +3291,7 @@ async function withRetry(generateFn, maxRetries = 3) {
       if (attempt === maxRetries) {
         throw error;
       }
-      await new Promise((resolve6) => setTimeout(resolve6, Math.pow(2, attempt) * 1e3));
+      await new Promise((resolve7) => setTimeout(resolve7, Math.pow(2, attempt) * 1e3));
     }
   }
   throw lastError;
@@ -4086,7 +4087,7 @@ var init_schemas = __esm({
 });
 
 // src/postgres/core-schema.ts
-var agentMessagesSchema, agentSessionsSchema, skillsSchema, variablesSchema, projectsSchema, agentsSchema, modelsSchema, usersSchema, platformConfigurationsSchema, embedderSettingsSchema, promptLibrarySchema, promptFavoritesSchema, contextPresetsSchema, addCoreFields, coreSchemas;
+var agentMessagesSchema, agentSessionsSchema, skillsSchema, variablesSchema, projectsSchema, agentsSchema, modelsSchema, usersSchema, platformConfigurationsSchema, embedderSettingsSchema, promptLibrarySchema, promptFavoritesSchema, transcriptionJobsSchema, imageGenerationsSchema, contextPresetsSchema, addCoreFields, coreSchemas;
 var init_core_schema = __esm({
   "src/postgres/core-schema.ts"() {
     "use strict";
@@ -4499,6 +4500,10 @@ var init_core_schema = __esm({
           name: "anthropic_token",
           type: "text"
         },
+        {
+          name: "personal_system_prompt",
+          type: "longText"
+        },
         {
           name: "role",
           type: "uuid"
@@ -4507,6 +4512,7 @@ var init_core_schema = __esm({
     };
     platformConfigurationsSchema = {
       type: "platform_configurations",
+      RBAC: true,
       name: {
         plural: "platform_configurations",
         singular: "platform_configuration"
@@ -4626,6 +4632,60 @@ var init_core_schema = __esm({
         }
       ]
     };
+    transcriptionJobsSchema = {
+      type: "transcription_jobs",
+      name: {
+        plural: "transcription_jobs",
+        singular: "transcription_job"
+      },
+      RBAC: true,
+      fields: [
+        { name: "audio", type: "file" },
+        { name: "title", type: "text" },
+        { name: "status", type: "text", index: true },
+        { name: "whisper_job_id", type: "text" },
+        { name: "raw_segments", type: "json" },
+        { name: "speakers", type: "json" },
+        { name: "language", type: "text" },
+        { name: "duration_seconds", type: "number" },
+        { name: "project_id", type: "uuid", required: false },
+        { name: "target_rights_mode", type: "text", default: "private" },
+        { name: "target_rbac_users", type: "json" },
+        { name: "target_rbac_roles", type: "json" },
+        { name: "saved_item_id", type: "uuid", required: false },
+        { name: "error", type: "text" }
+      ]
+    };
+    imageGenerationsSchema = {
+      type: "image_generations",
+      name: {
+        plural: "image_generations",
+        singular: "image_generation"
+      },
+      // Access is gated by the parent agent_sessions RBAC — rows have no
+      // independent visibility, so no row-level RBAC fields are needed here.
+      RBAC: false,
+      fields: [
+        { name: "session_id", type: "uuid", required: true, index: true },
+        { name: "tool_call_id", type: "text", required: true, index: true },
+        { name: "user_id", type: "number", required: true, index: true },
+        { name: "operation", type: "text", required: true },
+        // 'generate' | 'edit'
+        { name: "model", type: "text", required: true },
+        { name: "prompt", type: "longText", required: true },
+        { name: "applied_style_id", type: "uuid", required: false },
+        { name: "applied_style_markdown", type: "longText", required: false },
+        { name: "size", type: "text", required: false },
+        { name: "quality", type: "text", required: false },
+        { name: "n", type: "number", default: 1 },
+        { name: "reference_image_keys", type: "json", required: false },
+        { name: "mask_image_key", type: "text", required: false },
+        { name: "image_keys", type: "json", required: true },
+        { name: "revised_prompts", type: "json", required: false },
+        { name: "selected", type: "boolean", default: false },
+        { name: "error", type: "text", required: false }
+      ]
+    };
     contextPresetsSchema = {
       type: "context_presets",
       name: {
@@ -4716,7 +4776,9 @@ var init_core_schema = __esm({
           promptLibrarySchema: () => addCoreFields(promptLibrarySchema),
           embedderSettingsSchema: () => addCoreFields(embedderSettingsSchema),
           promptFavoritesSchema: () => addCoreFields(promptFavoritesSchema),
-          contextPresetsSchema: () => addCoreFields(contextPresetsSchema)
+          contextPresetsSchema: () => addCoreFields(contextPresetsSchema),
+          transcriptionJobsSchema: () => addCoreFields(transcriptionJobsSchema),
+          imageGenerationsSchema: () => addCoreFields(imageGenerationsSchema)
         };
         if (license["agent-feedback"]) {
           schemas.feedbackSchema = () => addCoreFields(feedbackSchema);
@@ -7618,7 +7680,11 @@ var init_catalog = __esm({
           supports_vision: !!m.model_info?.supports_vision,
           supports_function_calling: !!m.model_info?.supports_function_calling,
           supports_pdf_input: !!m.model_info?.supports_pdf_input,
-          supports_audio_input: !!m.model_info?.supports_audio_input
+          supports_audio_input: !!m.model_info?.supports_audio_input,
+          sizes: Array.isArray(m.model_info?.sizes) ? m.model_info.sizes : null,
+          qualities: Array.isArray(m.model_info?.qualities) ? m.model_info.qualities : null,
+          supports_edit: !!m.model_info?.supports_edit,
+          max_n: typeof m.model_info?.max_n === "number" ? m.model_info.max_n : null
         }));
         _cache = { expiresAt: Date.now() + CACHE_TTL_MS2, items };
         return items.filter((m) => m.type !== "speech_to_text" && m.type !== "text_to_speech");
@@ -10021,7 +10087,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
             );
             if (attempt < retries) {
               const backoffMs = 500 * Math.pow(2, attempt - 1);
-              await new Promise((resolve6) => setTimeout(resolve6, backoffMs));
+              await new Promise((resolve7) => setTimeout(resolve7, backoffMs));
             }
           }
         }
@@ -10225,7 +10291,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
               } = await validateWorkflowPayload(data, providers);
               const retries2 = 3;
               let attempts = 0;
-              const promise = new Promise(async (resolve6, reject) => {
+              const promise = new Promise(async (resolve7, reject) => {
                 while (attempts < retries2) {
                   try {
                     const messages2 = await processUiMessagesFlow({
@@ -10240,7 +10306,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
                       config,
                       variables: data.inputs
                     });
-                    resolve6(messages2);
+                    resolve7(messages2);
                     break;
                   } catch (error) {
                     console.error(
@@ -10251,7 +10317,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
                     if (attempts >= retries2) {
                       reject(new Error(error instanceof Error ? error.message : String(error)));
                     }
-                    await new Promise((resolve7) => setTimeout((resolve8) => resolve8(true), 2e3));
+                    await new Promise((resolve8) => setTimeout((resolve9) => resolve9(true), 2e3));
                   }
                 }
               });
@@ -10301,7 +10367,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
               } = await validateEvalPayload(data, providers);
               const retries2 = 3;
               let attempts = 0;
-              const promise = new Promise(async (resolve6, reject) => {
+              const promise = new Promise(async (resolve7, reject) => {
                 while (attempts < retries2) {
                   try {
                     const messages2 = await processUiMessagesFlow({
@@ -10315,7 +10381,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
                       tools,
                       config
                     });
-                    resolve6(messages2);
+                    resolve7(messages2);
                     break;
                   } catch (error) {
                     console.error(
@@ -10326,7 +10392,7 @@ var createWorkers = async (providers, queues2, config, contexts, rerankers, eval
                     if (attempts >= retries2) {
                       reject(new Error(error instanceof Error ? error.message : String(error)));
                     }
-                    await new Promise((resolve7) => setTimeout((resolve8) => resolve8(true), 2e3));
+                    await new Promise((resolve8) => setTimeout((resolve9) => resolve9(true), 2e3));
                   }
                 }
               });
@@ -10801,7 +10867,7 @@ var pollJobResult = async ({
     attempts++;
     const job = await import_bullmq3.Job.fromId(queue.queue, jobId);
     if (!job) {
-      await new Promise((resolve6) => setTimeout((resolve7) => resolve7(true), 2e3));
+      await new Promise((resolve7) => setTimeout((resolve8) => resolve8(true), 2e3));
       continue;
     }
     const elapsedTime = Date.now() - startTime;
@@ -10831,7 +10897,7 @@ var pollJobResult = async ({
       console.log(`[EXULU] eval function ${job.id} result: ${result}`);
       break;
     }
-    await new Promise((resolve6) => setTimeout(() => resolve6(true), 2e3));
+    await new Promise((resolve7) => setTimeout(() => resolve7(true), 2e3));
   }
   return result;
 };
@@ -10931,7 +10997,7 @@ var processUiMessagesFlow = async ({
       label: agent.name,
       trigger: "agent"
     };
-    messageHistory = await new Promise(async (resolve6, reject) => {
+    messageHistory = await new Promise(async (resolve7, reject) => {
       const startTime = Date.now();
       try {
         const result = await provider.generateStream({
@@ -11009,7 +11075,7 @@ var processUiMessagesFlow = async ({
                 })
               ] : []
             ]);
-            resolve6({
+            resolve7({
               messages,
               metadata: {
                 tokens: {
@@ -11065,6 +11131,373 @@ function getAverage(arr) {
 // src/graphql/schemas/index.ts
 init_entitlements();
 var import_fs = require("fs");
+
+// src/exulu/transcription/service.ts
+init_cjs_shims();
+init_singleton();
+init_client();
+init_uppy();
+
+// src/exulu/transcription/client.ts
+init_cjs_shims();
+var TranscriptionServerUnavailable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TranscriptionServerUnavailable";
+  }
+};
+var getBaseUrl = () => {
+  const url = process.env.TRANSCRIPTION_SERVER;
+  if (!url) {
+    throw new TranscriptionServerUnavailable(
+      "TRANSCRIPTION_SERVER env var is not set. Start a whisper server with `npx @exulu/backend exulu-start-whisper` and point TRANSCRIPTION_SERVER at it."
+    );
+  }
+  return url.replace(/\/$/, "");
+};
+var request = async (path3, init = {}) => {
+  const url = `${getBaseUrl()}${path3}`;
+  let res;
+  try {
+    res = await fetch(url, init);
+  } catch (err) {
+    throw new TranscriptionServerUnavailable(
+      `Unable to reach whisper server at ${url}: ${err.message}`
+    );
+  }
+  if (res.status === 404) {
+    const err = new Error(`whisper server returned 404 for ${path3}`);
+    err.code = "JOB_NOT_FOUND";
+    throw err;
+  }
+  if (!res.ok) {
+    throw new Error(
+      `whisper server returned ${res.status} for ${path3}: ${await res.text()}`
+    );
+  }
+  return await res.json();
+};
+var transcriptionClient = {
+  submitJob: (opts) => request("/jobs", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(opts)
+  }),
+  getJob: (jobId) => request(`/jobs/${jobId}`),
+  cancelJob: (jobId) => request(`/jobs/${jobId}`, {
+    method: "DELETE"
+  }),
+  health: () => request("/healthz"),
+  isConfigured: () => Boolean(process.env.TRANSCRIPTION_SERVER)
+};
+
+// src/exulu/transcription/transcript-text.ts
+init_cjs_shims();
+var renderTranscript = (segments, speakers) => {
+  if (!segments || segments.length === 0) return "";
+  const blocks = [];
+  for (const seg of segments) {
+    const text = (seg.text ?? "").trim();
+    if (!text) continue;
+    const label = speakers[seg.speaker] ?? seg.speaker ?? "unknown";
+    const last = blocks[blocks.length - 1];
+    if (last && last.speaker === label) {
+      last.text = `${last.text} ${text}`.trim();
+    } else {
+      blocks.push({ speaker: label, text });
+    }
+  }
+  return blocks.map((b) => `${b.speaker}: ${b.text}`).join("\n");
+};
+
+// src/exulu/transcription/service.ts
+var TABLE = "transcription_jobs";
+var log2 = (msg) => console.log(`[EXULU-TRANSCRIPTION] ${msg}`);
+var parseJsonField = (v) => {
+  if (v == null) return null;
+  if (typeof v === "string") {
+    try {
+      return JSON.parse(v);
+    } catch {
+      return null;
+    }
+  }
+  return v;
+};
+var presignAudio = async (s3Key) => {
+  const app = exuluApp.get();
+  const config = app._config ?? app.config;
+  const configuredBucket = config?.fileUploads?.s3Bucket;
+  if (!configuredBucket) {
+    throw new Error("File uploads are not configured (s3Bucket missing).");
+  }
+  const firstSlash = s3Key.indexOf("/");
+  const bucket = firstSlash > 0 ? s3Key.slice(0, firstSlash) : configuredBucket;
+  const objectKey = firstSlash > 0 ? s3Key.slice(firstSlash + 1) : s3Key;
+  return getPresignedUrl(bucket, objectKey, config);
+};
+var transcriptionService = {
+  /**
+   * Create a transcription job row and dispatch it to the whisper server.
+   * Throws TranscriptionServerUnavailable if the feature is off.
+   */
+  async startJob(input) {
+    if (!transcriptionClient.isConfigured()) {
+      throw new TranscriptionServerUnavailable(
+        "TRANSCRIPTION_SERVER is not set. Start a whisper server with `npx @exulu/backend exulu-start-whisper` and point TRANSCRIPTION_SERVER at it."
+      );
+    }
+    const { db: db2 } = await postgresClient();
+    const now = /* @__PURE__ */ new Date();
+    const [inserted] = await db2(TABLE).insert({
+      audio_s3key: input.s3Key,
+      title: input.title ?? input.filename,
+      status: "queued",
+      project_id: input.project_id ?? null,
+      target_rights_mode: input.target_rights_mode ?? "private",
+      target_rbac_users: input.target_rbac_users ? JSON.stringify(input.target_rbac_users) : null,
+      target_rbac_roles: input.target_rbac_roles ? JSON.stringify(input.target_rbac_roles) : null,
+      rights_mode: "private",
+      created_by: input.userId,
+      createdAt: now,
+      updatedAt: now
+    }).returning("*");
+    const row = this._rowFromDb(inserted);
+    try {
+      const audioUrl = await presignAudio(input.s3Key);
+      const submitted = await transcriptionClient.submitJob({
+        audio_url: audioUrl,
+        language: input.language ?? void 0,
+        num_speakers: input.num_speakers ?? void 0,
+        hotwords: input.hotwords
+      });
+      const [updated] = await db2(TABLE).where({ id: row.id }).update({
+        whisper_job_id: submitted.job_id,
+        status: "transcribing",
+        updatedAt: /* @__PURE__ */ new Date()
+      }).returning("*");
+      return this._rowFromDb(updated);
+    } catch (err) {
+      const [failed] = await db2(TABLE).where({ id: row.id }).update({
+        status: "failed",
+        error: err.message,
+        updatedAt: /* @__PURE__ */ new Date()
+      }).returning("*");
+      log2(`Failed to dispatch job ${row.id}: ${err.message}`);
+      return this._rowFromDb(failed);
+    }
+  },
+  /**
+   * Reconcile every transcribing row against the whisper server. Called from
+   * the polling loop on a fixed interval. Caps how many rows we touch per
+   * tick so a backlog can't starve the event loop.
+   */
+  async pollOnce(maxPerTick = 50) {
+    if (!transcriptionClient.isConfigured()) return;
+    const { db: db2 } = await postgresClient();
+    const rows = await db2(TABLE).where({ status: "transcribing" }).whereNotNull("whisper_job_id").limit(maxPerTick);
+    for (const dbRow of rows) {
+      const row = this._rowFromDb(dbRow);
+      if (!row.whisper_job_id) continue;
+      try {
+        const job = await transcriptionClient.getJob(row.whisper_job_id);
+        await this._applyJobUpdate(row, job);
+      } catch (err) {
+        const code = err.code;
+        if (code === "JOB_NOT_FOUND") {
+          await db2(TABLE).where({ id: row.id }).update({
+            status: "failed",
+            error: "lost on server restart",
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+        } else if (err instanceof TranscriptionServerUnavailable) {
+          log2(`Whisper server unreachable while polling ${row.id}; will retry`);
+        } else {
+          log2(`Error polling job ${row.id}: ${err.message}`);
+        }
+      }
+    }
+  },
+  async _applyJobUpdate(row, job) {
+    const { db: db2 } = await postgresClient();
+    if ((job.status === "queued" || job.status === "running") && job.duration_seconds != null && row.duration_seconds !== job.duration_seconds) {
+      await db2(TABLE).where({ id: row.id }).update({
+        duration_seconds: job.duration_seconds,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+    }
+    if (job.status === "running" || job.status === "queued") return;
+    if (job.status === "completed") {
+      await db2(TABLE).where({ id: row.id }).update({
+        status: "awaiting_review",
+        raw_segments: JSON.stringify(job.segments ?? []),
+        language: job.language ?? null,
+        duration_seconds: job.duration_seconds ?? null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return;
+    }
+    if (job.status === "failed") {
+      await db2(TABLE).where({ id: row.id }).update({
+        status: "failed",
+        error: job.error ?? "transcription failed",
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return;
+    }
+    if (job.status === "cancelled") {
+      await db2(TABLE).where({ id: row.id }).update({
+        status: "cancelled",
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+    }
+  },
+  async cancelJob(id) {
+    const { db: db2 } = await postgresClient();
+    const dbRow = await db2(TABLE).where({ id }).first();
+    if (!dbRow) throw new Error(`transcription_job ${id} not found`);
+    const row = this._rowFromDb(dbRow);
+    if (row.whisper_job_id && transcriptionClient.isConfigured()) {
+      try {
+        await transcriptionClient.cancelJob(row.whisper_job_id);
+      } catch (err) {
+        const code = err.code;
+        if (code !== "JOB_NOT_FOUND") {
+          log2(`Best-effort cancel of whisper job failed: ${err.message}`);
+        }
+      }
+    }
+    const [updated] = await db2(TABLE).where({ id }).update({ status: "cancelled", updatedAt: /* @__PURE__ */ new Date() }).returning("*");
+    return this._rowFromDb(updated);
+  },
+  /**
+   * User clicked Save in the review panel.
+   *
+   * - From 'awaiting_review': render the speaker-labeled transcript, create a
+   *   new ExuluContext item, apply RBAC + optional project linkage, mark the
+   *   job saved.
+   * - From 'saved': re-render the transcript with the (possibly updated)
+   *   speaker map and upsert the existing context item by id. Used by the
+   *   Completed-section re-edit flow.
+   */
+  async finalize(id, input) {
+    const { db: db2 } = await postgresClient();
+    const dbRow = await db2(TABLE).where({ id }).first();
+    if (!dbRow) throw new Error(`transcription_job ${id} not found`);
+    const row = this._rowFromDb(dbRow);
+    if (row.status !== "awaiting_review" && row.status !== "saved") {
+      throw new Error(
+        `transcription_job ${id} is in status '${row.status}'; can only finalize from 'awaiting_review' or 'saved'`
+      );
+    }
+    if (!row.raw_segments) {
+      throw new Error(`transcription_job ${id} has no raw_segments to finalize`);
+    }
+    const app = exuluApp.get();
+    const context = app.context("transcriptions");
+    if (!context) {
+      throw new Error("Built-in transcriptions context not registered");
+    }
+    const config = app._config ?? app.config;
+    const transcriptText = renderTranscript(row.raw_segments, input.speakers);
+    const rightsMode = input.target_rights_mode ?? row.target_rights_mode ?? "private";
+    const isReSave = row.status === "saved" && !!row.saved_item_id;
+    const itemInput = {
+      // Carrying the id on re-save makes context.createItem upsert in place.
+      ...isReSave && row.saved_item_id ? { id: row.saved_item_id } : {},
+      name: input.title ?? row.title ?? "Transcript",
+      transcript_text: transcriptText,
+      audio_s3key: row.audio_s3key,
+      language: row.language ?? void 0,
+      duration_seconds: row.duration_seconds ?? void 0,
+      speakers: input.speakers,
+      raw_segments: row.raw_segments,
+      rights_mode: rightsMode,
+      created_by: row.created_by
+    };
+    let item;
+    try {
+      const result = await context.createItem(
+        itemInput,
+        config,
+        row.created_by,
+        void 0,
+        isReSave
+        // upsert when re-saving
+      );
+      item = result.item;
+    } catch (err) {
+      await db2(TABLE).where({ id }).update({
+        speakers: JSON.stringify(input.speakers),
+        error: `Failed to save: ${err.message}`,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      throw err;
+    }
+    const itemId = item.id ?? row.saved_item_id ?? "";
+    const users = input.target_rbac_users ?? row.target_rbac_users ?? [];
+    const roles = input.target_rbac_roles ?? row.target_rbac_roles ?? [];
+    if ((users.length || roles.length) && rightsMode !== "private") {
+      try {
+        await handleRBACUpdate(
+          db2,
+          "transcriptions",
+          itemId,
+          { users, roles },
+          []
+        );
+      } catch (err) {
+        log2(`RBAC update failed for item ${itemId}: ${err.message}`);
+      }
+    }
+    const projectId = input.project_id ?? row.project_id ?? null;
+    let projectWarning = null;
+    if (projectId && !isReSave) {
+      try {
+        const project = await db2("projects").where({ id: projectId }).first();
+        if (!project) {
+          projectWarning = `project ${projectId} not found`;
+        } else {
+          const existing = parseJsonField(project.project_items) ?? [];
+          const globalId = `transcriptions/${itemId}`;
+          if (!existing.includes(globalId)) {
+            existing.push(globalId);
+            await db2("projects").where({ id: projectId }).update({
+              project_items: JSON.stringify(existing),
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+          }
+        }
+      } catch (err) {
+        projectWarning = err.message;
+      }
+    }
+    const [updated] = await db2(TABLE).where({ id }).update({
+      status: "saved",
+      saved_item_id: itemId,
+      title: input.title ?? row.title ?? null,
+      speakers: JSON.stringify(input.speakers),
+      error: projectWarning ? `Saved, but could not attach to project: ${projectWarning}` : null,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).returning("*");
+    return { item, row: this._rowFromDb(updated) };
+  },
+  _rowFromDb(dbRow) {
+    return {
+      ...dbRow,
+      raw_segments: parseJsonField(dbRow.raw_segments),
+      speakers: parseJsonField(dbRow.speakers),
+      target_rbac_users: parseJsonField(
+        dbRow.target_rbac_users
+      ),
+      target_rbac_roles: parseJsonField(
+        dbRow.target_rbac_roles
+      )
+    };
+  }
+};
+
+// src/graphql/schemas/index.ts
 function createExuluContextsTypeDefs(table) {
   const enumDefs = table.fields.filter((field) => field.type === "enum" && field.enumValues).map((field) => {
     if (!field.enumValues) {
@@ -11482,6 +11915,39 @@ type PageInfo {
   mutationDefs += `
     deleteJob(queue: QueueEnum!, id: String!): JobActionReturnPayload
     `;
+  mutationDefs += `
+    transcriptionJobStart(input: TranscriptionJobStartInput!): transcription_job
+    transcriptionJobFinalize(id: ID!, input: TranscriptionJobFinalizeInput!): TranscriptionJobFinalizeResult
+    transcriptionJobCancel(id: ID!): transcription_job
+    `;
+  modelDefs += `
+    input TranscriptionJobStartInput {
+      audio_s3key: String!
+      filename: String!
+      title: String
+      language: String
+      num_speakers: Int
+      hotwords: [String!]
+      project_id: ID
+      target_rights_mode: String
+      target_rbac_users: [RBACUserInput!]
+      target_rbac_roles: [RBACRoleInput!]
+    }
+
+    input TranscriptionJobFinalizeInput {
+      title: String
+      speakers: JSON!
+      project_id: ID
+      target_rights_mode: String
+      target_rbac_users: [RBACUserInput!]
+      target_rbac_roles: [RBACRoleInput!]
+    }
+
+    type TranscriptionJobFinalizeResult {
+      job: transcription_job!
+      item_id: ID!
+    }
+  `;
   typeDefs += `
    tools(search: String, category: String, limit: Int, page: Int): ToolPaginationResult
    toolCategories: [String!]!
@@ -11836,7 +12302,7 @@ type LiteLLMModel {
         } = await validateWorkflowPayload(jobData, providers);
         const retries = 3;
         let attempts = 0;
-        const promise = new Promise(async (resolve6, reject) => {
+        const promise = new Promise(async (resolve7, reject) => {
           while (attempts < retries) {
             try {
               const messages2 = await processUiMessagesFlow({
@@ -11851,7 +12317,7 @@ type LiteLLMModel {
                 config,
                 variables: args.variables
               });
-              resolve6(messages2);
+              resolve7(messages2);
               break;
             } catch (error) {
               console.error(
@@ -11865,7 +12331,7 @@ type LiteLLMModel {
               if (attempts >= retries) {
                 reject(error instanceof Error ? error : new Error(String(error)));
               }
-              await new Promise((resolve7) => setTimeout((resolve8) => resolve8(true), 2e3));
+              await new Promise((resolve8) => setTimeout((resolve9) => resolve9(true), 2e3));
             }
           }
         });
@@ -12047,6 +12513,54 @@ type LiteLLMModel {
     await config2.queue.remove(args.id);
     return { success: true };
   };
+  const assertOwnsTranscriptionJob = async (id, context) => {
+    const { db: db2, user } = context;
+    if (!user) throw new Error("Authentication required");
+    if (user.super_admin === true) return;
+    const row = await db2.from("transcription_jobs").select(["created_by", "rights_mode"]).where({ id }).first();
+    if (!row) throw new Error(`transcription_job ${id} not found`);
+    if (row.rights_mode === "public") return;
+    if (row.created_by === user.id) return;
+    throw new Error("Not authorized to act on this transcription job");
+  };
+  resolvers.Mutation["transcriptionJobStart"] = async (_, args, context) => {
+    const { user } = context;
+    if (!user) throw new Error("Authentication required");
+    if (!transcriptionClient.isConfigured()) {
+      throw new Error(
+        "TRANSCRIPTION_DISABLED: TRANSCRIPTION_SERVER not set on this server. Ask the operator to start a whisper server with `npx @exulu/backend exulu-start-whisper`."
+      );
+    }
+    return transcriptionService.startJob({
+      userId: user.id,
+      s3Key: args.input.audio_s3key,
+      filename: args.input.filename,
+      title: args.input.title,
+      language: args.input.language ?? void 0,
+      num_speakers: args.input.num_speakers ?? void 0,
+      hotwords: args.input.hotwords ?? void 0,
+      project_id: args.input.project_id ?? null,
+      target_rights_mode: args.input.target_rights_mode ?? null,
+      target_rbac_users: args.input.target_rbac_users ?? void 0,
+      target_rbac_roles: args.input.target_rbac_roles ?? void 0
+    });
+  };
+  resolvers.Mutation["transcriptionJobFinalize"] = async (_, args, context) => {
+    await assertOwnsTranscriptionJob(args.id, context);
+    const { item, row } = await transcriptionService.finalize(args.id, {
+      title: args.input.title,
+      speakers: args.input.speakers,
+      project_id: args.input.project_id ?? null,
+      target_rights_mode: args.input.target_rights_mode ?? null,
+      target_rbac_users: args.input.target_rbac_users ?? void 0,
+      target_rbac_roles: args.input.target_rbac_roles ?? void 0
+    });
+    return { job: row, item_id: item.id };
+  };
+  resolvers.Mutation["transcriptionJobCancel"] = async (_, args, context) => {
+    await assertOwnsTranscriptionJob(args.id, context);
+    return transcriptionService.cancelJob(args.id);
+  };
   resolvers.Query["evals"] = async (_, args, context, info) => {
     const requestedFields = getRequestedFields(info);
     return {
@@ -12118,10 +12632,10 @@ type LiteLLMModel {
       contexts.map(async (context2) => {
         let processor = null;
         if (context2.processor) {
-          processor = await new Promise(async (resolve6, reject) => {
+          processor = await new Promise(async (resolve7, reject) => {
             const config2 = context2.processor?.config;
             const queue = await config2?.queue;
-            resolve6({
+            resolve7({
               name: context2.processor.name,
               description: context2.processor.description,
               queue: queue?.queue?.name || void 0,
@@ -12202,10 +12716,10 @@ type LiteLLMModel {
     }
     let processor = null;
     if (data.processor) {
-      processor = await new Promise(async (resolve6, reject) => {
+      processor = await new Promise(async (resolve7, reject) => {
         const config2 = data.processor?.config;
         const queue = await config2?.queue;
-        resolve6({
+        resolve7({
           name: data.processor.name,
           description: data.processor.description,
           queue: queue?.queue?.name || void 0,
@@ -12899,7 +13413,7 @@ var import_utils5 = require("@apollo/utils.keyvaluecache");
 var import_body_parser = __toESM(require("body-parser"), 1);
 var import_crypto_js8 = __toESM(require("crypto-js"), 1);
 var import_openai = __toESM(require("openai"), 1);
-var import_fs3 = __toESM(require("fs"), 1);
+var import_fs4 = __toESM(require("fs"), 1);
 var import_node_crypto5 = require("crypto");
 var import_api2 = require("@opentelemetry/api");
 init_check_record_access();
@@ -13255,6 +13769,9 @@ var ExuluProvider = class {
                   If the user does not explicitly provide the current date, for examle when saying ' this weekend', you should assume 
                   they are talking with the current date in mind as a reference.`;
     let system = instructions || "You are a helpful assistant. When you use a tool to answer a question do not explicitly comment on the result of the tool call unless the user has explicitly you to do something with the result.";
+    if (user?.personal_system_prompt?.trim()) {
+      system += "\n\nUser preferences:\n" + user.personal_system_prompt.trim();
+    }
     system += "\n\n" + genericContext;
     if (memoryContext) {
       system += "\n\n" + memoryContext;
@@ -13354,7 +13871,10 @@ When a tool execution is not approved by the user, do not retry it unless explic
           agent,
           memoryItems
         ),
-        stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || 5)]
+        // Stop after the image_generation tool fires — the widget IS the
+        // assistant's response, no follow-up text turn is wanted (same
+        // reasoning as question_ask: the UI artifact is the message).
+        stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || 5), (0, import_ai9.hasToolCall)("image_generation")]
         // make configurable
       });
       console.log("[EXULU] Output: " + JSON.stringify(output, null, 2));
@@ -13435,7 +13955,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
           agent,
           memoryItems
         ),
-        stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || 5)]
+        stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || 5), (0, import_ai9.hasToolCall)("image_generation")]
       });
       if (statistics) {
         await Promise.all([
@@ -13660,6 +14180,9 @@ ${extractedText}
     messages = await this.processFilePartsInMessages(messages);
     const genericContext = "IMPORTANT: \n\n The current date is " + (/* @__PURE__ */ new Date()).toLocaleDateString() + " and the current time is " + (/* @__PURE__ */ new Date()).toLocaleTimeString() + ". If the user does not explicitly provide the current date, for examle when saying ' this weekend', you should assume they are talking with the current date in mind as a reference.";
     let system = instructions || "You are a helpful assistant. When you use a tool to answer a question do not explicitly comment on the result of the tool call unless the user has explicitly you to do something with the result.";
+    if (user?.personal_system_prompt?.trim()) {
+      system += "\n\nUser preferences:\n" + user.personal_system_prompt.trim();
+    }
     system += "\n\n" + genericContext;
     const includesContextSearchTool = currentTools?.some(
       (tool7) => tool7.name.toLowerCase().includes("context_search") || tool7.id.includes("context_search") || tool7.type === "context"
@@ -13816,7 +14339,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
       },
       // provide more loops for skills because they are more complex to execute
       // todo allow configuring this per skill
-      stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || currentSkills?.length ? 10 : 5)]
+      stopWhen: [(0, import_ai9.stepCountIs)(maxStepCount || currentSkills?.length ? 10 : 5), (0, import_ai9.hasToolCall)("image_generation")]
     });
     return {
       stream: result,
@@ -14026,80 +14549,547 @@ async function synthesizeSpeech(args) {
   return Buffer.from(arrayBuf);
 }
 
-// src/exulu/routes.ts
-init_tags();
-var import_multer = __toESM(require("multer"), 1);
-
-// src/utils/check-provider-rate-limit.ts
+// src/exulu/image-generation.ts
 init_cjs_shims();
-var checkProviderRateLimit = async (provider) => {
-  if (provider.rateLimit) {
-    console.log("[EXULU] rate limiting provider.", provider.rateLimit);
-    const limit = await providerRateLimiter(
-      provider.rateLimit.name || provider.id,
-      provider.rateLimit.rate_limit.time,
-      provider.rateLimit.rate_limit.limit,
-      1
-    );
-    if (!limit.status) {
-      throw new Error("Rate limit exceeded.");
-    }
+var ImageGenerationError = class extends Error {
+  constructor(upstreamStatus, message) {
+    super(message);
+    this.upstreamStatus = upstreamStatus;
+    this.name = "ImageGenerationError";
   }
 };
-var providerRateLimiter = async (key2, windowSeconds, limit, points) => {
-  try {
-    const { client: client2 } = await redisClient();
-    if (!client2) {
-      console.warn("[EXULU] Rate limiting disabled - Redis not available");
-      return {
-        status: true,
-        retryAfter: null
-      };
-    }
-    const redisKey = `exulu/${key2}`;
-    const current = await client2.incrBy(redisKey, points);
-    if (current === points) {
-      await client2.expire(redisKey, windowSeconds);
-    }
-    if (current > limit) {
-      const ttl = await client2.ttl(redisKey);
-      return {
-        status: false,
-        retryAfter: ttl
-      };
+var resolveProxyConfig = () => {
+  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+  const port = process.env.LITELLM_PORT ?? "4000";
+  const masterKey = process.env.LITELLM_MASTER_KEY;
+  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
+  return { host, port, masterKey };
+};
+var normalizeDataEntries = async (data) => {
+  const out = [];
+  for (const entry of data) {
+    let buffer;
+    let contentType = "image/png";
+    let extension = "png";
+    if (entry.b64_json) {
+      buffer = Buffer.from(entry.b64_json, "base64");
+    } else if (entry.url) {
+      const upstream = await fetch(entry.url);
+      if (!upstream.ok) {
+        throw new ImageGenerationError(
+          upstream.status,
+          `Failed to download generated image from ${entry.url}: ${upstream.status} ${upstream.statusText}`
+        );
+      }
+      const ct = upstream.headers.get("content-type");
+      if (ct && ct.startsWith("image/")) {
+        contentType = ct;
+        const inferred = ct.split("/")[1]?.split(";")[0]?.trim();
+        if (inferred) extension = inferred === "jpeg" ? "jpg" : inferred;
+      }
+      buffer = Buffer.from(await upstream.arrayBuffer());
+    } else {
+      throw new ImageGenerationError(
+        0,
+        "LiteLLM image response entry contained neither b64_json nor url."
+      );
     }
-    return {
-      status: true,
-      retryAfter: null
-    };
-  } catch (error) {
-    console.error("[EXULU] Rate limiting error:", error);
-    return {
-      status: true,
-      retryAfter: null
-    };
+    out.push({ buffer, contentType, extension, revisedPrompt: entry.revised_prompt });
   }
+  return out;
 };
-
-// src/utils/check-api-key-scope.ts
-init_cjs_shims();
-function checkApiKeyScope(user, agentId) {
-  if (!user || user.type !== "api") return { allowed: true };
-  if (!user.scope_mode || user.scope_mode === "admin") return { allowed: true };
-  if (user.scope_mode === "agents") {
-    const ids = Array.isArray(user.agent_ids) ? user.agent_ids : [];
-    if (!ids.includes(agentId)) {
-      return {
-        allowed: false,
-        reason: `API key is not scoped to agent ${agentId}.`,
-        code: 403
-      };
-    }
-    return { allowed: true };
+async function generateImage(args) {
+  if (!args.model) throw new Error("model is required");
+  if (!args.prompt) throw new Error("prompt is required");
+  const cfg = resolveProxyConfig();
+  const body = {
+    model: args.model,
+    prompt: args.prompt
+  };
+  if (args.size) body.size = args.size;
+  if (args.quality) body.quality = args.quality;
+  if (args.n) body.n = args.n;
+  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/generations`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${cfg.masterKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body),
+    signal: args.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ImageGenerationError(
+      res.status,
+      `LiteLLM image generation failed (status ${res.status}): ${text}`.trim()
+    );
   }
-  return { allowed: false, reason: "Unknown scope_mode.", code: 401 };
-}
-
+  const json = await res.json();
+  if (!json?.data || json.data.length === 0) {
+    throw new ImageGenerationError(
+      res.status,
+      "LiteLLM returned no image data in the response."
+    );
+  }
+  return normalizeDataEntries(json.data);
+}
+async function editImage(args) {
+  if (!args.model) throw new Error("model is required");
+  if (!args.prompt) throw new Error("prompt is required");
+  if (!args.references || args.references.length === 0) {
+    throw new Error("at least one reference image is required");
+  }
+  const cfg = resolveProxyConfig();
+  const form = new FormData();
+  form.append("model", args.model);
+  form.append("prompt", args.prompt);
+  if (args.n != null) form.append("n", String(args.n));
+  if (args.size) form.append("size", args.size);
+  if (args.quality) form.append("quality", args.quality);
+  form.append("response_format", "b64_json");
+  for (const ref of args.references) {
+    form.append(
+      "image",
+      new Blob([ref.buffer], { type: ref.mimetype ?? "image/png" }),
+      ref.filename
+    );
+  }
+  if (args.mask) {
+    form.append(
+      "mask",
+      new Blob([args.mask.buffer], { type: args.mask.mimetype ?? "image/png" }),
+      args.mask.filename
+    );
+  }
+  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/edits`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${cfg.masterKey}` },
+    body: form,
+    signal: args.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ImageGenerationError(
+      res.status,
+      `LiteLLM image edit failed (status ${res.status}): ${text}`.trim()
+    );
+  }
+  const json = await res.json();
+  if (!json?.data || json.data.length === 0) {
+    throw new ImageGenerationError(
+      res.status,
+      "LiteLLM returned no image data in the edit response."
+    );
+  }
+  return normalizeDataEntries(json.data);
+}
+
+// src/exulu/litellm/parse-image-models.ts
+init_cjs_shims();
+var import_node_fs5 = require("fs");
+var stripComment = (line) => {
+  const idx = line.indexOf("#");
+  return idx >= 0 ? line.slice(0, idx) : line;
+};
+var parseInlineArray = (raw) => {
+  const m = raw.trim().match(/^\[(.*)\]$/);
+  if (!m) return void 0;
+  const inner = m[1] ?? "";
+  if (!inner.trim()) return [];
+  return inner.split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter((s) => s.length > 0);
+};
+var parseBool = (raw) => {
+  const v = raw.trim().toLowerCase();
+  if (v === "true" || v === "yes") return true;
+  if (v === "false" || v === "no") return false;
+  return void 0;
+};
+var parseInt10 = (raw) => {
+  const n = Number(raw.trim());
+  return Number.isInteger(n) ? n : void 0;
+};
+var parseImageGenerationModels = (configPath) => {
+  if (!(0, import_node_fs5.existsSync)(configPath)) return [];
+  const text = (0, import_node_fs5.readFileSync)(configPath, "utf8");
+  const lines = text.split("\n");
+  const entries = [];
+  let current;
+  for (const rawLine of lines) {
+    const noComment = stripComment(rawLine);
+    if (!noComment.trim()) continue;
+    const indent = (rawLine.match(/^\s*/)?.[0] ?? "").length;
+    const modelNameMatch = noComment.match(
+      /^\s*-\s*model_name\s*:\s*["']?([^"'\s#]+)["']?\s*$/
+    );
+    if (modelNameMatch) {
+      if (current) entries.push(current);
+      current = { model_name: modelNameMatch[1], indent };
+      continue;
+    }
+    if (!current) continue;
+    if (indent <= current.indent && !/^\s*-\s/.test(rawLine)) {
+      entries.push(current);
+      current = void 0;
+      continue;
+    }
+    const kvMatch = noComment.match(/^\s*(\w+)\s*:\s*(.+?)\s*$/);
+    if (!kvMatch) continue;
+    const key2 = kvMatch[1] ?? "";
+    const rawValue = kvMatch[2] ?? "";
+    switch (key2) {
+      case "type": {
+        current.type = rawValue.replace(/^["']|["']$/g, "").trim();
+        break;
+      }
+      case "sizes": {
+        current.sizes = parseInlineArray(rawValue);
+        break;
+      }
+      case "qualities": {
+        current.qualities = parseInlineArray(rawValue);
+        break;
+      }
+      case "supports_edit": {
+        current.supports_edit = parseBool(rawValue);
+        break;
+      }
+      case "max_n": {
+        current.max_n = parseInt10(rawValue);
+        break;
+      }
+    }
+  }
+  if (current) entries.push(current);
+  const imageEntries = entries.filter((e) => e.type === "image_generation");
+  const errors = [];
+  const validated = [];
+  for (const e of imageEntries) {
+    const modelErrs = [];
+    if (!Array.isArray(e.sizes) || e.sizes.length === 0) {
+      modelErrs.push(
+        'model_info.sizes must be a non-empty inline YAML array of strings, e.g. `sizes: ["1024x1024", "1024x1536"]`'
+      );
+    }
+    if (!Array.isArray(e.qualities) || e.qualities.length === 0) {
+      modelErrs.push(
+        'model_info.qualities must be a non-empty inline YAML array of strings, e.g. `qualities: ["auto", "high"]`'
+      );
+    }
+    if (typeof e.supports_edit !== "boolean") {
+      modelErrs.push(
+        "model_info.supports_edit must be a boolean (true/false)"
+      );
+    }
+    if (typeof e.max_n !== "number" || !Number.isInteger(e.max_n) || e.max_n < 1) {
+      modelErrs.push("model_info.max_n must be an integer \u2265 1");
+    }
+    if (modelErrs.length > 0) {
+      errors.push(
+        `  - "${e.model_name}":
+      - ${modelErrs.join("\n      - ")}`
+      );
+      continue;
+    }
+    validated.push({
+      model_name: e.model_name,
+      sizes: e.sizes,
+      qualities: e.qualities,
+      supports_edit: e.supports_edit,
+      max_n: e.max_n
+    });
+  }
+  if (errors.length > 0) {
+    throw new Error(
+      `[EXULU] config.litellm.yaml has image-generation models with missing or invalid model_info keys. Fix and restart Exulu:
+${errors.join("\n")}
+See docs/superpowers/specs/2026-05-31-in-chat-image-generation-design.md for the required schema.`
+    );
+  }
+  return validated;
+};
+
+// src/exulu/routes.ts
+var import_node_path5 = require("path");
+
+// src/utils/python-setup.ts
+init_cjs_shims();
+var import_child_process = require("child_process");
+var import_util = require("util");
+var import_path = require("path");
+var import_fs3 = require("fs");
+var import_url = require("url");
+var execAsync4 = (0, import_util.promisify)(import_child_process.exec);
+function getPackageRoot() {
+  const currentFile = (0, import_url.fileURLToPath)(importMetaUrl);
+  let currentDir = (0, import_path.dirname)(currentFile);
+  let attempts = 0;
+  const maxAttempts = 10;
+  while (attempts < maxAttempts) {
+    const packageJsonPath = (0, import_path.join)(currentDir, "package.json");
+    if ((0, import_fs3.existsSync)(packageJsonPath)) {
+      try {
+        const packageJson = JSON.parse((0, import_fs3.readFileSync)(packageJsonPath, "utf-8"));
+        if (packageJson.name === "@exulu/backend") {
+          return currentDir;
+        }
+      } catch {
+      }
+    }
+    const parentDir = (0, import_path.resolve)(currentDir, "..");
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+    attempts++;
+  }
+  const fallback = (0, import_path.resolve)((0, import_path.dirname)((0, import_url.fileURLToPath)(importMetaUrl)), "../..");
+  return fallback;
+}
+function getSetupScriptPath(packageRoot) {
+  return (0, import_path.resolve)(packageRoot, "ee/python/setup.sh");
+}
+function getVenvPath(packageRoot) {
+  return (0, import_path.resolve)(packageRoot, "ee/python/.venv");
+}
+function isPythonEnvironmentSetup(packageRoot) {
+  const root = packageRoot ?? getPackageRoot();
+  const venvPath = getVenvPath(root);
+  const pythonPath = (0, import_path.join)(venvPath, "bin", "python");
+  return (0, import_fs3.existsSync)(venvPath) && (0, import_fs3.existsSync)(pythonPath);
+}
+async function setupPythonEnvironment(options = {}) {
+  const {
+    packageRoot = getPackageRoot(),
+    force = false,
+    verbose = false,
+    timeout = 6e5
+    // 10 minutes
+  } = options;
+  if (!force && isPythonEnvironmentSetup(packageRoot)) {
+    if (verbose) {
+      console.log("\u2713 Python environment already set up");
+    }
+    return {
+      success: true,
+      message: "Python environment already exists",
+      alreadyExists: true
+    };
+  }
+  const setupScriptPath = getSetupScriptPath(packageRoot);
+  if (!(0, import_fs3.existsSync)(setupScriptPath)) {
+    return {
+      success: false,
+      message: `Setup script not found at: ${setupScriptPath}`,
+      alreadyExists: false
+    };
+  }
+  try {
+    if (verbose) {
+      console.log("Setting up Python environment...");
+    }
+    const { stdout, stderr } = await execAsync4(`bash "${setupScriptPath}"`, {
+      cwd: packageRoot,
+      timeout,
+      env: {
+        ...process.env,
+        // Ensure script can write to the directory
+        PYTHONDONTWRITEBYTECODE: "1"
+      },
+      maxBuffer: 10 * 1024 * 1024
+      // 10MB buffer
+    });
+    const output = stdout + stderr;
+    const versionMatch = output.match(/Python (\d+\.\d+\.\d+)/);
+    const pythonVersion = versionMatch ? versionMatch[1] : void 0;
+    if (verbose) {
+      console.log(output);
+    }
+    return {
+      success: true,
+      message: "Python environment set up successfully",
+      alreadyExists: false,
+      pythonVersion,
+      output
+    };
+  } catch (error) {
+    const errorOutput = error.stdout + error.stderr;
+    return {
+      success: false,
+      message: `Setup failed: ${error.message}`,
+      alreadyExists: false,
+      output: errorOutput
+    };
+  }
+}
+function getPythonSetupInstructions() {
+  return `
+Python environment not set up. Please run one of the following commands:
+
+Option 1 (Automatic):
+  import { setupPythonEnvironment } from '@exulu/backend';
+  await setupPythonEnvironment();
+
+Option 2 (Manual - for package consumers):
+  npx @exulu/backend setup-python
+
+Option 3 (Manual - for contributors):
+  npm run python:setup
+
+These commands will automatically create a Python virtual environment (.venv)
+in the @exulu/backend package and install all required dependencies.
+
+Requirements:
+  - Python 3.10 or higher must be installed
+  - pip must be available
+  - venv module must be available (for creating virtual environments)
+
+If Python dependencies are not installed, install them first, then run one of the commands above:
+  - macOS: brew install python@3.12
+  - Ubuntu/Debian: sudo apt-get install python3.12 python3-pip python3-venv
+  - Alpine Linux: apk add python3 py3-pip python3-dev
+  - Windows: Download from https://www.python.org/downloads/
+
+Note: In Docker containers, ensure you install all three components:
+  Ubuntu/Debian: apt-get install -y python3 python3-pip python3-venv
+  Alpine: apk add python3 py3-pip python3-dev
+`.trim();
+}
+async function validatePythonEnvironment(packageRoot, checkPackages = true) {
+  const root = packageRoot ?? getPackageRoot();
+  const venvPath = getVenvPath(root);
+  const pythonPath = (0, import_path.join)(venvPath, "bin", "python");
+  if (!(0, import_fs3.existsSync)(venvPath)) {
+    return {
+      valid: false,
+      message: getPythonSetupInstructions()
+    };
+  }
+  if (!(0, import_fs3.existsSync)(pythonPath)) {
+    return {
+      valid: false,
+      message: "Python virtual environment is corrupted. Please run:\n  await setupPythonEnvironment({ force: true })"
+    };
+  }
+  try {
+    await execAsync4(`"${pythonPath}" --version`, { cwd: root });
+  } catch {
+    return {
+      valid: false,
+      message: "Python executable is not working. Please run:\n  await setupPythonEnvironment({ force: true })"
+    };
+  }
+  if (checkPackages) {
+    const criticalPackages = ["docling", "transformers"];
+    const missingPackages = [];
+    for (const pkg of criticalPackages) {
+      try {
+        await execAsync4(`"${pythonPath}" -c "import ${pkg}"`, {
+          cwd: root,
+          timeout: 1e4
+          // 10 second timeout per import check
+        });
+      } catch {
+        missingPackages.push(pkg);
+      }
+    }
+    if (missingPackages.length > 0) {
+      return {
+        valid: false,
+        message: `Python environment exists but required packages are not installed: ${missingPackages.join(", ")}
+
+This usually happens when:
+1. The .venv folder was copied but dependencies were not installed
+2. The package was installed via npm but setup script was not run
+
+Please run:
+  await setupPythonEnvironment({ force: true })
+
+Or manually run the setup script:
+  bash ` + getSetupScriptPath(root)
+      };
+    }
+  }
+  return {
+    valid: true,
+    message: "Python environment is valid"
+  };
+}
+
+// src/exulu/routes.ts
+init_tags();
+var import_multer = __toESM(require("multer"), 1);
+
+// src/utils/check-provider-rate-limit.ts
+init_cjs_shims();
+var checkProviderRateLimit = async (provider) => {
+  if (provider.rateLimit) {
+    console.log("[EXULU] rate limiting provider.", provider.rateLimit);
+    const limit = await providerRateLimiter(
+      provider.rateLimit.name || provider.id,
+      provider.rateLimit.rate_limit.time,
+      provider.rateLimit.rate_limit.limit,
+      1
+    );
+    if (!limit.status) {
+      throw new Error("Rate limit exceeded.");
+    }
+  }
+};
+var providerRateLimiter = async (key2, windowSeconds, limit, points) => {
+  try {
+    const { client: client2 } = await redisClient();
+    if (!client2) {
+      console.warn("[EXULU] Rate limiting disabled - Redis not available");
+      return {
+        status: true,
+        retryAfter: null
+      };
+    }
+    const redisKey = `exulu/${key2}`;
+    const current = await client2.incrBy(redisKey, points);
+    if (current === points) {
+      await client2.expire(redisKey, windowSeconds);
+    }
+    if (current > limit) {
+      const ttl = await client2.ttl(redisKey);
+      return {
+        status: false,
+        retryAfter: ttl
+      };
+    }
+    return {
+      status: true,
+      retryAfter: null
+    };
+  } catch (error) {
+    console.error("[EXULU] Rate limiting error:", error);
+    return {
+      status: true,
+      retryAfter: null
+    };
+  }
+};
+
+// src/utils/check-api-key-scope.ts
+init_cjs_shims();
+function checkApiKeyScope(user, agentId) {
+  if (!user || user.type !== "api") return { allowed: true };
+  if (!user.scope_mode || user.scope_mode === "admin") return { allowed: true };
+  if (user.scope_mode === "agents") {
+    const ids = Array.isArray(user.agent_ids) ? user.agent_ids : [];
+    if (!ids.includes(agentId)) {
+      return {
+        allowed: false,
+        reason: `API key is not scoped to agent ${agentId}.`,
+        code: 403
+      };
+    }
+    return { allowed: true };
+  }
+  return { allowed: false, reason: "Unknown scope_mode.", code: 401 };
+}
+
 // src/utils/check-agent-rate-limit.ts
 init_cjs_shims();
 function resolveCallerId(req, userId) {
@@ -14702,7 +15692,7 @@ var REQUEST_SIZE_LIMIT = "50mb";
 var getExuluVersionNumber = async () => {
   try {
     const path3 = process.cwd();
-    const packageJson = import_fs3.default.readFileSync(path3 + "/package.json", "utf8");
+    const packageJson = import_fs4.default.readFileSync(path3 + "/package.json", "utf8");
     const packageData = JSON.parse(packageJson);
     const exuluVersion = packageData.dependencies["@exulu/backend"];
     console.log(`[EXULU] Installed exulu-backend version: ${exuluVersion}`);
@@ -14736,7 +15726,8 @@ var {
   contextPresetsSchema: contextPresetsSchema2,
   embedderSettingsSchema: embedderSettingsSchema2,
   promptFavoritesSchema: promptFavoritesSchema2,
-  statisticsSchema: statisticsSchema2
+  statisticsSchema: statisticsSchema2,
+  transcriptionJobsSchema: transcriptionJobsSchema2
 } = coreSchemas.get();
 var createExpressRoutes = async (app, providers, tools, contexts, config, evals, tracer, queues2, rerankers) => {
   let corsOptions = {
@@ -14794,7 +15785,8 @@ var createExpressRoutes = async (app, providers, tools, contexts, config, evals,
       variablesSchema2(),
       workflowTemplatesSchema2(),
       statisticsSchema2(),
-      rbacSchema2()
+      rbacSchema2(),
+      transcriptionJobsSchema2()
     ],
     contexts ?? [],
     providers,
@@ -15542,81 +16534,562 @@ ${customInstructions}` : agent.instructions;
         res.status(503).json({ detail: "Transcription service is not ready. Try again shortly." });
         return;
       }
-      const language = typeof req.body?.language === "string" && /^[a-z]{2}$/.test(req.body.language) ? req.body.language : void 0;
-      try {
-        const { text } = await transcribeAudio({ file, language });
-        res.status(200).json({ text });
-      } catch (err) {
-        if (err instanceof TranscriptionError) {
-          const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
-          res.status(code).json({ detail: err.message });
-          return;
-        }
-        console.error("[EXULU] /transcribe failed", err);
-        res.status(500).json({
-          detail: err instanceof Error ? err.message : "Transcription failed."
-        });
-      }
+      const language = typeof req.body?.language === "string" && /^[a-z]{2}$/.test(req.body.language) ? req.body.language : void 0;
+      try {
+        const { text } = await transcribeAudio({ file, language });
+        res.status(200).json({ text });
+      } catch (err) {
+        if (err instanceof TranscriptionError) {
+          const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+          res.status(code).json({ detail: err.message });
+          return;
+        }
+        console.error("[EXULU] /transcribe failed", err);
+        res.status(500).json({
+          detail: err instanceof Error ? err.message : "Transcription failed."
+        });
+      }
+    }
+  );
+  const MAX_TTS_INPUT_CHARS = 4e3;
+  app.post(
+    "/speech",
+    import_body_parser.default.json({ limit: "64kb" }),
+    async (req, res) => {
+      if (!isLiteLLMEnabled() || !process.env.TTS_MODEL || !process.env.TTS_VOICE) {
+        res.status(503).json({
+          detail: "Text-to-speech is not enabled on this deployment. Set EXULU_USE_LITELLM=true, TTS_MODEL, and TTS_VOICE in the environment."
+        });
+        return;
+      }
+      const authenticationResult = await requestValidators.authenticate(req);
+      if (!authenticationResult.user?.id) {
+        res.status(authenticationResult.code || 401).json({ detail: authenticationResult.message });
+        return;
+      }
+      const text = typeof req.body?.text === "string" ? req.body.text.trim() : "";
+      if (!text) {
+        res.status(400).json({ detail: "Missing 'text' in request body." });
+        return;
+      }
+      if (text.length > MAX_TTS_INPUT_CHARS) {
+        res.status(400).json({
+          detail: `Text too long (${text.length} chars). Max ${MAX_TTS_INPUT_CHARS}.`
+        });
+        return;
+      }
+      try {
+        await Promise.race([
+          waitForLiteLLMReady(),
+          new Promise(
+            (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
+          )
+        ]);
+      } catch {
+        res.status(503).json({ detail: "Speech service is not ready. Try again shortly." });
+        return;
+      }
+      try {
+        const audio = await synthesizeSpeech({ text });
+        res.status(200);
+        res.setHeader("Content-Type", "audio/mpeg");
+        res.setHeader("Content-Length", String(audio.length));
+        res.setHeader("Cache-Control", "no-store");
+        res.send(audio);
+      } catch (err) {
+        if (err instanceof SpeechError) {
+          const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+          res.status(code).json({ detail: err.message });
+          return;
+        }
+        console.error("[EXULU] /speech failed", err);
+        res.status(500).json({
+          detail: err instanceof Error ? err.message : "Speech generation failed."
+        });
+      }
+    }
+  );
+  const imageModelsByName = (() => {
+    if (!isLiteLLMEnabled() || !config?.fileUploads) return /* @__PURE__ */ new Map();
+    try {
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path5.resolve)(getPackageRoot(), "./config.litellm.yaml");
+      const models2 = parseImageGenerationModels(configPath);
+      return new Map(models2.map((m) => [m.model_name, m]));
+    } catch (err) {
+      console.error(
+        "[EXULU] Skipping /images/* routes due to config.litellm.yaml error:",
+        err.message
+      );
+      return /* @__PURE__ */ new Map();
+    }
+  })();
+  const imageRoutesEnabled = isLiteLLMEnabled() && !!config?.fileUploads?.s3region && !!config?.fileUploads?.s3key && !!config?.fileUploads?.s3secret && !!config?.fileUploads?.s3Bucket && imageModelsByName.size > 0;
+  const respond503ImagesNotEnabled = (res) => {
+    res.status(503).json({
+      detail: "Image generation is not enabled on this deployment. Requires EXULU_USE_LITELLM=true, S3 fileUploads configuration, and at least one model in config.litellm.yaml with model_info.type=image_generation."
+    });
+  };
+  const loadAuthedSession = async (req, res, sessionId, rights) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code || 401).json({ detail: authResult.message });
+      return null;
+    }
+    const { db: db2 } = await postgresClient();
+    const session = await db2.from("agent_sessions").where({ id: sessionId }).first();
+    if (!session) {
+      res.status(404).json({ detail: `Session ${sessionId} not found.` });
+      return null;
+    }
+    const sessionRbac = await RBACResolver(
+      db2,
+      "agent_sessions",
+      session.id,
+      session.rights_mode || "private"
+    );
+    const allowed = await checkRecordAccess(
+      { ...session, RBAC: sessionRbac },
+      rights,
+      authResult.user
+    );
+    if (!allowed) {
+      res.status(403).json({ detail: `You don't have ${rights} access to this session.` });
+      return null;
+    }
+    return { user: authResult.user, session, db: db2 };
+  };
+  const loadStyle = async (db2, styleId, user, res) => {
+    if (!styleId) return { markdown: null, id: null };
+    const row = await db2.from("platform_configurations").where({ id: styleId }).first();
+    if (!row) {
+      res.status(404).json({ detail: `Style ${styleId} not found.` });
+      return "error";
+    }
+    const rbac = await RBACResolver(
+      db2,
+      "platform_configurations",
+      row.id,
+      row.rights_mode || "private"
+    );
+    const allowed = await checkRecordAccess(
+      { ...row, RBAC: rbac },
+      "read",
+      user
+    );
+    if (!allowed) {
+      res.status(403).json({ detail: "You don't have access to that style." });
+      return "error";
+    }
+    const value = typeof row.config_value === "string" ? (() => {
+      try {
+        return JSON.parse(row.config_value);
+      } catch {
+        return null;
+      }
+    })() : row.config_value;
+    return { markdown: value?.markdown ?? null, id: row.id };
+  };
+  const validateGenerationParams = (body, res) => {
+    const { model: modelName, prompt, n, size, quality } = body || {};
+    const model = typeof modelName === "string" ? imageModelsByName.get(modelName) : void 0;
+    if (!model) {
+      res.status(400).json({
+        detail: `Unknown image-generation model "${modelName}". Available: ${[...imageModelsByName.keys()].join(", ")}.`
+      });
+      return null;
+    }
+    if (typeof prompt !== "string" || prompt.trim().length === 0) {
+      res.status(400).json({ detail: "prompt must be a non-empty string." });
+      return null;
+    }
+    const requestedN = typeof n === "number" ? n : 1;
+    if (!Number.isInteger(requestedN) || requestedN < 1 || requestedN > model.max_n) {
+      res.status(400).json({
+        detail: `n must be an integer between 1 and ${model.max_n} for model ${model.model_name}.`
+      });
+      return null;
+    }
+    if (size && !model.sizes.includes(size)) {
+      res.status(400).json({
+        detail: `size "${size}" is not supported by ${model.model_name}. Allowed: ${model.sizes.join(", ")}.`
+      });
+      return null;
+    }
+    if (quality && !model.qualities.includes(quality)) {
+      res.status(400).json({
+        detail: `quality "${quality}" is not supported by ${model.model_name}. Allowed: ${model.qualities.join(", ")}.`
+      });
+      return null;
+    }
+    return { model, prompt, n: requestedN, size, quality };
+  };
+  const uploadGeneratedImages = async (images, sessionId, toolCallId, userId) => {
+    if (!config?.fileUploads) {
+      throw new Error("File uploads not configured.");
+    }
+    const keys = [];
+    const revisedPrompts = [];
+    for (const img of images) {
+      const filename = `${(0, import_node_crypto5.randomUUID)()}.${img.extension}`;
+      const key2 = `sessions/${sessionId}/images/${toolCallId}/${filename}`;
+      const fullKey = await uploadFile(
+        img.buffer,
+        key2,
+        config,
+        { contentType: img.contentType },
+        userId
+      );
+      keys.push(fullKey);
+      revisedPrompts.push(img.revisedPrompt ?? null);
+    }
+    const presignedUrls = await Promise.all(
+      keys.map((fullKey) => {
+        const slash = fullKey.indexOf("/");
+        const bucket = slash > 0 ? fullKey.slice(0, slash) : config.fileUploads.s3Bucket;
+        const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+        return getPresignedUrl(bucket, objectKey, config);
+      })
+    );
+    return { keys, revisedPrompts, presignedUrls };
+  };
+  app.post("/images/generate", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, styleId } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const params = validateGenerationParams(req.body, res);
+    if (!params) return;
+    const style = await loadStyle(authed.db, styleId, authed.user, res);
+    if (style === "error") return;
+    const finalPrompt = style.markdown ? `${params.prompt}
+
+${style.markdown}` : params.prompt;
+    try {
+      await Promise.race([
+        waitForLiteLLMReady(),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
+        )
+      ]);
+    } catch {
+      res.status(503).json({ detail: "Image service is not ready. Try again shortly." });
+      return;
+    }
+    const abortController = new AbortController();
+    req.on("close", () => abortController.abort());
+    try {
+      const images = await generateImage({
+        model: params.model.model_name,
+        prompt: finalPrompt,
+        n: params.n,
+        size: params.size,
+        quality: params.quality,
+        signal: abortController.signal
+      });
+      const { keys, revisedPrompts, presignedUrls } = await uploadGeneratedImages(
+        images,
+        sessionId,
+        toolCallId,
+        authed.user.id
+      );
+      const [row] = await authed.db("image_generations").insert({
+        session_id: sessionId,
+        tool_call_id: toolCallId,
+        user_id: authed.user.id,
+        operation: "generate",
+        model: params.model.model_name,
+        prompt: params.prompt,
+        applied_style_id: style.id,
+        applied_style_markdown: style.markdown,
+        size: params.size,
+        quality: params.quality,
+        n: params.n,
+        image_keys: JSON.stringify(keys),
+        revised_prompts: JSON.stringify(revisedPrompts),
+        selected: false
+      }).returning("*");
+      res.status(200).json({
+        generationId: row.id,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: presignedUrls[i],
+          revisedPrompt: revisedPrompts[i]
+        }))
+      });
+    } catch (err) {
+      if (abortController.signal.aborted) return;
+      if (err instanceof ImageGenerationError) {
+        const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+        res.status(code).json({ detail: err.message });
+        return;
+      }
+      console.error("[EXULU] /images/generate failed", err);
+      res.status(500).json({
+        detail: err instanceof Error ? err.message : "Image generation failed."
+      });
     }
-  );
-  const MAX_TTS_INPUT_CHARS = 4e3;
-  app.post(
-    "/speech",
-    import_body_parser.default.json({ limit: "64kb" }),
-    async (req, res) => {
-      if (!isLiteLLMEnabled() || !process.env.TTS_MODEL || !process.env.TTS_VOICE) {
-        res.status(503).json({
-          detail: "Text-to-speech is not enabled on this deployment. Set EXULU_USE_LITELLM=true, TTS_MODEL, and TTS_VOICE in the environment."
-        });
+  });
+  app.post("/images/edit", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, styleId, referenceImageKeys, maskKey } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    if (!Array.isArray(referenceImageKeys) || referenceImageKeys.length === 0) {
+      res.status(400).json({ detail: "referenceImageKeys must be a non-empty array." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const params = validateGenerationParams(req.body, res);
+    if (!params) return;
+    if (!params.model.supports_edit) {
+      res.status(400).json({
+        detail: `Model ${params.model.model_name} does not support image editing.`
+      });
+      return;
+    }
+    const userPrefix = `user_${authed.user.id}/`;
+    const sessionPrefix = `sessions/${sessionId}/`;
+    const ownsKey = (k) => k.includes(userPrefix) || k.includes(sessionPrefix);
+    if (!referenceImageKeys.every((k) => typeof k === "string" && ownsKey(k))) {
+      res.status(403).json({ detail: "One or more reference image keys are not accessible." });
+      return;
+    }
+    if (maskKey && (typeof maskKey !== "string" || !ownsKey(maskKey))) {
+      res.status(403).json({ detail: "Mask image is not accessible." });
+      return;
+    }
+    const style = await loadStyle(authed.db, styleId, authed.user, res);
+    if (style === "error") return;
+    const finalPrompt = style.markdown ? `${params.prompt}
+
+${style.markdown}` : params.prompt;
+    try {
+      await Promise.race([
+        waitForLiteLLMReady(),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
+        )
+      ]);
+    } catch {
+      res.status(503).json({ detail: "Image service is not ready. Try again shortly." });
+      return;
+    }
+    const fetchRef = async (fullKey) => {
+      const slash = fullKey.indexOf("/");
+      const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+      const buf = await getS3ObjectBytes(objectKey, config);
+      const filename = fullKey.split("/").pop() ?? "image.png";
+      const ext = filename.split(".").pop()?.toLowerCase() ?? "png";
+      const mimetype = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : `image/${ext}`;
+      return { buffer: buf, filename, mimetype };
+    };
+    const abortController = new AbortController();
+    req.on("close", () => abortController.abort());
+    try {
+      const references = await Promise.all(referenceImageKeys.map(fetchRef));
+      const mask = maskKey ? await fetchRef(maskKey) : void 0;
+      const images = await editImage({
+        model: params.model.model_name,
+        prompt: finalPrompt,
+        references,
+        mask,
+        n: params.n,
+        size: params.size,
+        quality: params.quality,
+        signal: abortController.signal
+      });
+      const { keys, revisedPrompts, presignedUrls } = await uploadGeneratedImages(
+        images,
+        sessionId,
+        toolCallId,
+        authed.user.id
+      );
+      const [row] = await authed.db("image_generations").insert({
+        session_id: sessionId,
+        tool_call_id: toolCallId,
+        user_id: authed.user.id,
+        operation: "edit",
+        model: params.model.model_name,
+        prompt: params.prompt,
+        applied_style_id: style.id,
+        applied_style_markdown: style.markdown,
+        size: params.size,
+        quality: params.quality,
+        n: params.n,
+        reference_image_keys: JSON.stringify(referenceImageKeys),
+        mask_image_key: maskKey,
+        image_keys: JSON.stringify(keys),
+        revised_prompts: JSON.stringify(revisedPrompts),
+        selected: false
+      }).returning("*");
+      res.status(200).json({
+        generationId: row.id,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: presignedUrls[i],
+          revisedPrompt: revisedPrompts[i]
+        }))
+      });
+    } catch (err) {
+      if (abortController.signal.aborted) return;
+      if (err instanceof ImageGenerationError) {
+        const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+        res.status(code).json({ detail: err.message });
         return;
       }
-      const authenticationResult = await requestValidators.authenticate(req);
-      if (!authenticationResult.user?.id) {
-        res.status(authenticationResult.code || 401).json({ detail: authenticationResult.message });
+      console.error("[EXULU] /images/edit failed", err);
+      res.status(500).json({
+        detail: err instanceof Error ? err.message : "Image edit failed."
+      });
+    }
+  });
+  app.post("/images/select", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, selections } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    if (!Array.isArray(selections) || selections.length === 0) {
+      res.status(400).json({ detail: "selections must be a non-empty array." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const rows = await authed.db("image_generations").where({ session_id: sessionId, tool_call_id: toolCallId }).select("*");
+    const rowsById = new Map(rows.map((r) => [r.id, r]));
+    const selectedDetails = [];
+    const rowsToMarkSelected = /* @__PURE__ */ new Set();
+    for (const sel of selections) {
+      if (typeof sel?.generationId !== "string" || typeof sel?.imageKey !== "string") {
+        res.status(400).json({ detail: "Each selection needs generationId + imageKey." });
         return;
       }
-      const text = typeof req.body?.text === "string" ? req.body.text.trim() : "";
-      if (!text) {
-        res.status(400).json({ detail: "Missing 'text' in request body." });
+      const row = rowsById.get(sel.generationId);
+      if (!row) {
+        res.status(404).json({ detail: `Generation ${sel.generationId} not found in this tool call.` });
         return;
       }
-      if (text.length > MAX_TTS_INPUT_CHARS) {
-        res.status(400).json({
-          detail: `Text too long (${text.length} chars). Max ${MAX_TTS_INPUT_CHARS}.`
-        });
+      const keys = Array.isArray(row.image_keys) ? row.image_keys : (() => {
+        try {
+          return JSON.parse(row.image_keys);
+        } catch {
+          return [];
+        }
+      })();
+      if (!keys.includes(sel.imageKey)) {
+        res.status(400).json({ detail: `imageKey not part of generation ${sel.generationId}.` });
         return;
       }
+      const slash = sel.imageKey.indexOf("/");
+      const bucket = slash > 0 ? sel.imageKey.slice(0, slash) : config.fileUploads.s3Bucket;
+      const objectKey = slash > 0 ? sel.imageKey.slice(slash + 1) : sel.imageKey;
+      const presignedUrl = await getPresignedUrl(bucket, objectKey, config);
+      let styleName = null;
+      if (row.applied_style_id) {
+        const styleRow = await authed.db("platform_configurations").where({ id: row.applied_style_id }).first();
+        const parsed = styleRow?.config_value && typeof styleRow.config_value === "string" ? (() => {
+          try {
+            return JSON.parse(styleRow.config_value);
+          } catch {
+            return null;
+          }
+        })() : styleRow?.config_value;
+        styleName = parsed?.name ?? null;
+      }
+      selectedDetails.push({
+        key: sel.imageKey,
+        presignedUrl,
+        prompt: row.prompt,
+        model: row.model,
+        styleName
+      });
+      rowsToMarkSelected.add(row.id);
+    }
+    await authed.db("image_generations").whereIn("id", [...rowsToMarkSelected]).update({ selected: true });
+    const lines = selectedDetails.map(
+      (d) => `- ${d.presignedUrl} (prompt: "${d.prompt}", model: ${d.model}${d.styleName ? `, style: ${d.styleName}` : ""})`
+    );
+    const messageText = "The user generated and selected the following image(s) in this chat:\n" + lines.join("\n");
+    const messageId = (0, import_node_crypto5.randomUUID)();
+    const uiMessage = {
+      id: messageId,
+      role: "system",
+      parts: [{ type: "text", text: messageText }]
+    };
+    await authed.db("agent_messages").insert({
+      content: JSON.stringify(uiMessage),
+      message_id: messageId,
+      session: sessionId,
+      user: authed.user.id
+    });
+    res.status(200).json({ ok: true, systemMessage: uiMessage, selectedImages: selectedDetails });
+  });
+  app.get("/images/history", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : "";
+    const toolCallId = typeof req.query.toolCallId === "string" ? req.query.toolCallId : "";
+    if (!sessionId || !toolCallId) {
+      res.status(400).json({ detail: "sessionId and toolCallId query params are required." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "read");
+    if (!authed) return;
+    const rows = await authed.db("image_generations").where({ session_id: sessionId, tool_call_id: toolCallId }).orderBy("createdAt", "asc").select("*");
+    const parseList = (v) => {
+      if (!v) return [];
+      if (Array.isArray(v)) return v;
       try {
-        await Promise.race([
-          waitForLiteLLMReady(),
-          new Promise(
-            (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
-          )
-        ]);
+        return JSON.parse(v);
       } catch {
-        res.status(503).json({ detail: "Speech service is not ready. Try again shortly." });
-        return;
-      }
-      try {
-        const audio = await synthesizeSpeech({ text });
-        res.status(200);
-        res.setHeader("Content-Type", "audio/mpeg");
-        res.setHeader("Content-Length", String(audio.length));
-        res.setHeader("Cache-Control", "no-store");
-        res.send(audio);
-      } catch (err) {
-        if (err instanceof SpeechError) {
-          const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
-          res.status(code).json({ detail: err.message });
-          return;
-        }
-        console.error("[EXULU] /speech failed", err);
-        res.status(500).json({
-          detail: err instanceof Error ? err.message : "Speech generation failed."
-        });
+        return [];
       }
-    }
-  );
+    };
+    const sign = async (fullKey) => {
+      const slash = fullKey.indexOf("/");
+      const bucket = slash > 0 ? fullKey.slice(0, slash) : config.fileUploads.s3Bucket;
+      const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+      return getPresignedUrl(bucket, objectKey, config);
+    };
+    const history = await Promise.all(rows.map(async (r) => {
+      const keys = parseList(r.image_keys);
+      const refs = parseList(r.reference_image_keys);
+      const revisedPrompts = parseList(r.revised_prompts);
+      const [imageUrls, referenceUrls] = await Promise.all([
+        Promise.all(keys.map(sign)),
+        Promise.all(refs.map(sign))
+      ]);
+      return {
+        generationId: r.id,
+        createdAt: r.createdAt,
+        operation: r.operation,
+        model: r.model,
+        prompt: r.prompt,
+        appliedStyleId: r.applied_style_id ?? null,
+        appliedStyleMarkdown: r.applied_style_markdown ?? null,
+        size: r.size ?? null,
+        quality: r.quality ?? null,
+        n: r.n ?? 1,
+        selected: !!r.selected,
+        error: r.error ?? null,
+        maskImageKey: r.mask_image_key ?? null,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: imageUrls[i],
+          revisedPrompt: revisedPrompts[i] ?? null
+        })),
+        references: refs.map((key2, i) => ({ key: key2, presignedUrl: referenceUrls[i] }))
+      };
+    }));
+    res.status(200).json({ history });
+  });
   app.use("/litellm/:project", async (req, res) => {
     if (!isLiteLLMEnabled()) {
       res.status(503).json({
@@ -18680,7 +20153,7 @@ var internetSearchTool = new ExuluTool({
       } catch (error) {
         if (error instanceof import_perplexity_ai.default.RateLimitError && attempt < maxRetries - 1) {
           const delay = Math.pow(2, attempt) * 1e3 + Math.random() * 1e3;
-          await new Promise((resolve6) => setTimeout(resolve6, delay));
+          await new Promise((resolve7) => setTimeout(resolve7, delay));
           continue;
         }
         throw error;
@@ -18774,21 +20247,341 @@ var emailTool = new ExuluTool({
       tls: {
         rejectUnauthorized: false
       }
-    };
-    if (toolVariablesConfig.allowed_recipient_domains) {
-      const allowedRecipientDomains = toolVariablesConfig.allowed_recipient_domains.split(",");
-      if (!allowedRecipientDomains.some((domain) => recipient.endsWith(`@${domain}`))) {
-        return {
-          result: "Recipient domain not allowed to send emails to."
-        };
+    };
+    if (toolVariablesConfig.allowed_recipient_domains) {
+      const allowedRecipientDomains = toolVariablesConfig.allowed_recipient_domains.split(",");
+      if (!allowedRecipientDomains.some((domain) => recipient.endsWith(`@${domain}`))) {
+        return {
+          result: "Recipient domain not allowed to send emails to."
+        };
+      }
+    }
+    await sendEmail(recipient, subject, html, text, EMAIL_CONFIG);
+    return {
+      result: "Email sent successfully to " + recipient + " with subject " + subject + "."
+    };
+  }
+});
+
+// src/templates/tools/transcribe.ts
+init_cjs_shims();
+init_tool();
+init_supervisor();
+init_uppy();
+var import_node_crypto8 = require("crypto");
+var import_promises3 = require("fs/promises");
+var import_node_path6 = require("path");
+var import_zod20 = require("zod");
+var SANDBOX_ROOT = "/tmp/exulu-sessions";
+var parseSandboxPath = (input) => {
+  const stripped = input.startsWith("file://") ? input.slice("file://".length) : input;
+  if (!stripped.startsWith(`${SANDBOX_ROOT}/`)) return null;
+  const tail = stripped.slice(SANDBOX_ROOT.length + 1);
+  const slash = tail.indexOf("/");
+  if (slash < 1) return null;
+  const sessionId = tail.slice(0, slash);
+  const relPath = tail.slice(slash + 1);
+  if (!relPath) return null;
+  return { sessionId, relPath };
+};
+var audioMimetypeFromExtension = (filename) => {
+  const ext = filename.split(".").pop()?.toLowerCase();
+  switch (ext) {
+    case "mp3":
+      return "audio/mpeg";
+    case "m4a":
+    case "mp4":
+      return "audio/mp4";
+    case "wav":
+      return "audio/wav";
+    case "ogg":
+    case "oga":
+      return "audio/ogg";
+    case "flac":
+      return "audio/flac";
+    case "webm":
+      return "audio/webm";
+    case "aac":
+      return "audio/aac";
+    case "mpga":
+    case "mpeg":
+      return "audio/mpeg";
+    default:
+      throw new Error(
+        `Unable to infer an audio mimetype from filename "${filename}". Supported extensions: mp3, m4a, mp4, wav, ogg, flac, webm, aac, mpga.`
+      );
+  }
+};
+var transcribeTool = new ExuluTool({
+  id: "transcribe_audio",
+  name: "Transcribe Audio",
+  description: "Transcribe an audio file (mp3, wav, m4a, etc.) from a URL to text using the configured speech-to-text model. The transcript is stored as a .txt file on S3 and the URL is returned; use this for clips that may be too long to inline in the conversation.",
+  inputSchema: import_zod20.z.object({
+    audio_url: import_zod20.z.string().describe(
+      "Location of the audio file to transcribe. Accepts a publicly fetchable URL (https URL or presigned S3 URL), or a sandbox path such as '/tmp/exulu-sessions/<sessionId>/<file>' or 'file:///tmp/exulu-sessions/<sessionId>/<file>' \u2014 sandbox paths are resolved to their persisted S3 copy."
+    ),
+    language: import_zod20.z.string().optional().describe(
+      "ISO-639-1 language code of the audio, e.g. 'en' or 'de'. Omit to let the model auto-detect."
+    )
+  }),
+  type: "function",
+  config: [{
+    name: "default_language",
+    description: "ISO-639-1 language code of the audio, e.g. 'en' or 'de'. Omit to let the model auto-detect.",
+    type: "string",
+    default: void 0
+  }],
+  execute: async ({ audio_url, language, user, exuluConfig, sessionID }) => {
+    if (!language && exuluConfig?.default_language) {
+      language = exuluConfig?.default_language;
+    } else {
+      language = "en";
+    }
+    language = exuluConfig?.default_language;
+    console.log("[EXULU] Exulu config", exuluConfig);
+    if (!isLiteLLMEnabled()) {
+      console.error("[EXULU] Speech-to-text is not enabled on this deployment (EXULU_USE_LITELLM is not 'true').");
+      throw new Error(
+        "Speech-to-text is not enabled on this deployment (EXULU_USE_LITELLM is not 'true')."
+      );
+    }
+    if (!process.env.TRANSCRIPTION_MODEL) {
+      console.error("[EXULU] TRANSCRIPTION_MODEL env var is not set.");
+      throw new Error("TRANSCRIPTION_MODEL env var is not set.");
+    }
+    if (!exuluConfig?.fileUploads) {
+      console.error("[EXULU] File uploads are not configured; the transcribe tool requires S3 to store transcripts.");
+      throw new Error(
+        "File uploads are not configured; the transcribe tool requires S3 to store transcripts."
+      );
+    }
+    const sandboxPath = parseSandboxPath(audio_url);
+    let buffer;
+    let mimetype;
+    let originalname;
+    if (sandboxPath) {
+      if (!user?.id) {
+        throw new Error(
+          "Sandbox audio paths require an authenticated user; got no user on the tool call."
+        );
+      }
+      if (sessionID && sandboxPath.sessionId !== sessionID) {
+        throw new Error(
+          `Refusing to transcribe an audio file from a different session's sandbox (path session=${sandboxPath.sessionId}, current session=${sessionID}).`
+        );
+      }
+      const rawKey = `user_${user.id}/sessions/${sandboxPath.sessionId}/${sandboxPath.relPath}`;
+      console.log("[EXULU] Transcribing audio from sandbox path", {
+        rawKey
+      });
+      const matches = await listS3ObjectsByPrefix(rawKey, exuluConfig);
+      const found = matches.find((m) => m.key.endsWith(rawKey));
+      if (!found) {
+        console.error("[EXULU] Sandbox audio file not found in S3 storage at", {
+          rawKey,
+          matches
+        });
+        throw new Error(
+          `Sandbox audio file not found in S3 storage at "${rawKey}". The file may not have been persisted yet \u2014 try again after the sandbox flushes it.`
+        );
+      }
+      buffer = await getS3ObjectBytes(found.key, exuluConfig);
+      originalname = decodeURIComponent(
+        sandboxPath.relPath.split("/").pop() || "audio"
+      );
+      mimetype = audioMimetypeFromExtension(originalname);
+    } else {
+      console.log("[EXULU] Fetching audio from URL", {
+        audio_url
+      });
+      const upstream = await fetch(audio_url);
+      if (!upstream.ok) {
+        console.error("[EXULU] Failed to fetch audio from", {
+          audio_url,
+          upstream
+        });
+        throw new Error(
+          `Failed to fetch audio from ${audio_url}: ${upstream.status} ${upstream.statusText}`
+        );
+      }
+      mimetype = upstream.headers.get("content-type") || "audio/mpeg";
+      if (!mimetype.startsWith("audio/")) {
+        throw new Error(
+          `URL did not return an audio file (content-type: ${mimetype}).`
+        );
+      }
+      buffer = Buffer.from(await upstream.arrayBuffer());
+      originalname = "audio";
+      try {
+        const pathname = new URL(audio_url).pathname;
+        const last = pathname.split("/").pop();
+        if (last) originalname = decodeURIComponent(last);
+      } catch {
+      }
+    }
+    const { text } = await transcribeAudio({
+      file: { buffer, originalname, mimetype },
+      language
+    });
+    const transcriptBuffer = Buffer.from(text, "utf-8");
+    const transcriptFilename = `${(0, import_node_crypto8.randomUUID)()}.txt`;
+    const transcriptKey = sessionID ? `sessions/${sessionID}/transcripts/${transcriptFilename}` : `transcripts/${transcriptFilename}`;
+    console.log("[EXULU] Uploading transcript to S3", {
+      transcriptFilename,
+      transcriptKey
+    });
+    const url = await uploadFile(
+      transcriptBuffer,
+      transcriptKey,
+      exuluConfig,
+      { contentType: "text/plain" },
+      user?.id
+    );
+    console.log("[EXULU] Uploaded transcript to S3", {
+      url
+    });
+    let sandboxLocalPath;
+    if (sessionID) {
+      sandboxLocalPath = (0, import_node_path6.join)(
+        SANDBOX_ROOT,
+        sessionID,
+        "transcripts",
+        transcriptFilename
+      );
+      console.log("[EXULU] Mirroring transcript into session sandbox", {
+        sandboxLocalPath
+      });
+      try {
+        await (0, import_promises3.mkdir)((0, import_node_path6.dirname)(sandboxLocalPath), { recursive: true });
+        await (0, import_promises3.writeFile)(sandboxLocalPath, transcriptBuffer);
+      } catch (err) {
+        console.error(
+          `[EXULU] Failed to write transcript to sandbox dir ${sandboxLocalPath}; S3 copy is unaffected.`,
+          err
+        );
+        sandboxLocalPath = void 0;
+      }
+    }
+    console.log("[EXULU] Transcribed audio successfully", {
+      text,
+      url,
+      sandboxLocalPath,
+      length: text.length
+    });
+    return {
+      result: sandboxLocalPath ? `Transcript stored at: ${url} (also available in the session sandbox at ${sandboxLocalPath}, ${text.length} characters).` : `${url}`
+    };
+  }
+});
+
+// src/templates/tools/image-generation.ts
+init_cjs_shims();
+init_tool();
+init_supervisor();
+init_client();
+init_check_record_access();
+var import_zod21 = require("zod");
+var _cachedImageModels;
+var setCachedImageModels = (models2) => {
+  _cachedImageModels = models2;
+};
+var buildDefaults = (models2) => {
+  const m = models2[0];
+  if (!m) {
+    return { model: "", size: "1024x1024", quality: "auto", n: 1 };
+  }
+  return {
+    model: m.model_name,
+    size: m.sizes.includes("1024x1024") ? "1024x1024" : m.sizes[0],
+    quality: m.qualities.includes("auto") ? "auto" : m.qualities[0],
+    n: 1
+  };
+};
+var loadAvailableStyles = async (user) => {
+  if (!user?.id) return [];
+  const { db: db2 } = await postgresClient();
+  const rows = await db2.from("platform_configurations").where("config_key", "like", "image_generation_style:%").select("*");
+  const visible = [];
+  for (const row of rows) {
+    const rbac = await RBACResolver(
+      db2,
+      "platform_configurations",
+      row.id,
+      row.rights_mode || "private"
+    );
+    const hasAccess = await checkRecordAccess(
+      { ...row, RBAC: rbac },
+      "read",
+      user
+    );
+    if (!hasAccess) continue;
+    const value = typeof row.config_value === "string" ? safeJsonParse(row.config_value) : row.config_value;
+    visible.push({
+      id: row.id,
+      name: value?.name ?? row.config_key.replace(/^image_generation_style:/, ""),
+      description: row.description ?? null,
+      owner: String(row.created_by) === String(user.id) ? "user" : "shared"
+    });
+  }
+  return visible;
+};
+var safeJsonParse = (s) => {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+};
+var createImageGenerationWidgetTool = (models2) => {
+  setCachedImageModels(models2);
+  return new ExuluTool({
+    id: "image_generation",
+    name: "image_generation",
+    description: "Open an in-chat image generation widget pre-filled with your prompt. The user picks the model, size, quality and count, optionally attaches reference images for editing, applies a saved style, generates one or more candidates, and selects the final image(s) to share back into the conversation. Use this whenever the user asks to create or edit an image.",
+    needsApproval: false,
+    type: "function",
+    config: [],
+    inputSchema: import_zod21.z.object({
+      prompt: import_zod21.z.string().describe(
+        "Initial image prompt. The user can edit it before generating."
+      )
+    }),
+    execute: async ({ prompt, user, sessionID }, options) => {
+      if (!isLiteLLMEnabled()) {
+        throw new Error(
+          "Image generation is not enabled on this deployment (EXULU_USE_LITELLM is not 'true')."
+        );
+      }
+      if (!_cachedImageModels || _cachedImageModels.length === 0) {
+        throw new Error(
+          "No image-generation models are registered in config.litellm.yaml."
+        );
       }
+      const toolCallId = options?.toolCallId;
+      const styles = await loadAvailableStyles(user);
+      return {
+        result: JSON.stringify({
+          type: "image_generation_widget",
+          toolCallId,
+          sessionId: sessionID,
+          initialPrompt: prompt,
+          models: _cachedImageModels.map((m) => ({
+            name: m.model_name,
+            sizes: m.sizes,
+            qualities: m.qualities,
+            supportsEdit: m.supports_edit,
+            maxN: m.max_n
+          })),
+          styles,
+          defaults: buildDefaults(_cachedImageModels)
+        })
+      };
     }
-    await sendEmail(recipient, subject, html, text, EMAIL_CONFIG);
-    return {
-      result: "Email sent successfully to " + recipient + " with subject " + subject + "."
-    };
-  }
-});
+  });
+};
+
+// src/exulu/app/index.ts
+var import_node_path7 = require("path");
 
 // src/validators/postgres-name.ts
 init_cjs_shims();
@@ -18806,209 +20599,69 @@ init_entitlements();
 init_system_dependencies();
 init_supervisor();
 
-// src/utils/python-setup.ts
+// src/templates/contexts/index.ts
 init_cjs_shims();
-var import_child_process = require("child_process");
-var import_util = require("util");
-var import_path = require("path");
-var import_fs4 = require("fs");
-var import_url = require("url");
-var execAsync4 = (0, import_util.promisify)(import_child_process.exec);
-function getPackageRoot() {
-  const currentFile = (0, import_url.fileURLToPath)(importMetaUrl);
-  let currentDir = (0, import_path.dirname)(currentFile);
-  let attempts = 0;
-  const maxAttempts = 10;
-  while (attempts < maxAttempts) {
-    const packageJsonPath = (0, import_path.join)(currentDir, "package.json");
-    if ((0, import_fs4.existsSync)(packageJsonPath)) {
-      try {
-        const packageJson = JSON.parse((0, import_fs4.readFileSync)(packageJsonPath, "utf-8"));
-        if (packageJson.name === "@exulu/backend") {
-          return currentDir;
-        }
-      } catch {
-      }
-    }
-    const parentDir = (0, import_path.resolve)(currentDir, "..");
-    if (parentDir === currentDir) {
-      break;
-    }
-    currentDir = parentDir;
-    attempts++;
-  }
-  const fallback = (0, import_path.resolve)((0, import_path.dirname)((0, import_url.fileURLToPath)(importMetaUrl)), "../..");
-  return fallback;
-}
-function getSetupScriptPath(packageRoot) {
-  return (0, import_path.resolve)(packageRoot, "ee/python/setup.sh");
-}
-function getVenvPath(packageRoot) {
-  return (0, import_path.resolve)(packageRoot, "ee/python/.venv");
-}
-function isPythonEnvironmentSetup(packageRoot) {
-  const root = packageRoot ?? getPackageRoot();
-  const venvPath = getVenvPath(root);
-  const pythonPath = (0, import_path.join)(venvPath, "bin", "python");
-  return (0, import_fs4.existsSync)(venvPath) && (0, import_fs4.existsSync)(pythonPath);
-}
-async function setupPythonEnvironment(options = {}) {
-  const {
-    packageRoot = getPackageRoot(),
-    force = false,
-    verbose = false,
-    timeout = 6e5
-    // 10 minutes
-  } = options;
-  if (!force && isPythonEnvironmentSetup(packageRoot)) {
-    if (verbose) {
-      console.log("\u2713 Python environment already set up");
-    }
-    return {
-      success: true,
-      message: "Python environment already exists",
-      alreadyExists: true
-    };
-  }
-  const setupScriptPath = getSetupScriptPath(packageRoot);
-  if (!(0, import_fs4.existsSync)(setupScriptPath)) {
-    return {
-      success: false,
-      message: `Setup script not found at: ${setupScriptPath}`,
-      alreadyExists: false
-    };
-  }
-  try {
-    if (verbose) {
-      console.log("Setting up Python environment...");
-    }
-    const { stdout, stderr } = await execAsync4(`bash "${setupScriptPath}"`, {
-      cwd: packageRoot,
-      timeout,
-      env: {
-        ...process.env,
-        // Ensure script can write to the directory
-        PYTHONDONTWRITEBYTECODE: "1"
-      },
-      maxBuffer: 10 * 1024 * 1024
-      // 10MB buffer
-    });
-    const output = stdout + stderr;
-    const versionMatch = output.match(/Python (\d+\.\d+\.\d+)/);
-    const pythonVersion = versionMatch ? versionMatch[1] : void 0;
-    if (verbose) {
-      console.log(output);
-    }
-    return {
-      success: true,
-      message: "Python environment set up successfully",
-      alreadyExists: false,
-      pythonVersion,
-      output
-    };
-  } catch (error) {
-    const errorOutput = error.stdout + error.stderr;
-    return {
-      success: false,
-      message: `Setup failed: ${error.message}`,
-      alreadyExists: false,
-      output: errorOutput
-    };
-  }
-}
-function getPythonSetupInstructions() {
-  return `
-Python environment not set up. Please run one of the following commands:
-
-Option 1 (Automatic):
-  import { setupPythonEnvironment } from '@exulu/backend';
-  await setupPythonEnvironment();
-
-Option 2 (Manual - for package consumers):
-  npx @exulu/backend setup-python
-
-Option 3 (Manual - for contributors):
-  npm run python:setup
-
-These commands will automatically create a Python virtual environment (.venv)
-in the @exulu/backend package and install all required dependencies.
-
-Requirements:
-  - Python 3.10 or higher must be installed
-  - pip must be available
-  - venv module must be available (for creating virtual environments)
-
-If Python dependencies are not installed, install them first, then run one of the commands above:
-  - macOS: brew install python@3.12
-  - Ubuntu/Debian: sudo apt-get install python3.12 python3-pip python3-venv
-  - Alpine Linux: apk add python3 py3-pip python3-dev
-  - Windows: Download from https://www.python.org/downloads/
 
-Note: In Docker containers, ensure you install all three components:
-  Ubuntu/Debian: apt-get install -y python3 python3-pip python3-venv
-  Alpine: apk add python3 py3-pip python3-dev
-`.trim();
-}
-async function validatePythonEnvironment(packageRoot, checkPackages = true) {
-  const root = packageRoot ?? getPackageRoot();
-  const venvPath = getVenvPath(root);
-  const pythonPath = (0, import_path.join)(venvPath, "bin", "python");
-  if (!(0, import_fs4.existsSync)(venvPath)) {
-    return {
-      valid: false,
-      message: getPythonSetupInstructions()
-    };
-  }
-  if (!(0, import_fs4.existsSync)(pythonPath)) {
-    return {
-      valid: false,
-      message: "Python virtual environment is corrupted. Please run:\n  await setupPythonEnvironment({ force: true })"
-    };
-  }
-  try {
-    await execAsync4(`"${pythonPath}" --version`, { cwd: root });
-  } catch {
-    return {
-      valid: false,
-      message: "Python executable is not working. Please run:\n  await setupPythonEnvironment({ force: true })"
-    };
+// src/templates/contexts/transcriptions.ts
+init_cjs_shims();
+init_context();
+var transcriptionsContext = new ExuluContext2({
+  id: "transcriptions",
+  name: "Transcriptions",
+  description: "Diarized audio transcripts",
+  fields: [
+    { name: "transcript_text", type: "longText", editable: true },
+    { name: "audio", type: "file" },
+    { name: "language", type: "text" },
+    { name: "duration_seconds", type: "number" },
+    { name: "speakers", type: "json" },
+    { name: "raw_segments", type: "json", editable: false }
+  ],
+  sources: [],
+  active: true,
+  configuration: {
+    calculateVectors: "onInsert",
+    defaultRightsMode: "private"
   }
-  if (checkPackages) {
-    const criticalPackages = ["docling", "transformers"];
-    const missingPackages = [];
-    for (const pkg of criticalPackages) {
-      try {
-        await execAsync4(`"${pythonPath}" -c "import ${pkg}"`, {
-          cwd: root,
-          timeout: 1e4
-          // 10 second timeout per import check
-        });
-      } catch {
-        missingPackages.push(pkg);
-      }
-    }
-    if (missingPackages.length > 0) {
-      return {
-        valid: false,
-        message: `Python environment exists but required packages are not installed: ${missingPackages.join(", ")}
-
-This usually happens when:
-1. The .venv folder was copied but dependencies were not installed
-2. The package was installed via npm but setup script was not run
+});
 
-Please run:
-  await setupPythonEnvironment({ force: true })
+// src/templates/contexts/index.ts
+var builtInContexts = {
+  transcriptions: transcriptionsContext
+};
 
-Or manually run the setup script:
-  bash ` + getSetupScriptPath(root)
-      };
+// src/exulu/transcription/polling-loop.ts
+init_cjs_shims();
+var POLL_INTERVAL_MS = 5e3;
+var MAX_PER_TICK = 50;
+var timer = null;
+var stopped = false;
+var tick = async () => {
+  if (stopped) return;
+  try {
+    await transcriptionService.pollOnce(MAX_PER_TICK);
+  } catch (err) {
+    console.error(`[EXULU-TRANSCRIPTION] polling tick failed: ${err.message}`);
+  } finally {
+    if (!stopped) {
+      timer = setTimeout(tick, POLL_INTERVAL_MS);
     }
   }
-  return {
-    valid: true,
-    message: "Python environment is valid"
+};
+var startTranscriptionPollingLoop = () => {
+  if (timer) return;
+  stopped = false;
+  timer = setTimeout(tick, POLL_INTERVAL_MS);
+  const stop = () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
   };
-}
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+};
 
 // src/exulu/app/index.ts
 var isDev = process.env.NODE_ENV !== "production";
@@ -19074,8 +20727,14 @@ var ExuluApp = class {
     rerankers
   }) => {
     this._evals = redisServer.host?.length && redisServer.port?.length ? [...getDefaultEvals(), ...evals ?? []] : [];
+    if (contexts && "transcriptions" in contexts) {
+      console.warn(
+        "[EXULU] User-defined 'transcriptions' context overridden by built-in. Rename your context to avoid the collision."
+      );
+    }
     this._contexts = {
-      ...contexts
+      ...contexts,
+      ...builtInContexts
     };
     this._rerankers = [...rerankers ?? []];
     this._agents = [...agents ?? []];
@@ -19102,12 +20761,30 @@ var ExuluApp = class {
       ...providers ?? []
     ];
     this._config = config;
+    const transcriptionTools = [];
+    if (process.env.TRANSCRIPTION_MODEL && config?.fileUploads && config?.fileUploads?.s3region && config?.fileUploads?.s3key && config?.fileUploads?.s3secret && config?.fileUploads?.s3Bucket) {
+      transcriptionTools.push(transcribeTool);
+    }
+    const imageGenerationTools = [];
+    const s3Configured = !!config?.fileUploads && !!config.fileUploads.s3region && !!config.fileUploads.s3key && !!config.fileUploads.s3secret && !!config.fileUploads.s3Bucket;
+    if (isLiteLLMEnabled() && s3Configured) {
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path7.resolve)(getPackageRoot(), "./config.litellm.yaml");
+      const imageModels = parseImageGenerationModels(configPath);
+      if (imageModels.length > 0) {
+        console.log(
+          `[EXULU] Registering image_generation widget tool with ${imageModels.length} model(s): ${imageModels.map((m) => m.model_name).join(", ")}`
+        );
+        imageGenerationTools.push(createImageGenerationWidgetTool(imageModels));
+      }
+    }
     this._tools = [
       ...tools ?? [],
       ...todoTools,
       ...questionTools,
       ...perplexityTools,
-      emailTool
+      emailTool,
+      ...transcriptionTools,
+      ...imageGenerationTools
       // Because agents are stored in the database, we add those as tools
       // at request time, not during ExuluApp initialization. We add them
       // in the grahql tools resolver.
@@ -19206,6 +20883,23 @@ var ExuluApp = class {
           );
         }
       }
+      if (process.env.TRANSCRIPTION_SERVER) {
+        try {
+          const health = await transcriptionClient.health();
+          console.log(
+            `[EXULU] Transcription: enabled (server=${process.env.TRANSCRIPTION_SERVER}, device=${health.device}, GPU=${health.gpu.available ? "enabled" : "disabled"}, diarization=${health.diarization ? "enabled" : "disabled"})`
+          );
+          startTranscriptionPollingLoop();
+        } catch (err) {
+          console.warn(
+            `[EXULU] TRANSCRIPTION_SERVER set but unreachable: ${err.message}. Transcriptions will fail until the server is up.`
+          );
+        }
+      } else {
+        console.log(
+          "[EXULU] Transcription: disabled (TRANSCRIPTION_SERVER not set). Start a whisper server with `npx @exulu/backend exulu-start-whisper`."
+        );
+      }
       return this._expressApp;
     }
   };
@@ -21023,7 +22717,9 @@ var {
   promptLibrarySchema: promptLibrarySchema3,
   contextPresetsSchema: contextPresetsSchema3,
   embedderSettingsSchema: embedderSettingsSchema3,
-  promptFavoritesSchema: promptFavoritesSchema3
+  promptFavoritesSchema: promptFavoritesSchema3,
+  transcriptionJobsSchema: transcriptionJobsSchema3,
+  imageGenerationsSchema: imageGenerationsSchema2
 } = coreSchemas.get();
 var addMissingFields = async (knex, tableName, fields, skipFields = []) => {
   for (const field of fields) {
@@ -21063,6 +22759,8 @@ var up = async function(knex) {
     contextPresetsSchema3(),
     embedderSettingsSchema3(),
     promptFavoritesSchema3(),
+    transcriptionJobsSchema3(),
+    imageGenerationsSchema2(),
     rbacSchema3(),
     agentsSchema3(),
     feedbackSchema3(),
@@ -21273,17 +22971,17 @@ init_cjs_shims();
 
 // src/exulu/litellm/db-init.ts
 init_cjs_shims();
-var import_node_fs6 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path8 = require("path");
 var import_node_child_process5 = require("child_process");
 var import_pg = require("pg");
 
 // src/exulu/litellm/db-setup-check.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var readLiteLLMDatabaseUrl = (configPath) => {
-  if (!(0, import_node_fs5.existsSync)(configPath)) return void 0;
-  const text = (0, import_node_fs5.readFileSync)(configPath, "utf8");
+  if (!(0, import_node_fs6.existsSync)(configPath)) return void 0;
+  const text = (0, import_node_fs6.readFileSync)(configPath, "utf8");
   const match = text.match(
     /^\s*database_url:\s*["']?([^"'\n#]+?)["']?\s*(#.*)?$/m
   );
@@ -21342,9 +23040,9 @@ ${WARNING_BANNER}`);
   console.warn(`${WARNING_BANNER}
 `);
 };
-var log2 = (line) => console.log(`[EXULU-LITELLM] ${line}`);
+var log3 = (line) => console.log(`[EXULU-LITELLM] ${line}`);
 var initLiteLLMDatabase = async (packageRoot) => {
-  const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path5.resolve)(packageRoot, "./config.litellm.yaml");
+  const configPath = process.env.LITELLM_CONFIG_PATH ?? (0, import_node_path8.resolve)(packageRoot, "./config.litellm.yaml");
   const safety = checkLiteLLMDatabaseSafety(configPath);
   if (safety.ok && safety.reason === "no-litellm-db-mode") return;
   if (!safety.ok && safety.reason === "unparseable-url") {
@@ -21376,7 +23074,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     return;
   }
   const target = "litellmTarget" in safety ? safety.litellmTarget : void 0;
-  log2(
+  log3(
     `LiteLLM database mode detected (${target?.host}:${target?.port}/${target?.database}).`
   );
   const ensureDatabaseExists2 = async () => {
@@ -21404,7 +23102,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
         return false;
       }
       url.pathname = "/postgres";
-      log2(`Target database "${targetDbName}" does not exist; creating it\u2026`);
+      log3(`Target database "${targetDbName}" does not exist; creating it\u2026`);
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(targetDbName)) {
         warn([
           `Refusing to auto-create database "${targetDbName}" \u2014 name`,
@@ -21417,7 +23115,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
       try {
         await admin.connect();
         await admin.query(`CREATE DATABASE "${targetDbName}"`);
-        log2(`\u2713 Created database "${targetDbName}".`);
+        log3(`\u2713 Created database "${targetDbName}".`);
         return true;
       } catch (createErr) {
         warn([
@@ -21439,7 +23137,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     }
   };
   if (!await ensureDatabaseExists2()) return;
-  log2("Checking that the target database is safe to push into\u2026");
+  log3("Checking that the target database is safe to push into\u2026");
   const client2 = new import_pg.Client({ connectionString: litellmUrl });
   let foreignTables = [];
   try {
@@ -21482,14 +23180,14 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  const venvBin = (0, import_node_path5.resolve)(packageRoot, "ee/python/.venv/bin");
-  const prismaCli = (0, import_node_path5.resolve)(venvBin, "prisma");
-  const litellmProxyDir = (0, import_node_path5.resolve)(
+  const venvBin = (0, import_node_path8.resolve)(packageRoot, "ee/python/.venv/bin");
+  const prismaCli = (0, import_node_path8.resolve)(venvBin, "prisma");
+  const litellmProxyDir = (0, import_node_path8.resolve)(
     packageRoot,
     "ee/python/.venv/lib/python3.12/site-packages/litellm/proxy"
   );
-  const schemaPath = (0, import_node_path5.resolve)(litellmProxyDir, "schema.prisma");
-  if (!(0, import_node_fs6.existsSync)(prismaCli)) {
+  const schemaPath = (0, import_node_path8.resolve)(litellmProxyDir, "schema.prisma");
+  if (!(0, import_node_fs7.existsSync)(prismaCli)) {
     warn([
       `Prisma CLI not found at ${prismaCli}.`,
       `Run \`npm run python:setup\` to create the venv and install prisma.`,
@@ -21497,14 +23195,14 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  if (!(0, import_node_fs6.existsSync)(schemaPath)) {
+  if (!(0, import_node_fs7.existsSync)(schemaPath)) {
     warn([
       `LiteLLM Prisma schema not found at ${schemaPath}.`,
       `Re-run \`npm run python:setup\`. Skipping LiteLLM database setup.`
     ]);
     return;
   }
-  log2("Running `prisma db push` against LiteLLM's schema\u2026");
+  log3("Running `prisma db push` against LiteLLM's schema\u2026");
   const result = (0, import_node_child_process5.spawnSync)(prismaCli, ["db", "push", "--skip-generate"], {
     cwd: litellmProxyDir,
     env: {
@@ -21534,7 +23232,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  log2("\u2713 LiteLLM database ready.");
+  log3("\u2713 LiteLLM database ready.");
 };
 
 // src/postgres/init-litellm-db.ts
@@ -22078,7 +23776,7 @@ init_cjs_shims();
 var fs5 = __toESM(require("fs"), 1);
 var path2 = __toESM(require("path"), 1);
 var import_ai14 = require("ai");
-var import_zod20 = require("zod");
+var import_zod22 = require("zod");
 var import_p_limit = __toESM(require("p-limit"), 1);
 var import_crypto = require("crypto");
 init_with_retry();
@@ -22433,15 +24131,15 @@ If the page contains a flow-chart, schematic, technical drawing or control board
   const result = await (0, import_ai14.generateText)({
     model,
     output: import_ai14.Output.object({
-      schema: import_zod20.z.object({
-        needs_correction: import_zod20.z.boolean(),
-        corrected_text: import_zod20.z.string().nullable(),
-        current_page_table: import_zod20.z.object({
-          headers: import_zod20.z.array(import_zod20.z.string()),
-          is_continuation: import_zod20.z.boolean()
+      schema: import_zod22.z.object({
+        needs_correction: import_zod22.z.boolean(),
+        corrected_text: import_zod22.z.string().nullable(),
+        current_page_table: import_zod22.z.object({
+          headers: import_zod22.z.array(import_zod22.z.string()),
+          is_continuation: import_zod22.z.boolean()
         }).nullable(),
-        confidence: import_zod20.z.enum(["high", "medium", "low"]),
-        reasoning: import_zod20.z.string()
+        confidence: import_zod22.z.enum(["high", "medium", "low"]),
+        reasoning: import_zod22.z.string()
       })
     }),
     messages: [
@@ -22521,7 +24219,7 @@ async function validateWithVLM(document2, model, verbose = false, concurrency =
   let correctedCount = 0;
   const validationTasks = document2.map(
     (page) => limit(async () => {
-      await new Promise((resolve6) => setImmediate(resolve6));
+      await new Promise((resolve7) => setImmediate(resolve7));
       const imagePath = page.image;
       if (!imagePath) {
         console.warn(`[EXULU] Page ${page.page}: No image found, skipping validation`);
@@ -22712,7 +24410,7 @@ ${setupResult.output || ""}`);
       if (!MISTRAL_API_KEY) {
         throw new Error('[EXULU] MISTRAL_API_KEY is not set, please set it in the environment variable via process.env or via an Exulu variable named "MISTRAL_API_KEY".');
       }
-      await new Promise((resolve6) => setTimeout(resolve6, Math.floor(Math.random() * 4e3) + 1e3));
+      await new Promise((resolve7) => setTimeout(resolve7, Math.floor(Math.random() * 4e3) + 1e3));
       const base64Pdf = buffer.toString("base64");
       const client2 = new import_mistralai.Mistral({ apiKey: MISTRAL_API_KEY });
       const ocrResponse = await withRetry(async () => {
@@ -22808,8 +24506,8 @@ ${setupResult.output || ""}`);
         markdownStream.write("\n\n\n<!-- END_OF_PAGE -->\n\n\n");
       }
     }
-    await new Promise((resolve6, reject) => {
-      markdownStream.end(() => resolve6());
+    await new Promise((resolve7, reject) => {
+      markdownStream.end(() => resolve7());
       markdownStream.on("error", reject);
     });
     console.log(`[EXULU] Validated output saved to: ${paths.json}`);