@exulu/backend 1.59.0 → 1.61.0

package/dist/index.js

@@ -1,3 +1,10 @@
+import {
+  getPackageRoot,
+  getPythonSetupInstructions,
+  isPythonEnvironmentSetup,
+  setupPythonEnvironment,
+  validatePythonEnvironment
+} from "./chunk-IDHS2BZO.js";
 import {
   ExuluContext,
   ExuluStorage,
@@ -46,10 +53,10 @@ import {
   vectorSearch,
   waitForLiteLLMReady,
   withRetry
-} from "./chunk-U36VJDZ7.js";
+} from "./chunk-MPV7HBV6.js";
 import {
   findLiteLLMModel
-} from "./chunk-YS27XOXI.js";
+} from "./chunk-ILAHW4UT.js";
 
 // src/index.ts
 import "dotenv/config";
@@ -3358,6 +3365,365 @@ function getAverage(arr) {
 
 // src/graphql/schemas/index.ts
 import "fs";
+
+// src/exulu/transcription/client.ts
+var TranscriptionServerUnavailable = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TranscriptionServerUnavailable";
+  }
+};
+var getBaseUrl = () => {
+  const url = process.env.TRANSCRIPTION_SERVER;
+  if (!url) {
+    throw new TranscriptionServerUnavailable(
+      "TRANSCRIPTION_SERVER env var is not set. Start a whisper server with `npx @exulu/backend exulu-start-whisper` and point TRANSCRIPTION_SERVER at it."
+    );
+  }
+  return url.replace(/\/$/, "");
+};
+var request = async (path2, init = {}) => {
+  const url = `${getBaseUrl()}${path2}`;
+  let res;
+  try {
+    res = await fetch(url, init);
+  } catch (err) {
+    throw new TranscriptionServerUnavailable(
+      `Unable to reach whisper server at ${url}: ${err.message}`
+    );
+  }
+  if (res.status === 404) {
+    const err = new Error(`whisper server returned 404 for ${path2}`);
+    err.code = "JOB_NOT_FOUND";
+    throw err;
+  }
+  if (!res.ok) {
+    throw new Error(
+      `whisper server returned ${res.status} for ${path2}: ${await res.text()}`
+    );
+  }
+  return await res.json();
+};
+var transcriptionClient = {
+  submitJob: (opts) => request("/jobs", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(opts)
+  }),
+  getJob: (jobId) => request(`/jobs/${jobId}`),
+  cancelJob: (jobId) => request(`/jobs/${jobId}`, {
+    method: "DELETE"
+  }),
+  health: () => request("/healthz"),
+  isConfigured: () => Boolean(process.env.TRANSCRIPTION_SERVER)
+};
+
+// src/exulu/transcription/transcript-text.ts
+var renderTranscript = (segments, speakers) => {
+  if (!segments || segments.length === 0) return "";
+  const blocks = [];
+  for (const seg of segments) {
+    const text = (seg.text ?? "").trim();
+    if (!text) continue;
+    const label = speakers[seg.speaker] ?? seg.speaker ?? "unknown";
+    const last = blocks[blocks.length - 1];
+    if (last && last.speaker === label) {
+      last.text = `${last.text} ${text}`.trim();
+    } else {
+      blocks.push({ speaker: label, text });
+    }
+  }
+  return blocks.map((b) => `${b.speaker}: ${b.text}`).join("\n");
+};
+
+// src/exulu/transcription/service.ts
+var TABLE = "transcription_jobs";
+var log = (msg) => console.log(`[EXULU-TRANSCRIPTION] ${msg}`);
+var parseJsonField = (v) => {
+  if (v == null) return null;
+  if (typeof v === "string") {
+    try {
+      return JSON.parse(v);
+    } catch {
+      return null;
+    }
+  }
+  return v;
+};
+var presignAudio = async (s3Key) => {
+  const app = exuluApp.get();
+  const config = app._config ?? app.config;
+  const configuredBucket = config?.fileUploads?.s3Bucket;
+  if (!configuredBucket) {
+    throw new Error("File uploads are not configured (s3Bucket missing).");
+  }
+  const firstSlash = s3Key.indexOf("/");
+  const bucket = firstSlash > 0 ? s3Key.slice(0, firstSlash) : configuredBucket;
+  const objectKey = firstSlash > 0 ? s3Key.slice(firstSlash + 1) : s3Key;
+  return getPresignedUrl(bucket, objectKey, config);
+};
+var transcriptionService = {
+  /**
+   * Create a transcription job row and dispatch it to the whisper server.
+   * Throws TranscriptionServerUnavailable if the feature is off.
+   */
+  async startJob(input) {
+    if (!transcriptionClient.isConfigured()) {
+      throw new TranscriptionServerUnavailable(
+        "TRANSCRIPTION_SERVER is not set. Start a whisper server with `npx @exulu/backend exulu-start-whisper` and point TRANSCRIPTION_SERVER at it."
+      );
+    }
+    const { db } = await postgresClient();
+    const now = /* @__PURE__ */ new Date();
+    const [inserted] = await db(TABLE).insert({
+      audio_s3key: input.s3Key,
+      title: input.title ?? input.filename,
+      status: "queued",
+      project_id: input.project_id ?? null,
+      target_rights_mode: input.target_rights_mode ?? "private",
+      target_rbac_users: input.target_rbac_users ? JSON.stringify(input.target_rbac_users) : null,
+      target_rbac_roles: input.target_rbac_roles ? JSON.stringify(input.target_rbac_roles) : null,
+      rights_mode: "private",
+      created_by: input.userId,
+      createdAt: now,
+      updatedAt: now
+    }).returning("*");
+    const row = this._rowFromDb(inserted);
+    try {
+      const audioUrl = await presignAudio(input.s3Key);
+      const submitted = await transcriptionClient.submitJob({
+        audio_url: audioUrl,
+        language: input.language ?? void 0,
+        num_speakers: input.num_speakers ?? void 0,
+        hotwords: input.hotwords
+      });
+      const [updated] = await db(TABLE).where({ id: row.id }).update({
+        whisper_job_id: submitted.job_id,
+        status: "transcribing",
+        updatedAt: /* @__PURE__ */ new Date()
+      }).returning("*");
+      return this._rowFromDb(updated);
+    } catch (err) {
+      const [failed] = await db(TABLE).where({ id: row.id }).update({
+        status: "failed",
+        error: err.message,
+        updatedAt: /* @__PURE__ */ new Date()
+      }).returning("*");
+      log(`Failed to dispatch job ${row.id}: ${err.message}`);
+      return this._rowFromDb(failed);
+    }
+  },
+  /**
+   * Reconcile every transcribing row against the whisper server. Called from
+   * the polling loop on a fixed interval. Caps how many rows we touch per
+   * tick so a backlog can't starve the event loop.
+   */
+  async pollOnce(maxPerTick = 50) {
+    if (!transcriptionClient.isConfigured()) return;
+    const { db } = await postgresClient();
+    const rows = await db(TABLE).where({ status: "transcribing" }).whereNotNull("whisper_job_id").limit(maxPerTick);
+    for (const dbRow of rows) {
+      const row = this._rowFromDb(dbRow);
+      if (!row.whisper_job_id) continue;
+      try {
+        const job = await transcriptionClient.getJob(row.whisper_job_id);
+        await this._applyJobUpdate(row, job);
+      } catch (err) {
+        const code = err.code;
+        if (code === "JOB_NOT_FOUND") {
+          await db(TABLE).where({ id: row.id }).update({
+            status: "failed",
+            error: "lost on server restart",
+            updatedAt: /* @__PURE__ */ new Date()
+          });
+        } else if (err instanceof TranscriptionServerUnavailable) {
+          log(`Whisper server unreachable while polling ${row.id}; will retry`);
+        } else {
+          log(`Error polling job ${row.id}: ${err.message}`);
+        }
+      }
+    }
+  },
+  async _applyJobUpdate(row, job) {
+    const { db } = await postgresClient();
+    if ((job.status === "queued" || job.status === "running") && job.duration_seconds != null && row.duration_seconds !== job.duration_seconds) {
+      await db(TABLE).where({ id: row.id }).update({
+        duration_seconds: job.duration_seconds,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+    }
+    if (job.status === "running" || job.status === "queued") return;
+    if (job.status === "completed") {
+      await db(TABLE).where({ id: row.id }).update({
+        status: "awaiting_review",
+        raw_segments: JSON.stringify(job.segments ?? []),
+        language: job.language ?? null,
+        duration_seconds: job.duration_seconds ?? null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return;
+    }
+    if (job.status === "failed") {
+      await db(TABLE).where({ id: row.id }).update({
+        status: "failed",
+        error: job.error ?? "transcription failed",
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return;
+    }
+    if (job.status === "cancelled") {
+      await db(TABLE).where({ id: row.id }).update({
+        status: "cancelled",
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+    }
+  },
+  async cancelJob(id) {
+    const { db } = await postgresClient();
+    const dbRow = await db(TABLE).where({ id }).first();
+    if (!dbRow) throw new Error(`transcription_job ${id} not found`);
+    const row = this._rowFromDb(dbRow);
+    if (row.whisper_job_id && transcriptionClient.isConfigured()) {
+      try {
+        await transcriptionClient.cancelJob(row.whisper_job_id);
+      } catch (err) {
+        const code = err.code;
+        if (code !== "JOB_NOT_FOUND") {
+          log(`Best-effort cancel of whisper job failed: ${err.message}`);
+        }
+      }
+    }
+    const [updated] = await db(TABLE).where({ id }).update({ status: "cancelled", updatedAt: /* @__PURE__ */ new Date() }).returning("*");
+    return this._rowFromDb(updated);
+  },
+  /**
+   * User clicked Save in the review panel.
+   *
+   * - From 'awaiting_review': render the speaker-labeled transcript, create a
+   *   new ExuluContext item, apply RBAC + optional project linkage, mark the
+   *   job saved.
+   * - From 'saved': re-render the transcript with the (possibly updated)
+   *   speaker map and upsert the existing context item by id. Used by the
+   *   Completed-section re-edit flow.
+   */
+  async finalize(id, input) {
+    const { db } = await postgresClient();
+    const dbRow = await db(TABLE).where({ id }).first();
+    if (!dbRow) throw new Error(`transcription_job ${id} not found`);
+    const row = this._rowFromDb(dbRow);
+    if (row.status !== "awaiting_review" && row.status !== "saved") {
+      throw new Error(
+        `transcription_job ${id} is in status '${row.status}'; can only finalize from 'awaiting_review' or 'saved'`
+      );
+    }
+    if (!row.raw_segments) {
+      throw new Error(`transcription_job ${id} has no raw_segments to finalize`);
+    }
+    const app = exuluApp.get();
+    const context = app.context("transcriptions");
+    if (!context) {
+      throw new Error("Built-in transcriptions context not registered");
+    }
+    const config = app._config ?? app.config;
+    const transcriptText = renderTranscript(row.raw_segments, input.speakers);
+    const rightsMode = input.target_rights_mode ?? row.target_rights_mode ?? "private";
+    const isReSave = row.status === "saved" && !!row.saved_item_id;
+    const itemInput = {
+      // Carrying the id on re-save makes context.createItem upsert in place.
+      ...isReSave && row.saved_item_id ? { id: row.saved_item_id } : {},
+      name: input.title ?? row.title ?? "Transcript",
+      transcript_text: transcriptText,
+      audio_s3key: row.audio_s3key,
+      language: row.language ?? void 0,
+      duration_seconds: row.duration_seconds ?? void 0,
+      speakers: input.speakers,
+      raw_segments: row.raw_segments,
+      rights_mode: rightsMode,
+      created_by: row.created_by
+    };
+    let item;
+    try {
+      const result = await context.createItem(
+        itemInput,
+        config,
+        row.created_by,
+        void 0,
+        isReSave
+        // upsert when re-saving
+      );
+      item = result.item;
+    } catch (err) {
+      await db(TABLE).where({ id }).update({
+        speakers: JSON.stringify(input.speakers),
+        error: `Failed to save: ${err.message}`,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      throw err;
+    }
+    const itemId = item.id ?? row.saved_item_id ?? "";
+    const users = input.target_rbac_users ?? row.target_rbac_users ?? [];
+    const roles = input.target_rbac_roles ?? row.target_rbac_roles ?? [];
+    if ((users.length || roles.length) && rightsMode !== "private") {
+      try {
+        await handleRBACUpdate(
+          db,
+          "transcriptions",
+          itemId,
+          { users, roles },
+          []
+        );
+      } catch (err) {
+        log(`RBAC update failed for item ${itemId}: ${err.message}`);
+      }
+    }
+    const projectId = input.project_id ?? row.project_id ?? null;
+    let projectWarning = null;
+    if (projectId && !isReSave) {
+      try {
+        const project = await db("projects").where({ id: projectId }).first();
+        if (!project) {
+          projectWarning = `project ${projectId} not found`;
+        } else {
+          const existing = parseJsonField(project.project_items) ?? [];
+          const globalId = `transcriptions/${itemId}`;
+          if (!existing.includes(globalId)) {
+            existing.push(globalId);
+            await db("projects").where({ id: projectId }).update({
+              project_items: JSON.stringify(existing),
+              updatedAt: /* @__PURE__ */ new Date()
+            });
+          }
+        }
+      } catch (err) {
+        projectWarning = err.message;
+      }
+    }
+    const [updated] = await db(TABLE).where({ id }).update({
+      status: "saved",
+      saved_item_id: itemId,
+      title: input.title ?? row.title ?? null,
+      speakers: JSON.stringify(input.speakers),
+      error: projectWarning ? `Saved, but could not attach to project: ${projectWarning}` : null,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).returning("*");
+    return { item, row: this._rowFromDb(updated) };
+  },
+  _rowFromDb(dbRow) {
+    return {
+      ...dbRow,
+      raw_segments: parseJsonField(dbRow.raw_segments),
+      speakers: parseJsonField(dbRow.speakers),
+      target_rbac_users: parseJsonField(
+        dbRow.target_rbac_users
+      ),
+      target_rbac_roles: parseJsonField(
+        dbRow.target_rbac_roles
+      )
+    };
+  }
+};
+
+// src/graphql/schemas/index.ts
 function createExuluContextsTypeDefs(table) {
   const enumDefs = table.fields.filter((field) => field.type === "enum" && field.enumValues).map((field) => {
     if (!field.enumValues) {
@@ -3775,6 +4141,39 @@ type PageInfo {
   mutationDefs += `
     deleteJob(queue: QueueEnum!, id: String!): JobActionReturnPayload
     `;
+  mutationDefs += `
+    transcriptionJobStart(input: TranscriptionJobStartInput!): transcription_job
+    transcriptionJobFinalize(id: ID!, input: TranscriptionJobFinalizeInput!): TranscriptionJobFinalizeResult
+    transcriptionJobCancel(id: ID!): transcription_job
+    `;
+  modelDefs += `
+    input TranscriptionJobStartInput {
+      audio_s3key: String!
+      filename: String!
+      title: String
+      language: String
+      num_speakers: Int
+      hotwords: [String!]
+      project_id: ID
+      target_rights_mode: String
+      target_rbac_users: [RBACUserInput!]
+      target_rbac_roles: [RBACRoleInput!]
+    }
+
+    input TranscriptionJobFinalizeInput {
+      title: String
+      speakers: JSON!
+      project_id: ID
+      target_rights_mode: String
+      target_rbac_users: [RBACUserInput!]
+      target_rbac_roles: [RBACRoleInput!]
+    }
+
+    type TranscriptionJobFinalizeResult {
+      job: transcription_job!
+      item_id: ID!
+    }
+  `;
   typeDefs += `
    tools(search: String, category: String, limit: Int, page: Int): ToolPaginationResult
    toolCategories: [String!]!
@@ -3865,7 +4264,7 @@ type LiteLLMModel {
     };
   };
   resolvers.Query["litellmCatalog"] = async () => {
-    const { fetchLiteLLMCatalog } = await import("./catalog-EOKGOHTY.js");
+    const { fetchLiteLLMCatalog } = await import("./catalog-BWE6SLE2.js");
     return fetchLiteLLMCatalog();
   };
   resolvers.Query["workflowSchedule"] = async (_, args, context, info) => {
@@ -4340,6 +4739,54 @@ type LiteLLMModel {
     await config2.queue.remove(args.id);
     return { success: true };
   };
+  const assertOwnsTranscriptionJob = async (id, context) => {
+    const { db, user } = context;
+    if (!user) throw new Error("Authentication required");
+    if (user.super_admin === true) return;
+    const row = await db.from("transcription_jobs").select(["created_by", "rights_mode"]).where({ id }).first();
+    if (!row) throw new Error(`transcription_job ${id} not found`);
+    if (row.rights_mode === "public") return;
+    if (row.created_by === user.id) return;
+    throw new Error("Not authorized to act on this transcription job");
+  };
+  resolvers.Mutation["transcriptionJobStart"] = async (_, args, context) => {
+    const { user } = context;
+    if (!user) throw new Error("Authentication required");
+    if (!transcriptionClient.isConfigured()) {
+      throw new Error(
+        "TRANSCRIPTION_DISABLED: TRANSCRIPTION_SERVER not set on this server. Ask the operator to start a whisper server with `npx @exulu/backend exulu-start-whisper`."
+      );
+    }
+    return transcriptionService.startJob({
+      userId: user.id,
+      s3Key: args.input.audio_s3key,
+      filename: args.input.filename,
+      title: args.input.title,
+      language: args.input.language ?? void 0,
+      num_speakers: args.input.num_speakers ?? void 0,
+      hotwords: args.input.hotwords ?? void 0,
+      project_id: args.input.project_id ?? null,
+      target_rights_mode: args.input.target_rights_mode ?? null,
+      target_rbac_users: args.input.target_rbac_users ?? void 0,
+      target_rbac_roles: args.input.target_rbac_roles ?? void 0
+    });
+  };
+  resolvers.Mutation["transcriptionJobFinalize"] = async (_, args, context) => {
+    await assertOwnsTranscriptionJob(args.id, context);
+    const { item, row } = await transcriptionService.finalize(args.id, {
+      title: args.input.title,
+      speakers: args.input.speakers,
+      project_id: args.input.project_id ?? null,
+      target_rights_mode: args.input.target_rights_mode ?? null,
+      target_rbac_users: args.input.target_rbac_users ?? void 0,
+      target_rbac_roles: args.input.target_rbac_roles ?? void 0
+    });
+    return { job: row, item_id: item.id };
+  };
+  resolvers.Mutation["transcriptionJobCancel"] = async (_, args, context) => {
+    await assertOwnsTranscriptionJob(args.id, context);
+    return transcriptionService.cancelJob(args.id);
+  };
   resolvers.Query["evals"] = async (_, args, context, info) => {
     const requestedFields = getRequestedFields(info);
     return {
@@ -5197,7 +5644,8 @@ import {
   generateText as generateText2,
   streamText,
   validateUIMessages,
-  stepCountIs
+  stepCountIs,
+  hasToolCall
 } from "ai";
 
 // src/utils/generate-slug.ts
@@ -5528,6 +5976,9 @@ var ExuluProvider = class {
                   If the user does not explicitly provide the current date, for examle when saying ' this weekend', you should assume 
                   they are talking with the current date in mind as a reference.`;
     let system = instructions || "You are a helpful assistant. When you use a tool to answer a question do not explicitly comment on the result of the tool call unless the user has explicitly you to do something with the result.";
+    if (user?.personal_system_prompt?.trim()) {
+      system += "\n\nUser preferences:\n" + user.personal_system_prompt.trim();
+    }
     system += "\n\n" + genericContext;
     if (memoryContext) {
       system += "\n\n" + memoryContext;
@@ -5627,7 +6078,10 @@ When a tool execution is not approved by the user, do not retry it unless explic
           agent,
           memoryItems
         ),
-        stopWhen: [stepCountIs(maxStepCount || 5)]
+        // Stop after the image_generation tool fires — the widget IS the
+        // assistant's response, no follow-up text turn is wanted (same
+        // reasoning as question_ask: the UI artifact is the message).
+        stopWhen: [stepCountIs(maxStepCount || 5), hasToolCall("image_generation")]
         // make configurable
       });
       console.log("[EXULU] Output: " + JSON.stringify(output, null, 2));
@@ -5708,7 +6162,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
           agent,
           memoryItems
         ),
-        stopWhen: [stepCountIs(maxStepCount || 5)]
+        stopWhen: [stepCountIs(maxStepCount || 5), hasToolCall("image_generation")]
       });
       if (statistics) {
         await Promise.all([
@@ -5933,6 +6387,9 @@ ${extractedText}
     messages = await this.processFilePartsInMessages(messages);
     const genericContext = "IMPORTANT: \n\n The current date is " + (/* @__PURE__ */ new Date()).toLocaleDateString() + " and the current time is " + (/* @__PURE__ */ new Date()).toLocaleTimeString() + ". If the user does not explicitly provide the current date, for examle when saying ' this weekend', you should assume they are talking with the current date in mind as a reference.";
     let system = instructions || "You are a helpful assistant. When you use a tool to answer a question do not explicitly comment on the result of the tool call unless the user has explicitly you to do something with the result.";
+    if (user?.personal_system_prompt?.trim()) {
+      system += "\n\nUser preferences:\n" + user.personal_system_prompt.trim();
+    }
     system += "\n\n" + genericContext;
     const includesContextSearchTool = currentTools?.some(
       (tool2) => tool2.name.toLowerCase().includes("context_search") || tool2.id.includes("context_search") || tool2.type === "context"
@@ -6089,7 +6546,7 @@ When a tool execution is not approved by the user, do not retry it unless explic
       },
       // provide more loops for skills because they are more complex to execute
       // todo allow configuring this per skill
-      stopWhen: [stepCountIs(maxStepCount || currentSkills?.length ? 10 : 5)]
+      stopWhen: [stepCountIs(maxStepCount || currentSkills?.length ? 10 : 5), hasToolCall("image_generation")]
     });
     return {
       stream: result,
@@ -6296,7 +6753,266 @@ async function synthesizeSpeech(args) {
   return Buffer.from(arrayBuf);
 }
 
+// src/exulu/image-generation.ts
+var ImageGenerationError = class extends Error {
+  constructor(upstreamStatus, message) {
+    super(message);
+    this.upstreamStatus = upstreamStatus;
+    this.name = "ImageGenerationError";
+  }
+};
+var resolveProxyConfig = () => {
+  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+  const port = process.env.LITELLM_PORT ?? "4000";
+  const masterKey = process.env.LITELLM_MASTER_KEY;
+  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
+  return { host, port, masterKey };
+};
+var normalizeDataEntries = async (data) => {
+  const out = [];
+  for (const entry of data) {
+    let buffer;
+    let contentType = "image/png";
+    let extension = "png";
+    if (entry.b64_json) {
+      buffer = Buffer.from(entry.b64_json, "base64");
+    } else if (entry.url) {
+      const upstream = await fetch(entry.url);
+      if (!upstream.ok) {
+        throw new ImageGenerationError(
+          upstream.status,
+          `Failed to download generated image from ${entry.url}: ${upstream.status} ${upstream.statusText}`
+        );
+      }
+      const ct = upstream.headers.get("content-type");
+      if (ct && ct.startsWith("image/")) {
+        contentType = ct;
+        const inferred = ct.split("/")[1]?.split(";")[0]?.trim();
+        if (inferred) extension = inferred === "jpeg" ? "jpg" : inferred;
+      }
+      buffer = Buffer.from(await upstream.arrayBuffer());
+    } else {
+      throw new ImageGenerationError(
+        0,
+        "LiteLLM image response entry contained neither b64_json nor url."
+      );
+    }
+    out.push({ buffer, contentType, extension, revisedPrompt: entry.revised_prompt });
+  }
+  return out;
+};
+async function generateImage(args) {
+  if (!args.model) throw new Error("model is required");
+  if (!args.prompt) throw new Error("prompt is required");
+  const cfg = resolveProxyConfig();
+  const body = {
+    model: args.model,
+    prompt: args.prompt
+  };
+  if (args.size) body.size = args.size;
+  if (args.quality) body.quality = args.quality;
+  if (args.n) body.n = args.n;
+  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/generations`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${cfg.masterKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body),
+    signal: args.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ImageGenerationError(
+      res.status,
+      `LiteLLM image generation failed (status ${res.status}): ${text}`.trim()
+    );
+  }
+  const json = await res.json();
+  if (!json?.data || json.data.length === 0) {
+    throw new ImageGenerationError(
+      res.status,
+      "LiteLLM returned no image data in the response."
+    );
+  }
+  return normalizeDataEntries(json.data);
+}
+async function editImage(args) {
+  if (!args.model) throw new Error("model is required");
+  if (!args.prompt) throw new Error("prompt is required");
+  if (!args.references || args.references.length === 0) {
+    throw new Error("at least one reference image is required");
+  }
+  const cfg = resolveProxyConfig();
+  const form = new FormData();
+  form.append("model", args.model);
+  form.append("prompt", args.prompt);
+  if (args.n != null) form.append("n", String(args.n));
+  if (args.size) form.append("size", args.size);
+  if (args.quality) form.append("quality", args.quality);
+  form.append("response_format", "b64_json");
+  for (const ref of args.references) {
+    form.append(
+      "image",
+      new Blob([ref.buffer], { type: ref.mimetype ?? "image/png" }),
+      ref.filename
+    );
+  }
+  if (args.mask) {
+    form.append(
+      "mask",
+      new Blob([args.mask.buffer], { type: args.mask.mimetype ?? "image/png" }),
+      args.mask.filename
+    );
+  }
+  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/edits`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${cfg.masterKey}` },
+    body: form,
+    signal: args.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new ImageGenerationError(
+      res.status,
+      `LiteLLM image edit failed (status ${res.status}): ${text}`.trim()
+    );
+  }
+  const json = await res.json();
+  if (!json?.data || json.data.length === 0) {
+    throw new ImageGenerationError(
+      res.status,
+      "LiteLLM returned no image data in the edit response."
+    );
+  }
+  return normalizeDataEntries(json.data);
+}
+
+// src/exulu/litellm/parse-image-models.ts
+import { existsSync as existsSync2, readFileSync } from "fs";
+var stripComment = (line) => {
+  const idx = line.indexOf("#");
+  return idx >= 0 ? line.slice(0, idx) : line;
+};
+var parseInlineArray = (raw) => {
+  const m = raw.trim().match(/^\[(.*)\]$/);
+  if (!m) return void 0;
+  const inner = m[1] ?? "";
+  if (!inner.trim()) return [];
+  return inner.split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter((s) => s.length > 0);
+};
+var parseBool = (raw) => {
+  const v = raw.trim().toLowerCase();
+  if (v === "true" || v === "yes") return true;
+  if (v === "false" || v === "no") return false;
+  return void 0;
+};
+var parseInt10 = (raw) => {
+  const n = Number(raw.trim());
+  return Number.isInteger(n) ? n : void 0;
+};
+var parseImageGenerationModels = (configPath) => {
+  if (!existsSync2(configPath)) return [];
+  const text = readFileSync(configPath, "utf8");
+  const lines = text.split("\n");
+  const entries = [];
+  let current;
+  for (const rawLine of lines) {
+    const noComment = stripComment(rawLine);
+    if (!noComment.trim()) continue;
+    const indent = (rawLine.match(/^\s*/)?.[0] ?? "").length;
+    const modelNameMatch = noComment.match(
+      /^\s*-\s*model_name\s*:\s*["']?([^"'\s#]+)["']?\s*$/
+    );
+    if (modelNameMatch) {
+      if (current) entries.push(current);
+      current = { model_name: modelNameMatch[1], indent };
+      continue;
+    }
+    if (!current) continue;
+    if (indent <= current.indent && !/^\s*-\s/.test(rawLine)) {
+      entries.push(current);
+      current = void 0;
+      continue;
+    }
+    const kvMatch = noComment.match(/^\s*(\w+)\s*:\s*(.+?)\s*$/);
+    if (!kvMatch) continue;
+    const key2 = kvMatch[1] ?? "";
+    const rawValue = kvMatch[2] ?? "";
+    switch (key2) {
+      case "type": {
+        current.type = rawValue.replace(/^["']|["']$/g, "").trim();
+        break;
+      }
+      case "sizes": {
+        current.sizes = parseInlineArray(rawValue);
+        break;
+      }
+      case "qualities": {
+        current.qualities = parseInlineArray(rawValue);
+        break;
+      }
+      case "supports_edit": {
+        current.supports_edit = parseBool(rawValue);
+        break;
+      }
+      case "max_n": {
+        current.max_n = parseInt10(rawValue);
+        break;
+      }
+    }
+  }
+  if (current) entries.push(current);
+  const imageEntries = entries.filter((e) => e.type === "image_generation");
+  const errors = [];
+  const validated = [];
+  for (const e of imageEntries) {
+    const modelErrs = [];
+    if (!Array.isArray(e.sizes) || e.sizes.length === 0) {
+      modelErrs.push(
+        'model_info.sizes must be a non-empty inline YAML array of strings, e.g. `sizes: ["1024x1024", "1024x1536"]`'
+      );
+    }
+    if (!Array.isArray(e.qualities) || e.qualities.length === 0) {
+      modelErrs.push(
+        'model_info.qualities must be a non-empty inline YAML array of strings, e.g. `qualities: ["auto", "high"]`'
+      );
+    }
+    if (typeof e.supports_edit !== "boolean") {
+      modelErrs.push(
+        "model_info.supports_edit must be a boolean (true/false)"
+      );
+    }
+    if (typeof e.max_n !== "number" || !Number.isInteger(e.max_n) || e.max_n < 1) {
+      modelErrs.push("model_info.max_n must be an integer \u2265 1");
+    }
+    if (modelErrs.length > 0) {
+      errors.push(
+        `  - "${e.model_name}":
+      - ${modelErrs.join("\n      - ")}`
+      );
+      continue;
+    }
+    validated.push({
+      model_name: e.model_name,
+      sizes: e.sizes,
+      qualities: e.qualities,
+      supports_edit: e.supports_edit,
+      max_n: e.max_n
+    });
+  }
+  if (errors.length > 0) {
+    throw new Error(
+      `[EXULU] config.litellm.yaml has image-generation models with missing or invalid model_info keys. Fix and restart Exulu:
+${errors.join("\n")}
+See docs/superpowers/specs/2026-05-31-in-chat-image-generation-design.md for the required schema.`
+    );
+  }
+  return validated;
+};
+
 // src/exulu/routes.ts
+import { resolve as resolvePath } from "path";
 import multer from "multer";
 
 // src/utils/check-provider-rate-limit.ts
@@ -6993,7 +7709,8 @@ var {
   contextPresetsSchema,
   embedderSettingsSchema,
   promptFavoritesSchema,
-  statisticsSchema
+  statisticsSchema,
+  transcriptionJobsSchema
 } = coreSchemas.get();
 var createExpressRoutes = async (app, providers, tools, contexts, config, evals, tracer, queues2, rerankers) => {
   let corsOptions = {
@@ -7051,7 +7768,8 @@ var createExpressRoutes = async (app, providers, tools, contexts, config, evals,
       variablesSchema(),
       workflowTemplatesSchema(),
       statisticsSchema(),
-      rbacSchema()
+      rbacSchema(),
+      transcriptionJobsSchema()
     ],
     contexts ?? [],
     providers,
@@ -7874,17 +8592,498 @@ ${customInstructions}` : agent.instructions;
       }
     }
   );
-  app.use("/litellm/:project", async (req, res) => {
-    if (!isLiteLLMEnabled()) {
-      res.status(503).json({
-        detail: "LiteLLM is not enabled on this deployment. Set EXULU_USE_LITELLM=true."
-      });
-      return;
+  const imageModelsByName = (() => {
+    if (!isLiteLLMEnabled() || !config?.fileUploads) return /* @__PURE__ */ new Map();
+    try {
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? resolvePath(getPackageRoot(), "./config.litellm.yaml");
+      const models2 = parseImageGenerationModels(configPath);
+      return new Map(models2.map((m) => [m.model_name, m]));
+    } catch (err) {
+      console.error(
+        "[EXULU] Skipping /images/* routes due to config.litellm.yaml error:",
+        err.message
+      );
+      return /* @__PURE__ */ new Map();
     }
-    const masterKey = process.env.LITELLM_MASTER_KEY;
-    if (!masterKey) {
-      res.status(503).json({ detail: "LITELLM_MASTER_KEY is not configured." });
-      return;
+  })();
+  const imageRoutesEnabled = isLiteLLMEnabled() && !!config?.fileUploads?.s3region && !!config?.fileUploads?.s3key && !!config?.fileUploads?.s3secret && !!config?.fileUploads?.s3Bucket && imageModelsByName.size > 0;
+  const respond503ImagesNotEnabled = (res) => {
+    res.status(503).json({
+      detail: "Image generation is not enabled on this deployment. Requires EXULU_USE_LITELLM=true, S3 fileUploads configuration, and at least one model in config.litellm.yaml with model_info.type=image_generation."
+    });
+  };
+  const loadAuthedSession = async (req, res, sessionId, rights) => {
+    const authResult = await requestValidators.authenticate(req);
+    if (!authResult.user?.id) {
+      res.status(authResult.code || 401).json({ detail: authResult.message });
+      return null;
+    }
+    const { db } = await postgresClient();
+    const session = await db.from("agent_sessions").where({ id: sessionId }).first();
+    if (!session) {
+      res.status(404).json({ detail: `Session ${sessionId} not found.` });
+      return null;
+    }
+    const sessionRbac = await RBACResolver(
+      db,
+      "agent_sessions",
+      session.id,
+      session.rights_mode || "private"
+    );
+    const allowed = await checkRecordAccess(
+      { ...session, RBAC: sessionRbac },
+      rights,
+      authResult.user
+    );
+    if (!allowed) {
+      res.status(403).json({ detail: `You don't have ${rights} access to this session.` });
+      return null;
+    }
+    return { user: authResult.user, session, db };
+  };
+  const loadStyle = async (db, styleId, user, res) => {
+    if (!styleId) return { markdown: null, id: null };
+    const row = await db.from("platform_configurations").where({ id: styleId }).first();
+    if (!row) {
+      res.status(404).json({ detail: `Style ${styleId} not found.` });
+      return "error";
+    }
+    const rbac = await RBACResolver(
+      db,
+      "platform_configurations",
+      row.id,
+      row.rights_mode || "private"
+    );
+    const allowed = await checkRecordAccess(
+      { ...row, RBAC: rbac },
+      "read",
+      user
+    );
+    if (!allowed) {
+      res.status(403).json({ detail: "You don't have access to that style." });
+      return "error";
+    }
+    const value = typeof row.config_value === "string" ? (() => {
+      try {
+        return JSON.parse(row.config_value);
+      } catch {
+        return null;
+      }
+    })() : row.config_value;
+    return { markdown: value?.markdown ?? null, id: row.id };
+  };
+  const validateGenerationParams = (body, res) => {
+    const { model: modelName, prompt, n, size, quality } = body || {};
+    const model = typeof modelName === "string" ? imageModelsByName.get(modelName) : void 0;
+    if (!model) {
+      res.status(400).json({
+        detail: `Unknown image-generation model "${modelName}". Available: ${[...imageModelsByName.keys()].join(", ")}.`
+      });
+      return null;
+    }
+    if (typeof prompt !== "string" || prompt.trim().length === 0) {
+      res.status(400).json({ detail: "prompt must be a non-empty string." });
+      return null;
+    }
+    const requestedN = typeof n === "number" ? n : 1;
+    if (!Number.isInteger(requestedN) || requestedN < 1 || requestedN > model.max_n) {
+      res.status(400).json({
+        detail: `n must be an integer between 1 and ${model.max_n} for model ${model.model_name}.`
+      });
+      return null;
+    }
+    if (size && !model.sizes.includes(size)) {
+      res.status(400).json({
+        detail: `size "${size}" is not supported by ${model.model_name}. Allowed: ${model.sizes.join(", ")}.`
+      });
+      return null;
+    }
+    if (quality && !model.qualities.includes(quality)) {
+      res.status(400).json({
+        detail: `quality "${quality}" is not supported by ${model.model_name}. Allowed: ${model.qualities.join(", ")}.`
+      });
+      return null;
+    }
+    return { model, prompt, n: requestedN, size, quality };
+  };
+  const uploadGeneratedImages = async (images, sessionId, toolCallId, userId) => {
+    if (!config?.fileUploads) {
+      throw new Error("File uploads not configured.");
+    }
+    const keys = [];
+    const revisedPrompts = [];
+    for (const img of images) {
+      const filename = `${randomUUID2()}.${img.extension}`;
+      const key2 = `sessions/${sessionId}/images/${toolCallId}/${filename}`;
+      const fullKey = await uploadFile(
+        img.buffer,
+        key2,
+        config,
+        { contentType: img.contentType },
+        userId
+      );
+      keys.push(fullKey);
+      revisedPrompts.push(img.revisedPrompt ?? null);
+    }
+    const presignedUrls = await Promise.all(
+      keys.map((fullKey) => {
+        const slash = fullKey.indexOf("/");
+        const bucket = slash > 0 ? fullKey.slice(0, slash) : config.fileUploads.s3Bucket;
+        const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+        return getPresignedUrl(bucket, objectKey, config);
+      })
+    );
+    return { keys, revisedPrompts, presignedUrls };
+  };
+  app.post("/images/generate", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, styleId } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const params = validateGenerationParams(req.body, res);
+    if (!params) return;
+    const style = await loadStyle(authed.db, styleId, authed.user, res);
+    if (style === "error") return;
+    const finalPrompt = style.markdown ? `${params.prompt}
+
+${style.markdown}` : params.prompt;
+    try {
+      await Promise.race([
+        waitForLiteLLMReady(),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
+        )
+      ]);
+    } catch {
+      res.status(503).json({ detail: "Image service is not ready. Try again shortly." });
+      return;
+    }
+    const abortController = new AbortController();
+    req.on("close", () => abortController.abort());
+    try {
+      const images = await generateImage({
+        model: params.model.model_name,
+        prompt: finalPrompt,
+        n: params.n,
+        size: params.size,
+        quality: params.quality,
+        signal: abortController.signal
+      });
+      const { keys, revisedPrompts, presignedUrls } = await uploadGeneratedImages(
+        images,
+        sessionId,
+        toolCallId,
+        authed.user.id
+      );
+      const [row] = await authed.db("image_generations").insert({
+        session_id: sessionId,
+        tool_call_id: toolCallId,
+        user_id: authed.user.id,
+        operation: "generate",
+        model: params.model.model_name,
+        prompt: params.prompt,
+        applied_style_id: style.id,
+        applied_style_markdown: style.markdown,
+        size: params.size,
+        quality: params.quality,
+        n: params.n,
+        image_keys: JSON.stringify(keys),
+        revised_prompts: JSON.stringify(revisedPrompts),
+        selected: false
+      }).returning("*");
+      res.status(200).json({
+        generationId: row.id,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: presignedUrls[i],
+          revisedPrompt: revisedPrompts[i]
+        }))
+      });
+    } catch (err) {
+      if (abortController.signal.aborted) return;
+      if (err instanceof ImageGenerationError) {
+        const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+        res.status(code).json({ detail: err.message });
+        return;
+      }
+      console.error("[EXULU] /images/generate failed", err);
+      res.status(500).json({
+        detail: err instanceof Error ? err.message : "Image generation failed."
+      });
+    }
+  });
+  app.post("/images/edit", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, styleId, referenceImageKeys, maskKey } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    if (!Array.isArray(referenceImageKeys) || referenceImageKeys.length === 0) {
+      res.status(400).json({ detail: "referenceImageKeys must be a non-empty array." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const params = validateGenerationParams(req.body, res);
+    if (!params) return;
+    if (!params.model.supports_edit) {
+      res.status(400).json({
+        detail: `Model ${params.model.model_name} does not support image editing.`
+      });
+      return;
+    }
+    const userPrefix = `user_${authed.user.id}/`;
+    const sessionPrefix = `sessions/${sessionId}/`;
+    const ownsKey = (k) => k.includes(userPrefix) || k.includes(sessionPrefix);
+    if (!referenceImageKeys.every((k) => typeof k === "string" && ownsKey(k))) {
+      res.status(403).json({ detail: "One or more reference image keys are not accessible." });
+      return;
+    }
+    if (maskKey && (typeof maskKey !== "string" || !ownsKey(maskKey))) {
+      res.status(403).json({ detail: "Mask image is not accessible." });
+      return;
+    }
+    const style = await loadStyle(authed.db, styleId, authed.user, res);
+    if (style === "error") return;
+    const finalPrompt = style.markdown ? `${params.prompt}
+
+${style.markdown}` : params.prompt;
+    try {
+      await Promise.race([
+        waitForLiteLLMReady(),
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error("LiteLLM not ready")), 5e3)
+        )
+      ]);
+    } catch {
+      res.status(503).json({ detail: "Image service is not ready. Try again shortly." });
+      return;
+    }
+    const fetchRef = async (fullKey) => {
+      const slash = fullKey.indexOf("/");
+      const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+      const buf = await getS3ObjectBytes(objectKey, config);
+      const filename = fullKey.split("/").pop() ?? "image.png";
+      const ext = filename.split(".").pop()?.toLowerCase() ?? "png";
+      const mimetype = ext === "jpg" || ext === "jpeg" ? "image/jpeg" : `image/${ext}`;
+      return { buffer: buf, filename, mimetype };
+    };
+    const abortController = new AbortController();
+    req.on("close", () => abortController.abort());
+    try {
+      const references = await Promise.all(referenceImageKeys.map(fetchRef));
+      const mask = maskKey ? await fetchRef(maskKey) : void 0;
+      const images = await editImage({
+        model: params.model.model_name,
+        prompt: finalPrompt,
+        references,
+        mask,
+        n: params.n,
+        size: params.size,
+        quality: params.quality,
+        signal: abortController.signal
+      });
+      const { keys, revisedPrompts, presignedUrls } = await uploadGeneratedImages(
+        images,
+        sessionId,
+        toolCallId,
+        authed.user.id
+      );
+      const [row] = await authed.db("image_generations").insert({
+        session_id: sessionId,
+        tool_call_id: toolCallId,
+        user_id: authed.user.id,
+        operation: "edit",
+        model: params.model.model_name,
+        prompt: params.prompt,
+        applied_style_id: style.id,
+        applied_style_markdown: style.markdown,
+        size: params.size,
+        quality: params.quality,
+        n: params.n,
+        reference_image_keys: JSON.stringify(referenceImageKeys),
+        mask_image_key: maskKey,
+        image_keys: JSON.stringify(keys),
+        revised_prompts: JSON.stringify(revisedPrompts),
+        selected: false
+      }).returning("*");
+      res.status(200).json({
+        generationId: row.id,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: presignedUrls[i],
+          revisedPrompt: revisedPrompts[i]
+        }))
+      });
+    } catch (err) {
+      if (abortController.signal.aborted) return;
+      if (err instanceof ImageGenerationError) {
+        const code = err.upstreamStatus >= 500 ? 502 : err.upstreamStatus;
+        res.status(code).json({ detail: err.message });
+        return;
+      }
+      console.error("[EXULU] /images/edit failed", err);
+      res.status(500).json({
+        detail: err instanceof Error ? err.message : "Image edit failed."
+      });
+    }
+  });
+  app.post("/images/select", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const { sessionId, toolCallId, selections } = req.body || {};
+    if (typeof sessionId !== "string" || typeof toolCallId !== "string") {
+      res.status(400).json({ detail: "sessionId and toolCallId are required." });
+      return;
+    }
+    if (!Array.isArray(selections) || selections.length === 0) {
+      res.status(400).json({ detail: "selections must be a non-empty array." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "write");
+    if (!authed) return;
+    const rows = await authed.db("image_generations").where({ session_id: sessionId, tool_call_id: toolCallId }).select("*");
+    const rowsById = new Map(rows.map((r) => [r.id, r]));
+    const selectedDetails = [];
+    const rowsToMarkSelected = /* @__PURE__ */ new Set();
+    for (const sel of selections) {
+      if (typeof sel?.generationId !== "string" || typeof sel?.imageKey !== "string") {
+        res.status(400).json({ detail: "Each selection needs generationId + imageKey." });
+        return;
+      }
+      const row = rowsById.get(sel.generationId);
+      if (!row) {
+        res.status(404).json({ detail: `Generation ${sel.generationId} not found in this tool call.` });
+        return;
+      }
+      const keys = Array.isArray(row.image_keys) ? row.image_keys : (() => {
+        try {
+          return JSON.parse(row.image_keys);
+        } catch {
+          return [];
+        }
+      })();
+      if (!keys.includes(sel.imageKey)) {
+        res.status(400).json({ detail: `imageKey not part of generation ${sel.generationId}.` });
+        return;
+      }
+      const slash = sel.imageKey.indexOf("/");
+      const bucket = slash > 0 ? sel.imageKey.slice(0, slash) : config.fileUploads.s3Bucket;
+      const objectKey = slash > 0 ? sel.imageKey.slice(slash + 1) : sel.imageKey;
+      const presignedUrl = await getPresignedUrl(bucket, objectKey, config);
+      let styleName = null;
+      if (row.applied_style_id) {
+        const styleRow = await authed.db("platform_configurations").where({ id: row.applied_style_id }).first();
+        const parsed = styleRow?.config_value && typeof styleRow.config_value === "string" ? (() => {
+          try {
+            return JSON.parse(styleRow.config_value);
+          } catch {
+            return null;
+          }
+        })() : styleRow?.config_value;
+        styleName = parsed?.name ?? null;
+      }
+      selectedDetails.push({
+        key: sel.imageKey,
+        presignedUrl,
+        prompt: row.prompt,
+        model: row.model,
+        styleName
+      });
+      rowsToMarkSelected.add(row.id);
+    }
+    await authed.db("image_generations").whereIn("id", [...rowsToMarkSelected]).update({ selected: true });
+    const lines = selectedDetails.map(
+      (d) => `- ${d.presignedUrl} (prompt: "${d.prompt}", model: ${d.model}${d.styleName ? `, style: ${d.styleName}` : ""})`
+    );
+    const messageText = "The user generated and selected the following image(s) in this chat:\n" + lines.join("\n");
+    const messageId = randomUUID2();
+    const uiMessage = {
+      id: messageId,
+      role: "system",
+      parts: [{ type: "text", text: messageText }]
+    };
+    await authed.db("agent_messages").insert({
+      content: JSON.stringify(uiMessage),
+      message_id: messageId,
+      session: sessionId,
+      user: authed.user.id
+    });
+    res.status(200).json({ ok: true, systemMessage: uiMessage, selectedImages: selectedDetails });
+  });
+  app.get("/images/history", async (req, res) => {
+    if (!imageRoutesEnabled) return respond503ImagesNotEnabled(res);
+    const sessionId = typeof req.query.sessionId === "string" ? req.query.sessionId : "";
+    const toolCallId = typeof req.query.toolCallId === "string" ? req.query.toolCallId : "";
+    if (!sessionId || !toolCallId) {
+      res.status(400).json({ detail: "sessionId and toolCallId query params are required." });
+      return;
+    }
+    const authed = await loadAuthedSession(req, res, sessionId, "read");
+    if (!authed) return;
+    const rows = await authed.db("image_generations").where({ session_id: sessionId, tool_call_id: toolCallId }).orderBy("createdAt", "asc").select("*");
+    const parseList = (v) => {
+      if (!v) return [];
+      if (Array.isArray(v)) return v;
+      try {
+        return JSON.parse(v);
+      } catch {
+        return [];
+      }
+    };
+    const sign = async (fullKey) => {
+      const slash = fullKey.indexOf("/");
+      const bucket = slash > 0 ? fullKey.slice(0, slash) : config.fileUploads.s3Bucket;
+      const objectKey = slash > 0 ? fullKey.slice(slash + 1) : fullKey;
+      return getPresignedUrl(bucket, objectKey, config);
+    };
+    const history = await Promise.all(rows.map(async (r) => {
+      const keys = parseList(r.image_keys);
+      const refs = parseList(r.reference_image_keys);
+      const revisedPrompts = parseList(r.revised_prompts);
+      const [imageUrls, referenceUrls] = await Promise.all([
+        Promise.all(keys.map(sign)),
+        Promise.all(refs.map(sign))
+      ]);
+      return {
+        generationId: r.id,
+        createdAt: r.createdAt,
+        operation: r.operation,
+        model: r.model,
+        prompt: r.prompt,
+        appliedStyleId: r.applied_style_id ?? null,
+        appliedStyleMarkdown: r.applied_style_markdown ?? null,
+        size: r.size ?? null,
+        quality: r.quality ?? null,
+        n: r.n ?? 1,
+        selected: !!r.selected,
+        error: r.error ?? null,
+        maskImageKey: r.mask_image_key ?? null,
+        images: keys.map((key2, i) => ({
+          key: key2,
+          presignedUrl: imageUrls[i],
+          revisedPrompt: revisedPrompts[i] ?? null
+        })),
+        references: refs.map((key2, i) => ({ key: key2, presignedUrl: referenceUrls[i] }))
+      };
+    }));
+    res.status(200).json({ history });
+  });
+  app.use("/litellm/:project", async (req, res) => {
+    if (!isLiteLLMEnabled()) {
+      res.status(503).json({
+        detail: "LiteLLM is not enabled on this deployment. Set EXULU_USE_LITELLM=true."
+      });
+      return;
+    }
+    const masterKey = process.env.LITELLM_MASTER_KEY;
+    if (!masterKey) {
+      res.status(503).json({ detail: "LITELLM_MASTER_KEY is not configured." });
+      return;
     }
     const authenticationResult = await requestValidators.authenticate(req);
     if (!authenticationResult.user?.id) {
@@ -11004,216 +12203,382 @@ var emailTool = new ExuluTool({
   }
 });
 
-// src/validators/postgres-name.ts
-var isValidPostgresName = (id) => {
-  const regex = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-  const isValid = regex.test(id);
-  const length = id.length;
-  return isValid && length <= 80 && length > 2;
+// src/templates/tools/transcribe.ts
+import { randomUUID as randomUUID5 } from "crypto";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { dirname, join as join2 } from "path";
+import { z as z10 } from "zod";
+var SANDBOX_ROOT = "/tmp/exulu-sessions";
+var parseSandboxPath = (input) => {
+  const stripped = input.startsWith("file://") ? input.slice("file://".length) : input;
+  if (!stripped.startsWith(`${SANDBOX_ROOT}/`)) return null;
+  const tail = stripped.slice(SANDBOX_ROOT.length + 1);
+  const slash = tail.indexOf("/");
+  if (slash < 1) return null;
+  const sessionId = tail.slice(0, slash);
+  const relPath = tail.slice(slash + 1);
+  if (!relPath) return null;
+  return { sessionId, relPath };
 };
-
-// src/utils/python-setup.ts
-import { exec as exec2 } from "child_process";
-import { promisify as promisify2 } from "util";
-import { resolve, join as join2, dirname } from "path";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { fileURLToPath } from "url";
-var execAsync2 = promisify2(exec2);
-function getPackageRoot() {
-  const currentFile = fileURLToPath(import.meta.url);
-  let currentDir = dirname(currentFile);
-  let attempts = 0;
-  const maxAttempts = 10;
-  while (attempts < maxAttempts) {
-    const packageJsonPath = join2(currentDir, "package.json");
-    if (existsSync2(packageJsonPath)) {
-      try {
-        const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
-        if (packageJson.name === "@exulu/backend") {
-          return currentDir;
-        }
-      } catch {
-      }
+var audioMimetypeFromExtension = (filename) => {
+  const ext = filename.split(".").pop()?.toLowerCase();
+  switch (ext) {
+    case "mp3":
+      return "audio/mpeg";
+    case "m4a":
+    case "mp4":
+      return "audio/mp4";
+    case "wav":
+      return "audio/wav";
+    case "ogg":
+    case "oga":
+      return "audio/ogg";
+    case "flac":
+      return "audio/flac";
+    case "webm":
+      return "audio/webm";
+    case "aac":
+      return "audio/aac";
+    case "mpga":
+    case "mpeg":
+      return "audio/mpeg";
+    default:
+      throw new Error(
+        `Unable to infer an audio mimetype from filename "${filename}". Supported extensions: mp3, m4a, mp4, wav, ogg, flac, webm, aac, mpga.`
+      );
+  }
+};
+var transcribeTool = new ExuluTool({
+  id: "transcribe_audio",
+  name: "Transcribe Audio",
+  description: "Transcribe an audio file (mp3, wav, m4a, etc.) from a URL to text using the configured speech-to-text model. The transcript is stored as a .txt file on S3 and the URL is returned; use this for clips that may be too long to inline in the conversation.",
+  inputSchema: z10.object({
+    audio_url: z10.string().describe(
+      "Location of the audio file to transcribe. Accepts a publicly fetchable URL (https URL or presigned S3 URL), or a sandbox path such as '/tmp/exulu-sessions/<sessionId>/<file>' or 'file:///tmp/exulu-sessions/<sessionId>/<file>' \u2014 sandbox paths are resolved to their persisted S3 copy."
+    ),
+    language: z10.string().optional().describe(
+      "ISO-639-1 language code of the audio, e.g. 'en' or 'de'. Omit to let the model auto-detect."
+    )
+  }),
+  type: "function",
+  config: [{
+    name: "default_language",
+    description: "ISO-639-1 language code of the audio, e.g. 'en' or 'de'. Omit to let the model auto-detect.",
+    type: "string",
+    default: void 0
+  }],
+  execute: async ({ audio_url, language, user, exuluConfig, sessionID }) => {
+    if (!language && exuluConfig?.default_language) {
+      language = exuluConfig?.default_language;
+    } else {
+      language = "en";
     }
-    const parentDir = resolve(currentDir, "..");
-    if (parentDir === currentDir) {
-      break;
+    language = exuluConfig?.default_language;
+    console.log("[EXULU] Exulu config", exuluConfig);
+    if (!isLiteLLMEnabled()) {
+      console.error("[EXULU] Speech-to-text is not enabled on this deployment (EXULU_USE_LITELLM is not 'true').");
+      throw new Error(
+        "Speech-to-text is not enabled on this deployment (EXULU_USE_LITELLM is not 'true')."
+      );
     }
-    currentDir = parentDir;
-    attempts++;
-  }
-  const fallback = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
-  return fallback;
-}
-function getSetupScriptPath(packageRoot) {
-  return resolve(packageRoot, "ee/python/setup.sh");
-}
-function getVenvPath(packageRoot) {
-  return resolve(packageRoot, "ee/python/.venv");
-}
-function isPythonEnvironmentSetup(packageRoot) {
-  const root = packageRoot ?? getPackageRoot();
-  const venvPath = getVenvPath(root);
-  const pythonPath = join2(venvPath, "bin", "python");
-  return existsSync2(venvPath) && existsSync2(pythonPath);
-}
-async function setupPythonEnvironment(options = {}) {
-  const {
-    packageRoot = getPackageRoot(),
-    force = false,
-    verbose = false,
-    timeout = 6e5
-    // 10 minutes
-  } = options;
-  if (!force && isPythonEnvironmentSetup(packageRoot)) {
-    if (verbose) {
-      console.log("\u2713 Python environment already set up");
+    if (!process.env.TRANSCRIPTION_MODEL) {
+      console.error("[EXULU] TRANSCRIPTION_MODEL env var is not set.");
+      throw new Error("TRANSCRIPTION_MODEL env var is not set.");
     }
-    return {
-      success: true,
-      message: "Python environment already exists",
-      alreadyExists: true
-    };
-  }
-  const setupScriptPath = getSetupScriptPath(packageRoot);
-  if (!existsSync2(setupScriptPath)) {
-    return {
-      success: false,
-      message: `Setup script not found at: ${setupScriptPath}`,
-      alreadyExists: false
-    };
-  }
-  try {
-    if (verbose) {
-      console.log("Setting up Python environment...");
+    if (!exuluConfig?.fileUploads) {
+      console.error("[EXULU] File uploads are not configured; the transcribe tool requires S3 to store transcripts.");
+      throw new Error(
+        "File uploads are not configured; the transcribe tool requires S3 to store transcripts."
+      );
     }
-    const { stdout, stderr } = await execAsync2(`bash "${setupScriptPath}"`, {
-      cwd: packageRoot,
-      timeout,
-      env: {
-        ...process.env,
-        // Ensure script can write to the directory
-        PYTHONDONTWRITEBYTECODE: "1"
-      },
-      maxBuffer: 10 * 1024 * 1024
-      // 10MB buffer
+    const sandboxPath = parseSandboxPath(audio_url);
+    let buffer;
+    let mimetype;
+    let originalname;
+    if (sandboxPath) {
+      if (!user?.id) {
+        throw new Error(
+          "Sandbox audio paths require an authenticated user; got no user on the tool call."
+        );
+      }
+      if (sessionID && sandboxPath.sessionId !== sessionID) {
+        throw new Error(
+          `Refusing to transcribe an audio file from a different session's sandbox (path session=${sandboxPath.sessionId}, current session=${sessionID}).`
+        );
+      }
+      const rawKey = `user_${user.id}/sessions/${sandboxPath.sessionId}/${sandboxPath.relPath}`;
+      console.log("[EXULU] Transcribing audio from sandbox path", {
+        rawKey
+      });
+      const matches = await listS3ObjectsByPrefix(rawKey, exuluConfig);
+      const found = matches.find((m) => m.key.endsWith(rawKey));
+      if (!found) {
+        console.error("[EXULU] Sandbox audio file not found in S3 storage at", {
+          rawKey,
+          matches
+        });
+        throw new Error(
+          `Sandbox audio file not found in S3 storage at "${rawKey}". The file may not have been persisted yet \u2014 try again after the sandbox flushes it.`
+        );
+      }
+      buffer = await getS3ObjectBytes(found.key, exuluConfig);
+      originalname = decodeURIComponent(
+        sandboxPath.relPath.split("/").pop() || "audio"
+      );
+      mimetype = audioMimetypeFromExtension(originalname);
+    } else {
+      console.log("[EXULU] Fetching audio from URL", {
+        audio_url
+      });
+      const upstream = await fetch(audio_url);
+      if (!upstream.ok) {
+        console.error("[EXULU] Failed to fetch audio from", {
+          audio_url,
+          upstream
+        });
+        throw new Error(
+          `Failed to fetch audio from ${audio_url}: ${upstream.status} ${upstream.statusText}`
+        );
+      }
+      mimetype = upstream.headers.get("content-type") || "audio/mpeg";
+      if (!mimetype.startsWith("audio/")) {
+        throw new Error(
+          `URL did not return an audio file (content-type: ${mimetype}).`
+        );
+      }
+      buffer = Buffer.from(await upstream.arrayBuffer());
+      originalname = "audio";
+      try {
+        const pathname = new URL(audio_url).pathname;
+        const last = pathname.split("/").pop();
+        if (last) originalname = decodeURIComponent(last);
+      } catch {
+      }
+    }
+    const { text } = await transcribeAudio({
+      file: { buffer, originalname, mimetype },
+      language
+    });
+    const transcriptBuffer = Buffer.from(text, "utf-8");
+    const transcriptFilename = `${randomUUID5()}.txt`;
+    const transcriptKey = sessionID ? `sessions/${sessionID}/transcripts/${transcriptFilename}` : `transcripts/${transcriptFilename}`;
+    console.log("[EXULU] Uploading transcript to S3", {
+      transcriptFilename,
+      transcriptKey
+    });
+    const url = await uploadFile(
+      transcriptBuffer,
+      transcriptKey,
+      exuluConfig,
+      { contentType: "text/plain" },
+      user?.id
+    );
+    console.log("[EXULU] Uploaded transcript to S3", {
+      url
     });
-    const output = stdout + stderr;
-    const versionMatch = output.match(/Python (\d+\.\d+\.\d+)/);
-    const pythonVersion = versionMatch ? versionMatch[1] : void 0;
-    if (verbose) {
-      console.log(output);
+    let sandboxLocalPath;
+    if (sessionID) {
+      sandboxLocalPath = join2(
+        SANDBOX_ROOT,
+        sessionID,
+        "transcripts",
+        transcriptFilename
+      );
+      console.log("[EXULU] Mirroring transcript into session sandbox", {
+        sandboxLocalPath
+      });
+      try {
+        await mkdir2(dirname(sandboxLocalPath), { recursive: true });
+        await writeFile2(sandboxLocalPath, transcriptBuffer);
+      } catch (err) {
+        console.error(
+          `[EXULU] Failed to write transcript to sandbox dir ${sandboxLocalPath}; S3 copy is unaffected.`,
+          err
+        );
+        sandboxLocalPath = void 0;
+      }
     }
+    console.log("[EXULU] Transcribed audio successfully", {
+      text,
+      url,
+      sandboxLocalPath,
+      length: text.length
+    });
     return {
-      success: true,
-      message: "Python environment set up successfully",
-      alreadyExists: false,
-      pythonVersion,
-      output
-    };
-  } catch (error) {
-    const errorOutput = error.stdout + error.stderr;
-    return {
-      success: false,
-      message: `Setup failed: ${error.message}`,
-      alreadyExists: false,
-      output: errorOutput
+      result: sandboxLocalPath ? `Transcript stored at: ${url} (also available in the session sandbox at ${sandboxLocalPath}, ${text.length} characters).` : `${url}`
     };
   }
-}
-function getPythonSetupInstructions() {
-  return `
-Python environment not set up. Please run one of the following commands:
-
-Option 1 (Automatic):
-  import { setupPythonEnvironment } from '@exulu/backend';
-  await setupPythonEnvironment();
-
-Option 2 (Manual - for package consumers):
-  npx @exulu/backend setup-python
-
-Option 3 (Manual - for contributors):
-  npm run python:setup
-
-These commands will automatically create a Python virtual environment (.venv)
-in the @exulu/backend package and install all required dependencies.
-
-Requirements:
-  - Python 3.10 or higher must be installed
-  - pip must be available
-  - venv module must be available (for creating virtual environments)
-
-If Python dependencies are not installed, install them first, then run one of the commands above:
-  - macOS: brew install python@3.12
-  - Ubuntu/Debian: sudo apt-get install python3.12 python3-pip python3-venv
-  - Alpine Linux: apk add python3 py3-pip python3-dev
-  - Windows: Download from https://www.python.org/downloads/
-
-Note: In Docker containers, ensure you install all three components:
-  Ubuntu/Debian: apt-get install -y python3 python3-pip python3-venv
-  Alpine: apk add python3 py3-pip python3-dev
-`.trim();
-}
-async function validatePythonEnvironment(packageRoot, checkPackages = true) {
-  const root = packageRoot ?? getPackageRoot();
-  const venvPath = getVenvPath(root);
-  const pythonPath = join2(venvPath, "bin", "python");
-  if (!existsSync2(venvPath)) {
-    return {
-      valid: false,
-      message: getPythonSetupInstructions()
-    };
+});
+
+// src/templates/tools/image-generation.ts
+import { z as z11 } from "zod";
+var _cachedImageModels;
+var setCachedImageModels = (models2) => {
+  _cachedImageModels = models2;
+};
+var buildDefaults = (models2) => {
+  const m = models2[0];
+  if (!m) {
+    return { model: "", size: "1024x1024", quality: "auto", n: 1 };
   }
-  if (!existsSync2(pythonPath)) {
-    return {
-      valid: false,
-      message: "Python virtual environment is corrupted. Please run:\n  await setupPythonEnvironment({ force: true })"
-    };
+  return {
+    model: m.model_name,
+    size: m.sizes.includes("1024x1024") ? "1024x1024" : m.sizes[0],
+    quality: m.qualities.includes("auto") ? "auto" : m.qualities[0],
+    n: 1
+  };
+};
+var loadAvailableStyles = async (user) => {
+  if (!user?.id) return [];
+  const { db } = await postgresClient();
+  const rows = await db.from("platform_configurations").where("config_key", "like", "image_generation_style:%").select("*");
+  const visible = [];
+  for (const row of rows) {
+    const rbac = await RBACResolver(
+      db,
+      "platform_configurations",
+      row.id,
+      row.rights_mode || "private"
+    );
+    const hasAccess = await checkRecordAccess(
+      { ...row, RBAC: rbac },
+      "read",
+      user
+    );
+    if (!hasAccess) continue;
+    const value = typeof row.config_value === "string" ? safeJsonParse(row.config_value) : row.config_value;
+    visible.push({
+      id: row.id,
+      name: value?.name ?? row.config_key.replace(/^image_generation_style:/, ""),
+      description: row.description ?? null,
+      owner: String(row.created_by) === String(user.id) ? "user" : "shared"
+    });
   }
+  return visible;
+};
+var safeJsonParse = (s) => {
   try {
-    await execAsync2(`"${pythonPath}" --version`, { cwd: root });
+    return JSON.parse(s);
   } catch {
-    return {
-      valid: false,
-      message: "Python executable is not working. Please run:\n  await setupPythonEnvironment({ force: true })"
-    };
+    return null;
   }
-  if (checkPackages) {
-    const criticalPackages = ["docling", "transformers"];
-    const missingPackages = [];
-    for (const pkg of criticalPackages) {
-      try {
-        await execAsync2(`"${pythonPath}" -c "import ${pkg}"`, {
-          cwd: root,
-          timeout: 1e4
-          // 10 second timeout per import check
-        });
-      } catch {
-        missingPackages.push(pkg);
+};
+var createImageGenerationWidgetTool = (models2) => {
+  setCachedImageModels(models2);
+  return new ExuluTool({
+    id: "image_generation",
+    name: "image_generation",
+    description: "Open an in-chat image generation widget pre-filled with your prompt. The user picks the model, size, quality and count, optionally attaches reference images for editing, applies a saved style, generates one or more candidates, and selects the final image(s) to share back into the conversation. Use this whenever the user asks to create or edit an image.",
+    needsApproval: false,
+    type: "function",
+    config: [],
+    inputSchema: z11.object({
+      prompt: z11.string().describe(
+        "Initial image prompt. The user can edit it before generating."
+      )
+    }),
+    execute: async ({ prompt, user, sessionID }, options) => {
+      if (!isLiteLLMEnabled()) {
+        throw new Error(
+          "Image generation is not enabled on this deployment (EXULU_USE_LITELLM is not 'true')."
+        );
       }
-    }
-    if (missingPackages.length > 0) {
+      if (!_cachedImageModels || _cachedImageModels.length === 0) {
+        throw new Error(
+          "No image-generation models are registered in config.litellm.yaml."
+        );
+      }
+      const toolCallId = options?.toolCallId;
+      const styles = await loadAvailableStyles(user);
       return {
-        valid: false,
-        message: `Python environment exists but required packages are not installed: ${missingPackages.join(", ")}
+        result: JSON.stringify({
+          type: "image_generation_widget",
+          toolCallId,
+          sessionId: sessionID,
+          initialPrompt: prompt,
+          models: _cachedImageModels.map((m) => ({
+            name: m.model_name,
+            sizes: m.sizes,
+            qualities: m.qualities,
+            supportsEdit: m.supports_edit,
+            maxN: m.max_n
+          })),
+          styles,
+          defaults: buildDefaults(_cachedImageModels)
+        })
+      };
+    }
+  });
+};
+
+// src/exulu/app/index.ts
+import { resolve } from "path";
+
+// src/validators/postgres-name.ts
+var isValidPostgresName = (id) => {
+  const regex = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+  const isValid = regex.test(id);
+  const length = id.length;
+  return isValid && length <= 80 && length > 2;
+};
 
-This usually happens when:
-1. The .venv folder was copied but dependencies were not installed
-2. The package was installed via npm but setup script was not run
+// src/templates/contexts/transcriptions.ts
+var transcriptionsContext = new ExuluContext({
+  id: "transcriptions",
+  name: "Transcriptions",
+  description: "Diarized audio transcripts",
+  fields: [
+    { name: "transcript_text", type: "longText", editable: true },
+    { name: "audio", type: "file" },
+    { name: "language", type: "text" },
+    { name: "duration_seconds", type: "number" },
+    { name: "speakers", type: "json" },
+    { name: "raw_segments", type: "json", editable: false }
+  ],
+  sources: [],
+  active: true,
+  configuration: {
+    calculateVectors: "onInsert",
+    defaultRightsMode: "private"
+  }
+});
 
-Please run:
-  await setupPythonEnvironment({ force: true })
+// src/templates/contexts/index.ts
+var builtInContexts = {
+  transcriptions: transcriptionsContext
+};
 
-Or manually run the setup script:
-  bash ` + getSetupScriptPath(root)
-      };
+// src/exulu/transcription/polling-loop.ts
+var POLL_INTERVAL_MS = 5e3;
+var MAX_PER_TICK = 50;
+var timer = null;
+var stopped = false;
+var tick = async () => {
+  if (stopped) return;
+  try {
+    await transcriptionService.pollOnce(MAX_PER_TICK);
+  } catch (err) {
+    console.error(`[EXULU-TRANSCRIPTION] polling tick failed: ${err.message}`);
+  } finally {
+    if (!stopped) {
+      timer = setTimeout(tick, POLL_INTERVAL_MS);
     }
   }
-  return {
-    valid: true,
-    message: "Python environment is valid"
+};
+var startTranscriptionPollingLoop = () => {
+  if (timer) return;
+  stopped = false;
+  timer = setTimeout(tick, POLL_INTERVAL_MS);
+  const stop = () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
   };
-}
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+};
 
 // src/exulu/app/index.ts
 var isDev = process.env.NODE_ENV !== "production";
@@ -11279,8 +12644,14 @@ var ExuluApp = class {
     rerankers
   }) => {
     this._evals = redisServer.host?.length && redisServer.port?.length ? [...getDefaultEvals(), ...evals ?? []] : [];
+    if (contexts && "transcriptions" in contexts) {
+      console.warn(
+        "[EXULU] User-defined 'transcriptions' context overridden by built-in. Rename your context to avoid the collision."
+      );
+    }
     this._contexts = {
-      ...contexts
+      ...contexts,
+      ...builtInContexts
     };
     this._rerankers = [...rerankers ?? []];
     this._agents = [...agents ?? []];
@@ -11307,12 +12678,30 @@ var ExuluApp = class {
       ...providers ?? []
     ];
     this._config = config;
+    const transcriptionTools = [];
+    if (process.env.TRANSCRIPTION_MODEL && config?.fileUploads && config?.fileUploads?.s3region && config?.fileUploads?.s3key && config?.fileUploads?.s3secret && config?.fileUploads?.s3Bucket) {
+      transcriptionTools.push(transcribeTool);
+    }
+    const imageGenerationTools = [];
+    const s3Configured = !!config?.fileUploads && !!config.fileUploads.s3region && !!config.fileUploads.s3key && !!config.fileUploads.s3secret && !!config.fileUploads.s3Bucket;
+    if (isLiteLLMEnabled() && s3Configured) {
+      const configPath = process.env.LITELLM_CONFIG_PATH ?? resolve(getPackageRoot(), "./config.litellm.yaml");
+      const imageModels = parseImageGenerationModels(configPath);
+      if (imageModels.length > 0) {
+        console.log(
+          `[EXULU] Registering image_generation widget tool with ${imageModels.length} model(s): ${imageModels.map((m) => m.model_name).join(", ")}`
+        );
+        imageGenerationTools.push(createImageGenerationWidgetTool(imageModels));
+      }
+    }
     this._tools = [
       ...tools ?? [],
       ...todoTools,
       ...questionTools,
       ...perplexityTools,
-      emailTool
+      emailTool,
+      ...transcriptionTools,
+      ...imageGenerationTools
       // Because agents are stored in the database, we add those as tools
       // at request time, not during ExuluApp initialization. We add them
       // in the grahql tools resolver.
@@ -11411,6 +12800,23 @@ var ExuluApp = class {
           );
         }
       }
+      if (process.env.TRANSCRIPTION_SERVER) {
+        try {
+          const health = await transcriptionClient.health();
+          console.log(
+            `[EXULU] Transcription: enabled (server=${process.env.TRANSCRIPTION_SERVER}, device=${health.device}, GPU=${health.gpu.available ? "enabled" : "disabled"}, diarization=${health.diarization ? "enabled" : "disabled"})`
+          );
+          startTranscriptionPollingLoop();
+        } catch (err) {
+          console.warn(
+            `[EXULU] TRANSCRIPTION_SERVER set but unreachable: ${err.message}. Transcriptions will fail until the server is up.`
+          );
+        }
+      } else {
+        console.log(
+          "[EXULU] Transcription: disabled (TRANSCRIPTION_SERVER not set). Start a whisper server with `npx @exulu/backend exulu-start-whisper`."
+        );
+      }
       return this._expressApp;
     }
   };
@@ -13194,7 +14600,9 @@ var {
   promptLibrarySchema: promptLibrarySchema2,
   contextPresetsSchema: contextPresetsSchema2,
   embedderSettingsSchema: embedderSettingsSchema2,
-  promptFavoritesSchema: promptFavoritesSchema2
+  promptFavoritesSchema: promptFavoritesSchema2,
+  transcriptionJobsSchema: transcriptionJobsSchema2,
+  imageGenerationsSchema
 } = coreSchemas.get();
 var addMissingFields = async (knex, tableName, fields, skipFields = []) => {
   for (const field of fields) {
@@ -13234,6 +14642,8 @@ var up = async function(knex) {
     contextPresetsSchema2(),
     embedderSettingsSchema2(),
     promptFavoritesSchema2(),
+    transcriptionJobsSchema2(),
+    imageGenerationsSchema(),
     rbacSchema2(),
     agentsSchema2(),
     feedbackSchema2(),
@@ -13508,7 +14918,7 @@ ${WARNING_BANNER}`);
   console.warn(`${WARNING_BANNER}
 `);
 };
-var log = (line) => console.log(`[EXULU-LITELLM] ${line}`);
+var log2 = (line) => console.log(`[EXULU-LITELLM] ${line}`);
 var initLiteLLMDatabase = async (packageRoot) => {
   const configPath = process.env.LITELLM_CONFIG_PATH ?? resolve2(packageRoot, "./config.litellm.yaml");
   const safety = checkLiteLLMDatabaseSafety(configPath);
@@ -13542,7 +14952,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     return;
   }
   const target = "litellmTarget" in safety ? safety.litellmTarget : void 0;
-  log(
+  log2(
     `LiteLLM database mode detected (${target?.host}:${target?.port}/${target?.database}).`
   );
   const ensureDatabaseExists = async () => {
@@ -13570,7 +14980,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
         return false;
       }
       url.pathname = "/postgres";
-      log(`Target database "${targetDbName}" does not exist; creating it\u2026`);
+      log2(`Target database "${targetDbName}" does not exist; creating it\u2026`);
       if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(targetDbName)) {
         warn([
           `Refusing to auto-create database "${targetDbName}" \u2014 name`,
@@ -13583,7 +14993,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
       try {
         await admin.connect();
         await admin.query(`CREATE DATABASE "${targetDbName}"`);
-        log(`\u2713 Created database "${targetDbName}".`);
+        log2(`\u2713 Created database "${targetDbName}".`);
         return true;
       } catch (createErr) {
         warn([
@@ -13605,7 +15015,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     }
   };
   if (!await ensureDatabaseExists()) return;
-  log("Checking that the target database is safe to push into\u2026");
+  log2("Checking that the target database is safe to push into\u2026");
   const client2 = new Client({ connectionString: litellmUrl });
   let foreignTables = [];
   try {
@@ -13670,7 +15080,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  log("Running `prisma db push` against LiteLLM's schema\u2026");
+  log2("Running `prisma db push` against LiteLLM's schema\u2026");
   const result = spawnSync(prismaCli, ["db", "push", "--skip-generate"], {
     cwd: litellmProxyDir,
     env: {
@@ -13700,7 +15110,7 @@ var initLiteLLMDatabase = async (packageRoot) => {
     ]);
     return;
   }
-  log("\u2713 LiteLLM database ready.");
+  log2("\u2713 LiteLLM database ready.");
 };
 
 // src/postgres/init-litellm-db.ts
@@ -14237,23 +15647,23 @@ var MarkdownChunker = class {
 import * as fs4 from "fs";
 import * as path from "path";
 import { generateText as generateText5, Output as Output2 } from "ai";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 import pLimit from "p-limit";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import * as mammoth from "mammoth";
 import TurndownService from "turndown";
 import WordExtractor from "word-extractor";
 import { parseOfficeAsync as parseOfficeAsync2 } from "officeparser";
 
 // src/utils/python-executor.ts
-import { exec as exec3 } from "child_process";
-import { promisify as promisify3 } from "util";
+import { exec as exec2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import { resolve as resolve3, join as join3, dirname as dirname2 } from "path";
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var execAsync3 = promisify3(exec3);
+import { fileURLToPath } from "url";
+var execAsync2 = promisify2(exec2);
 function getPackageRoot2() {
-  const currentFile = fileURLToPath2(import.meta.url);
+  const currentFile = fileURLToPath(import.meta.url);
   let currentDir = dirname2(currentFile);
   let attempts = 0;
   const maxAttempts = 10;
@@ -14275,7 +15685,7 @@ function getPackageRoot2() {
     currentDir = parentDir;
     attempts++;
   }
-  return resolve3(dirname2(fileURLToPath2(import.meta.url)), "../..");
+  return resolve3(dirname2(fileURLToPath(import.meta.url)), "../..");
 }
 var PythonEnvironmentError = class extends Error {
   constructor(message) {
@@ -14295,11 +15705,11 @@ var PythonExecutionError = class extends Error {
     this.exitCode = exitCode;
   }
 };
-function getVenvPath2(packageRoot) {
+function getVenvPath(packageRoot) {
   return resolve3(packageRoot, "ee/python/.venv");
 }
 function getPythonExecutable(packageRoot) {
-  const venvPath = getVenvPath2(packageRoot);
+  const venvPath = getVenvPath(packageRoot);
   return join3(venvPath, "bin", "python");
 }
 async function validatePythonEnvironmentForExecution(packageRoot) {
@@ -14337,7 +15747,7 @@ async function executePythonScript(config) {
   });
   const command = `${pythonExecutable} "${resolvedScriptPath}" ${quotedArgs.join(" ")}`;
   try {
-    const { stdout, stderr } = await execAsync3(command, {
+    const { stdout, stderr } = await execAsync2(command, {
       cwd,
       timeout,
       env: {
@@ -14589,15 +15999,15 @@ If the page contains a flow-chart, schematic, technical drawing or control board
   const result = await generateText5({
     model,
     output: Output2.object({
-      schema: z10.object({
-        needs_correction: z10.boolean(),
-        corrected_text: z10.string().nullable(),
-        current_page_table: z10.object({
-          headers: z10.array(z10.string()),
-          is_continuation: z10.boolean()
+      schema: z12.object({
+        needs_correction: z12.boolean(),
+        corrected_text: z12.string().nullable(),
+        current_page_table: z12.object({
+          headers: z12.array(z12.string()),
+          is_continuation: z12.boolean()
         }).nullable(),
-        confidence: z10.enum(["high", "medium", "low"]),
-        reasoning: z10.string()
+        confidence: z12.enum(["high", "medium", "low"]),
+        reasoning: z12.string()
       })
     }),
     messages: [
@@ -14997,7 +16407,7 @@ var loadFile = async (file, name, tempDir) => {
   if (!fileType) {
     throw new Error("[EXULU] File name does not include extension, extension is required for document processing.");
   }
-  const UUID = randomUUID5();
+  const UUID = randomUUID6();
   let buffer;
   if (Buffer.isBuffer(file)) {
     filePath = path.join(tempDir, `${UUID}.${fileType}`);
@@ -15027,7 +16437,7 @@ async function documentProcessor({
   if (!license["advanced-document-processing"]) {
     throw new Error("Advanced document processing is an enterprise feature, please add a valid Exulu enterprise license key to use it.");
   }
-  const uuid = randomUUID5();
+  const uuid = randomUUID6();
   const tempDir = path.join(process.cwd(), "temp", uuid);
   const localFilesAndFoldersToDelete = [tempDir];
   console.log(`[EXULU] Temporary directory for processing document ${name}: ${tempDir}`);