@exulu/backend 3.3.1 → 3.5.0

package/dist/index.cjs

@@ -1233,8 +1233,60 @@ var init_table_names = __esm({
   }
 });
 
+// src/exulu/litellm/env.ts
+function litellmBase() {
+  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+  const port = process.env.LITELLM_PORT ?? "4000";
+  const masterKey = process.env.LITELLM_MASTER_KEY;
+  if (!masterKey) {
+    throw new LiteLLMAdminError("LITELLM_MASTER_KEY is not configured.");
+  }
+  return { url: `http://${host}:${port}`, masterKey };
+}
+function resolveLiteLLMTarget() {
+  const rawBase = process.env.LITELLM_BASE_URL;
+  if (isLiteLLMClientMode() && rawBase && rawBase.trim().length > 0) {
+    const apiKey = process.env.EXULU_API_KEY;
+    if (!apiKey) {
+      throw new Error("EXULU_API_KEY is required when LITELLM_BASE_URL is set (remote LiteLLM client mode).");
+    }
+    return {
+      baseUrl: rawBase.trim().replace(/\/+$/, ""),
+      authHeaders: { "exulu-api-key": apiKey },
+      remote: true
+    };
+  }
+  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
+  const port = process.env.LITELLM_PORT ?? "4000";
+  const masterKey = process.env.LITELLM_MASTER_KEY;
+  return {
+    baseUrl: `http://${host}:${port}`,
+    authHeaders: masterKey ? { Authorization: `Bearer ${masterKey}` } : {},
+    remote: false
+  };
+}
+var LiteLLMAdminError, _clientMode, isLiteLLMClientMode, setLiteLLMClientMode;
+var init_env = __esm({
+  "src/exulu/litellm/env.ts"() {
+    "use strict";
+    init_cjs_shims();
+    LiteLLMAdminError = class extends Error {
+      constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "LiteLLMAdminError";
+      }
+    };
+    _clientMode = false;
+    isLiteLLMClientMode = () => _clientMode;
+    setLiteLLMClientMode = (value) => {
+      _clientMode = value;
+    };
+  }
+});
+
 // src/exulu/litellm/supervisor.ts
-var import_node_child_process, import_node_fs3, import_node_path2, LITELLM_UI_PATH, MAX_CRASHES, INITIAL_BACKOFF_MS, MAX_BACKOFF_MS, READY_TIMEOUT_MS, WAIT_TIMEOUT_MS, READY_POLL_INTERVAL_MS, SHUTDOWN_GRACE_MS, internal, isLiteLLMEnabled, resolveConfig, log2, pollHealth, spawnLiteLLM, supervise, _packageRoot, _clientMode, setLiteLLMPackageRoot, enableLiteLLMClientMode, startLiteLLMSupervisor, waitForLiteLLMReady, stopLiteLLM, shutdownHandlersRegistered, registerShutdownHandlers, getSupervisorState;
+var import_node_child_process, import_node_fs3, import_node_path2, LITELLM_UI_PATH, MAX_CRASHES, INITIAL_BACKOFF_MS, MAX_BACKOFF_MS, READY_TIMEOUT_MS, WAIT_TIMEOUT_MS, READY_POLL_INTERVAL_MS, SHUTDOWN_GRACE_MS, internal, isLiteLLMEnabled, resolveConfig, log2, pollHealth, spawnLiteLLM, supervise, _packageRoot, setLiteLLMPackageRoot, enableLiteLLMClientMode, startLiteLLMSupervisor, waitForLiteLLMReady, stopLiteLLM, shutdownHandlersRegistered, registerShutdownHandlers, getSupervisorState;
 var init_supervisor = __esm({
   "src/exulu/litellm/supervisor.ts"() {
     "use strict";
@@ -1242,6 +1294,7 @@ var init_supervisor = __esm({
     import_node_child_process = require("child_process");
     import_node_fs3 = require("fs");
     import_node_path2 = require("path");
+    init_env();
     LITELLM_UI_PATH = "/litellm-admin";
     MAX_CRASHES = 5;
     INITIAL_BACKOFF_MS = 1e3;
@@ -1368,13 +1421,12 @@ var init_supervisor = __esm({
         internal.backoffMs = Math.min(internal.backoffMs * 2, MAX_BACKOFF_MS);
       }
     };
-    _clientMode = false;
     setLiteLLMPackageRoot = (root) => {
       _packageRoot = root;
     };
     enableLiteLLMClientMode = () => {
       if (internal.readyPromise) return;
-      _clientMode = true;
+      setLiteLLMClientMode(true);
     };
     startLiteLLMSupervisor = async (options = {}) => {
       if (!isLiteLLMEnabled()) return;
@@ -1424,14 +1476,13 @@ var init_supervisor = __esm({
     };
     waitForLiteLLMReady = async () => {
       if (!isLiteLLMEnabled()) return;
-      if (_clientMode) {
+      if (isLiteLLMClientMode()) {
         if (internal.state === "ready") return;
-        const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-        const port = process.env.LITELLM_PORT ?? "4000";
-        const url = `http://${host}:${port}/health/liveliness`;
+        const { baseUrl, authHeaders, remote } = resolveLiteLLMTarget();
+        const url = remote ? `${baseUrl}/v1/models` : `${baseUrl}/health/liveliness`;
         let res;
         try {
-          res = await fetch(url, { method: "GET" });
+          res = await fetch(url, { method: "GET", headers: remote ? authHeaders : {} });
         } catch (err) {
           throw new Error(
             `LiteLLM proxy not reachable at ${url} (is the Exulu server process running?): ${err.message}`
@@ -1625,31 +1676,6 @@ var init_tags = __esm({
   }
 });
 
-// src/exulu/litellm/env.ts
-function litellmBase() {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new LiteLLMAdminError("LITELLM_MASTER_KEY is not configured.");
-  }
-  return { url: `http://${host}:${port}`, masterKey };
-}
-var LiteLLMAdminError;
-var init_env = __esm({
-  "src/exulu/litellm/env.ts"() {
-    "use strict";
-    init_cjs_shims();
-    LiteLLMAdminError = class extends Error {
-      constructor(message, status) {
-        super(message);
-        this.status = status;
-        this.name = "LiteLLMAdminError";
-      }
-    };
-  }
-});
-
 // src/exulu/litellm/admin-client.ts
 async function call(path4, body) {
   const { url, masterKey } = litellmBase();
@@ -2285,6 +2311,7 @@ var init_resolve_model = __esm({
     init_supervisor();
     init_tags();
     init_budget_service();
+    init_env();
     ResolveModelError = class extends Error {
       constructor(code, message) {
         super(message);
@@ -2300,9 +2327,7 @@ var init_resolve_model = __esm({
       team,
       routine
     }) => {
-      const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-      const port = process.env.LITELLM_PORT ?? "4000";
-      const masterKey = process.env.LITELLM_MASTER_KEY;
+      const { baseUrl, authHeaders } = resolveLiteLLMTarget();
       const tags = buildTags({
         user_id: user?.id,
         role_id: role?.id,
@@ -2317,16 +2342,13 @@ var init_resolve_model = __esm({
         routine_id: routine?.id,
         routine_name: routine?.name
       });
-      if (!masterKey) {
-        throw new ResolveModelError(
-          "LITELLM_NOT_CONFIGURED",
-          "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-        );
-      }
       return (0, import_openai_compatible.createOpenAICompatible)({
         name: "litellm",
-        baseURL: `http://${host}:${port}/v1`,
-        apiKey: masterKey,
+        baseURL: `${baseUrl}/v1`,
+        // createOpenAICompatible requires a non-empty apiKey; real auth for remote mode is the
+        // exulu-api-key header (added via `headers`). The passthrough strips/ignores Authorization.
+        apiKey: process.env.LITELLM_MASTER_KEY ?? process.env.EXULU_API_KEY ?? "x",
+        headers: authHeaders,
         fetch: createTaggedFetch(tags),
         // Without this flag the openai-compatible provider strips any
         // responseFormat.schema before sending and warns
@@ -3320,6 +3342,9 @@ var init_check_item_write_access = __esm({
       if (record.rights_mode === "private") {
         return record.created_by != null && String(record.created_by) === String(user.id);
       }
+      if (record.created_by != null && String(record.created_by) === String(user.id)) {
+        return true;
+      }
       const validRightsModes = ["users", "roles", "teams"];
       if (!validRightsModes.includes(record.rights_mode)) {
         return false;
@@ -4958,28 +4983,33 @@ __export(catalog_exports, {
   fetchLiteLLMCatalog: () => fetchLiteLLMCatalog,
   findLiteLLMModel: () => findLiteLLMModel
 });
-var CACHE_TTL_MS, _cache, __resetLiteLLMCatalogCacheForTesting, fetchLiteLLMCatalog, findLiteLLMModel;
+var CACHE_TTL_MS, _cache, __resetLiteLLMCatalogCacheForTesting, fetchFullCatalog, fetchLiteLLMCatalog, findLiteLLMModel;
 var init_catalog = __esm({
   "src/exulu/litellm/catalog.ts"() {
     "use strict";
     init_cjs_shims();
+    init_env();
     CACHE_TTL_MS = 3e4;
     __resetLiteLLMCatalogCacheForTesting = () => {
       _cache = void 0;
     };
-    fetchLiteLLMCatalog = async () => {
+    fetchFullCatalog = async () => {
       if (process.env.EXULU_USE_LITELLM !== "true") return [];
       if (_cache && _cache.expiresAt > Date.now()) {
         return _cache.items;
       }
-      const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-      const port = process.env.LITELLM_PORT ?? "4000";
-      const masterKey = process.env.LITELLM_MASTER_KEY;
-      if (!masterKey) return [];
+      let baseUrl;
+      let authHeaders;
+      try {
+        ({ baseUrl, authHeaders } = resolveLiteLLMTarget());
+      } catch {
+        return [];
+      }
+      if (Object.keys(authHeaders).length === 0) return [];
       try {
-        const res = await fetch(`http://${host}:${port}/model/info`, {
+        const res = await fetch(`${baseUrl}/model/info`, {
           method: "GET",
-          headers: { Authorization: `Bearer ${masterKey}` }
+          headers: authHeaders
         });
         if (!res.ok) {
           console.error(
@@ -5022,15 +5052,19 @@ var init_catalog = __esm({
         }
         const uniqueItems = Array.from(map.values());
         _cache = { expiresAt: Date.now() + CACHE_TTL_MS, items: uniqueItems };
-        return uniqueItems.filter((m) => m.type !== "speech_to_text" && m.type !== "text_to_speech");
+        return uniqueItems;
       } catch (err) {
         console.error("[EXULU] litellmCatalog: failed to fetch /model/info:", err);
         return [];
       }
     };
+    fetchLiteLLMCatalog = async () => {
+      const items = await fetchFullCatalog();
+      return items.filter((m) => m.type !== "speech_to_text" && m.type !== "text_to_speech");
+    };
     findLiteLLMModel = async (modelName) => {
       if (!modelName) return void 0;
-      const items = await fetchLiteLLMCatalog();
+      const items = await fetchFullCatalog();
       return items.find((m) => m.model_name === modelName);
     };
   }
@@ -6564,15 +6598,7 @@ async function resolveReranker(input) {
       `LiteLLM is not ready: ${err.message}`
     );
   }
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new ResolveRerankerError(
-      "LITELLM_NOT_CONFIGURED",
-      "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-    );
-  }
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const resolvedUserId = user?.id ?? userId;
   if (resolvedUserId) await provisionDefaultUserBudget(resolvedUserId);
   const role = user?.role;
@@ -6592,7 +6618,7 @@ async function resolveReranker(input) {
     routine_name: routine?.name,
     context_name: contextName
   });
-  const endpoint = `http://${host}:${port}/v1/rerank`;
+  const endpoint = `${baseUrl}/v1/rerank`;
   const rerank2 = async (query, chunks, opts) => {
     try {
       if (chunks.length === 0) return [];
@@ -6602,7 +6628,7 @@ async function resolveReranker(input) {
       const res = await fetch(endpoint, {
         method: "POST",
         headers: {
-          Authorization: `Bearer ${masterKey}`,
+          ...authHeaders,
           "Content-Type": "application/json"
         },
         body: JSON.stringify({
@@ -6643,7 +6669,7 @@ async function resolveReranker(input) {
   };
   return { model, rerank: rerank2 };
 }
-var import_fs2, ResolveRerankerError;
+var ResolveRerankerError;
 var init_resolve_reranker = __esm({
   "src/exulu/resolve-reranker.ts"() {
     "use strict";
@@ -6651,7 +6677,7 @@ var init_resolve_reranker = __esm({
     init_supervisor();
     init_budget_service();
     init_tags();
-    import_fs2 = require("fs");
+    init_env();
     ResolveRerankerError = class extends Error {
       constructor(code, message) {
         super(message);
@@ -10019,6 +10045,7 @@ init_cjs_shims();
 init_supervisor();
 init_budget_service();
 init_tags();
+init_env();
 var ResolveEmbedderError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -10042,15 +10069,7 @@ async function resolveEmbedder(input) {
       `LiteLLM is not ready: ${err.message}`
     );
   }
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new ResolveEmbedderError(
-      "LITELLM_NOT_CONFIGURED",
-      "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-    );
-  }
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const resolvedUserId = user?.id ?? userId;
   if (resolvedUserId) await provisionDefaultUserBudget(resolvedUserId);
   const { dimensionality, maxChunkSize, maxBatchSize } = getEmbeddingModelInfo(model);
@@ -10071,12 +10090,12 @@ async function resolveEmbedder(input) {
     routine_name: routine?.name,
     context_name: contextName
   });
-  const endpoint = `http://${host}:${port}/v1/embeddings`;
+  const endpoint = `${baseUrl}/v1/embeddings`;
   const embedBatch = async (batch) => {
     const res = await fetch(endpoint, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${masterKey}`,
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
@@ -15120,20 +15139,25 @@ async function encryptString(string) {
   const hash = await import_bcryptjs2.default.hash(string, SALT_ROUNDS);
   return hash;
 }
-var generateApiKey = async (name, email) => {
+var generateApiKey = async (name, email, options) => {
   const { db: db2 } = await postgresClient();
   email = String(email).trim().toLowerCase();
+  const superAdmin = options?.superAdmin ?? true;
+  const roleName = options?.roleName ?? "admin";
+  const rolePermissions = options?.rolePermissions ?? {
+    agents: "write",
+    workflows: "write",
+    variables: "write",
+    users: "write"
+  };
   console.log("[EXULU] Inserting default user and admin role.");
-  const existingRole = await db2.from("roles").where({ name: "admin" }).first();
+  const existingRole = await db2.from("roles").where({ name: roleName }).first();
   let roleId;
   if (!existingRole) {
-    console.log("[EXULU] Creating default admin role.");
+    console.log(`[EXULU] Creating default ${roleName} role.`);
     const role = await db2.from("roles").insert({
-      name: "admin",
-      agents: "write",
-      workflows: "write",
-      variables: "write",
-      users: "write"
+      name: roleName,
+      ...rolePermissions
     }).returning("id");
     roleId = role[0].id;
   } else {
@@ -15149,7 +15173,7 @@ var generateApiKey = async (name, email) => {
     await db2.from("users").insert({
       name,
       email,
-      super_admin: true,
+      super_admin: superAdmin,
       createdAt: /* @__PURE__ */ new Date(),
       updatedAt: /* @__PURE__ */ new Date(),
       type: "api",
@@ -15735,6 +15759,9 @@ function createMutations(table, contexts, tools, config) {
         }
         throw new Error("Only the creator can edit this private record");
       }
+      if (record.created_by != null && String(record.created_by) === String(user.id)) {
+        return true;
+      }
       if (record.rights_mode === "users") {
         const rbacRecord = await db2.from("rbac").where({
           entity: table.name.singular,
@@ -19681,7 +19708,7 @@ var mapRoutineRunRow = (row, routineById) => {
 
 // src/graphql/schemas/index.ts
 init_entitlements();
-var import_fs3 = require("fs");
+var import_fs2 = require("fs");
 
 // src/exulu/transcription/service.ts
 init_cjs_shims();
@@ -23636,7 +23663,7 @@ var import_utils5 = require("@apollo/utils.keyvaluecache");
 var import_body_parser = __toESM(require("body-parser"), 1);
 var import_crypto_js7 = require("crypto-js");
 var import_openai = require("openai");
-var import_fs4 = __toESM(require("fs"), 1);
+var import_fs3 = __toESM(require("fs"), 1);
 var import_node_crypto15 = require("crypto");
 var import_api2 = require("@opentelemetry/api");
 var import_jszip3 = __toESM(require("jszip"), 1);
@@ -23855,6 +23882,19 @@ ${summary}` }],
 
 // src/exulu/transcribe.ts
 init_cjs_shims();
+init_env();
+init_catalog();
+var TRANSCRIBE_SYSTEM_PROMPT = "You are a speech-to-text transcription engine. Detect the language actually spoken and transcribe it word-for-word in that same language. Never translate. Output only the transcript text \u2014 no quotes, labels, or commentary. If there is no intelligible speech, output nothing.";
+function isGeminiChatTranscriptionModel(entry) {
+  const upstream = entry?.upstream_model ?? "";
+  return /^vertex_ai\//i.test(upstream) && /gemini/i.test(upstream);
+}
+function cleanTranscript(raw) {
+  let text = (raw ?? "").trim();
+  const wrapped = text.match(/^(["'`])([\s\S]*)\1$/);
+  if (wrapped) text = (wrapped[2] ?? "").trim();
+  return text;
+}
 var TranscriptionError = class extends Error {
   constructor(upstreamStatus, message) {
     super(message);
@@ -23863,12 +23903,16 @@ var TranscriptionError = class extends Error {
   }
 };
 async function transcribeAudio(args) {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
+  const target = resolveLiteLLMTarget();
   const model = process.env.TRANSCRIPTION_MODEL;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
   if (!model) throw new Error("TRANSCRIPTION_MODEL is not set");
+  const entry = await findLiteLLMModel(model).catch(() => void 0);
+  if (isGeminiChatTranscriptionModel(entry)) {
+    return transcribeViaChat(args, target, model);
+  }
+  return transcribeViaAudioEndpoint(args, target, model);
+}
+async function transcribeViaAudioEndpoint(args, target, model) {
   const form = new FormData();
   form.append(
     "file",
@@ -23877,9 +23921,9 @@ async function transcribeAudio(args) {
   );
   form.append("model", model);
   if (args.language) form.append("language", args.language);
-  const res = await fetch(`http://${host}:${port}/v1/audio/transcriptions`, {
+  const res = await fetch(`${target.baseUrl}/v1/audio/transcriptions`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${masterKey}` },
+    headers: { ...target.authHeaders },
     body: form
   });
   if (!res.ok) {
@@ -23892,9 +23936,46 @@ async function transcribeAudio(args) {
   const json = await res.json();
   return { text: typeof json.text === "string" ? json.text : "" };
 }
+async function transcribeViaChat(args, target, model) {
+  const subtype = args.file.mimetype.replace(/^audio\//, "").split(";")[0];
+  const format = (subtype && subtype.length > 0 ? subtype : "wav").toLowerCase();
+  const body = {
+    model,
+    temperature: 0,
+    reasoning_effort: "disable",
+    messages: [
+      { role: "system", content: TRANSCRIBE_SYSTEM_PROMPT },
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "Transcribe this audio." },
+          {
+            type: "input_audio",
+            input_audio: { data: args.file.buffer.toString("base64"), format }
+          }
+        ]
+      }
+    ]
+  };
+  const res = await fetch(`${target.baseUrl}/v1/chat/completions`, {
+    method: "POST",
+    headers: { ...target.authHeaders, "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const errBody = await res.text().catch(() => "");
+    throw new TranscriptionError(
+      res.status,
+      `LiteLLM transcription failed (status ${res.status}): ${errBody}`.trim()
+    );
+  }
+  const json = await res.json();
+  return { text: cleanTranscript(json.choices?.[0]?.message?.content) };
+}
 
 // src/exulu/speech.ts
 init_cjs_shims();
+init_env();
 var SpeechError = class extends Error {
   constructor(upstreamStatus, message) {
     super(message);
@@ -23903,12 +23984,9 @@ var SpeechError = class extends Error {
   }
 };
 async function synthesizeSpeech(args) {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const model = process.env.TTS_MODEL;
   const voice = process.env.TTS_VOICE;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
   if (!model) throw new Error("TTS_MODEL is not set");
   if (!voice) throw new Error("TTS_VOICE is not set");
   const body = {
@@ -23917,10 +23995,10 @@ async function synthesizeSpeech(args) {
     voice,
     response_format: "mp3"
   };
-  const res = await fetch(`http://${host}:${port}/v1/audio/speech`, {
+  const res = await fetch(`${baseUrl}/v1/audio/speech`, {
     method: "POST",
     headers: {
-      Authorization: `Bearer ${masterKey}`,
+      ...authHeaders,
       "Content-Type": "application/json"
     },
     body: JSON.stringify(body)
@@ -23938,6 +24016,7 @@ async function synthesizeSpeech(args) {
 
 // src/exulu/image-generation.ts
 init_cjs_shims();
+init_env();
 var ImageGenerationError = class extends Error {
   constructor(upstreamStatus, message) {
     super(message);
@@ -23945,13 +24024,6 @@ var ImageGenerationError = class extends Error {
     this.name = "ImageGenerationError";
   }
 };
-var resolveProxyConfig = () => {
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) throw new Error("LITELLM_MASTER_KEY is not set");
-  return { host, port, masterKey };
-};
 var normalizeDataEntries = async (data) => {
   const out = [];
   for (const entry of data) {
@@ -23988,7 +24060,7 @@ var normalizeDataEntries = async (data) => {
 async function generateImage(args) {
   if (!args.model) throw new Error("model is required");
   if (!args.prompt) throw new Error("prompt is required");
-  const cfg = resolveProxyConfig();
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const body = {
     model: args.model,
     prompt: args.prompt
@@ -23996,10 +24068,10 @@ async function generateImage(args) {
   if (args.size) body.size = args.size;
   if (args.quality) body.quality = args.quality;
   if (args.n) body.n = args.n;
-  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/generations`, {
+  const res = await fetch(`${baseUrl}/v1/images/generations`, {
     method: "POST",
     headers: {
-      Authorization: `Bearer ${cfg.masterKey}`,
+      ...authHeaders,
       "Content-Type": "application/json"
     },
     body: JSON.stringify(body),
@@ -24027,7 +24099,7 @@ async function editImage(args) {
   if (!args.references || args.references.length === 0) {
     throw new Error("at least one reference image is required");
   }
-  const cfg = resolveProxyConfig();
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const form = new FormData();
   form.append("model", args.model);
   form.append("prompt", args.prompt);
@@ -24049,9 +24121,9 @@ async function editImage(args) {
       args.mask.filename
     );
   }
-  const res = await fetch(`http://${cfg.host}:${cfg.port}/v1/images/edits`, {
+  const res = await fetch(`${baseUrl}/v1/images/edits`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${cfg.masterKey}` },
+    headers: { ...authHeaders },
     body: form,
     signal: args.signal
   });
@@ -24201,6 +24273,12 @@ var import_node_path9 = require("path");
 init_tags();
 init_admin_client();
 init_env();
+
+// src/exulu/litellm/passthrough-allowlist.ts
+init_cjs_shims();
+var isLiteLLMPassthroughPathAllowed = (path4) => path4.startsWith("/v1/") || path4 === "/model/info";
+
+// src/exulu/routes.ts
 init_activity_client();
 init_budget_service();
 
@@ -24901,7 +24979,7 @@ var REQUEST_SIZE_LIMIT = "50mb";
 var getExuluVersionNumber = async () => {
   try {
     const path4 = process.cwd();
-    const packageJson = import_fs4.default.readFileSync(path4 + "/package.json", "utf8");
+    const packageJson = import_fs3.default.readFileSync(path4 + "/package.json", "utf8");
     const packageData = JSON.parse(packageJson);
     const exuluVersion = packageData.dependencies["@exulu/backend"];
     console.log(`[EXULU] Installed exulu-backend version: ${exuluVersion}`);
@@ -26453,7 +26531,7 @@ ${style.markdown}` : params.prompt;
       return;
     }
     const user = authenticationResult.user;
-    if (!req.path.startsWith("/v1/")) {
+    if (!isLiteLLMPassthroughPathAllowed(req.path)) {
       res.status(403).json({
         detail: `Path ${req.path} is not exposed through the Exulu LiteLLM proxy.`
       });
@@ -29883,7 +29961,7 @@ init_cjs_shims();
 var import_child_process = require("child_process");
 var import_util = require("util");
 var import_path3 = require("path");
-var import_fs5 = require("fs");
+var import_fs4 = require("fs");
 var import_url = require("url");
 var execAsync4 = (0, import_util.promisify)(import_child_process.exec);
 function getPackageRoot() {
@@ -29893,9 +29971,9 @@ function getPackageRoot() {
   const maxAttempts = 10;
   while (attempts < maxAttempts) {
     const packageJsonPath = (0, import_path3.join)(currentDir, "package.json");
-    if ((0, import_fs5.existsSync)(packageJsonPath)) {
+    if ((0, import_fs4.existsSync)(packageJsonPath)) {
       try {
-        const packageJson = JSON.parse((0, import_fs5.readFileSync)(packageJsonPath, "utf-8"));
+        const packageJson = JSON.parse((0, import_fs4.readFileSync)(packageJsonPath, "utf-8"));
         if (packageJson.name === "@exulu/backend") {
           return currentDir;
         }
@@ -29922,7 +30000,7 @@ function isPythonEnvironmentSetup(packageRoot) {
   const root = packageRoot ?? getPackageRoot();
   const venvPath = getVenvPath(root);
   const pythonPath = (0, import_path3.join)(venvPath, "bin", "python");
-  return (0, import_fs5.existsSync)(venvPath) && (0, import_fs5.existsSync)(pythonPath);
+  return (0, import_fs4.existsSync)(venvPath) && (0, import_fs4.existsSync)(pythonPath);
 }
 async function setupPythonEnvironment(options = {}) {
   const {
@@ -29943,7 +30021,7 @@ async function setupPythonEnvironment(options = {}) {
     };
   }
   const setupScriptPath = getSetupScriptPath(packageRoot);
-  if (!(0, import_fs5.existsSync)(setupScriptPath)) {
+  if (!(0, import_fs4.existsSync)(setupScriptPath)) {
     return {
       success: false,
       message: `Setup script not found at: ${setupScriptPath}`,
@@ -30025,13 +30103,13 @@ async function validatePythonEnvironment(packageRoot, checkPackages = true) {
   const root = packageRoot ?? getPackageRoot();
   const venvPath = getVenvPath(root);
   const pythonPath = (0, import_path3.join)(venvPath, "bin", "python");
-  if (!(0, import_fs5.existsSync)(venvPath)) {
+  if (!(0, import_fs4.existsSync)(venvPath)) {
     return {
       valid: false,
       message: getPythonSetupInstructions()
     };
   }
-  if (!(0, import_fs5.existsSync)(pythonPath)) {
+  if (!(0, import_fs4.existsSync)(pythonPath)) {
     return {
       valid: false,
       message: "Python virtual environment is corrupted. Please run:\n  await setupPythonEnvironment({ force: true })"
@@ -32581,7 +32659,7 @@ var MarkdownChunker = class {
 
 // ee/python/documents/processing/doc_processor.ts
 init_cjs_shims();
-var fs5 = __toESM(require("fs"), 1);
+var fs4 = __toESM(require("fs"), 1);
 var path3 = __toESM(require("path"), 1);
 var import_ai14 = require("ai");
 var import_zod27 = require("zod");
@@ -32599,7 +32677,7 @@ init_cjs_shims();
 var import_child_process2 = require("child_process");
 var import_util3 = require("util");
 var import_path4 = require("path");
-var import_fs6 = require("fs");
+var import_fs5 = require("fs");
 var import_url2 = require("url");
 var execAsync5 = (0, import_util3.promisify)(import_child_process2.exec);
 function getPackageRoot2() {
@@ -32609,9 +32687,9 @@ function getPackageRoot2() {
   const maxAttempts = 10;
   while (attempts < maxAttempts) {
     const packageJsonPath = (0, import_path4.join)(currentDir, "package.json");
-    if ((0, import_fs6.existsSync)(packageJsonPath)) {
+    if ((0, import_fs5.existsSync)(packageJsonPath)) {
       try {
-        const packageJson = JSON.parse((0, import_fs6.readFileSync)(packageJsonPath, "utf-8"));
+        const packageJson = JSON.parse((0, import_fs5.readFileSync)(packageJsonPath, "utf-8"));
         if (packageJson.name === "@exulu/backend") {
           return currentDir;
         }
@@ -32673,7 +32751,7 @@ async function executePythonScript(config) {
     await validatePythonEnvironmentForExecution(packageRoot);
   }
   const resolvedScriptPath = (0, import_path4.resolve)(packageRoot, scriptPath);
-  if (!(0, import_fs6.existsSync)(resolvedScriptPath)) {
+  if (!(0, import_fs5.existsSync)(resolvedScriptPath)) {
     throw new PythonExecutionError(
       `Python script not found: ${resolvedScriptPath}`,
       "",
@@ -32743,6 +32821,7 @@ init_cjs_shims();
 init_supervisor();
 init_budget_service();
 init_tags();
+init_env();
 var ResolveOcrError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -32766,15 +32845,7 @@ async function resolveOcr(input) {
       `LiteLLM is not ready: ${err.message}`
     );
   }
-  const host = process.env.LITELLM_HOST ?? "127.0.0.1";
-  const port = process.env.LITELLM_PORT ?? "4000";
-  const masterKey = process.env.LITELLM_MASTER_KEY;
-  if (!masterKey) {
-    throw new ResolveOcrError(
-      "LITELLM_NOT_CONFIGURED",
-      "LITELLM_MASTER_KEY is required when EXULU_USE_LITELLM=true"
-    );
-  }
+  const { baseUrl, authHeaders } = resolveLiteLLMTarget();
   const resolvedUserId = user?.id ?? userId;
   if (resolvedUserId) await provisionDefaultUserBudget(resolvedUserId);
   const role = user?.role;
@@ -32794,12 +32865,12 @@ async function resolveOcr(input) {
     routine_name: routine?.name,
     context_name: contextName
   });
-  const endpoint = `http://${host}:${port}/v1/ocr`;
+  const endpoint = `${baseUrl}/v1/ocr`;
   const ocr = async (document2, opts) => {
     const res = await fetch(endpoint, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${masterKey}`,
+        ...authHeaders,
         "Content-Type": "application/json"
       },
       body: JSON.stringify({
@@ -32877,9 +32948,9 @@ async function resolveVlmModel(config) {
 }
 async function processImage(buffer, paths, config, verbose = false) {
   try {
-    await fs5.promises.mkdir(paths.images, { recursive: true });
+    await fs4.promises.mkdir(paths.images, { recursive: true });
     const imagePath = path3.join(paths.images, "1.png");
-    await fs5.promises.writeFile(imagePath, buffer);
+    await fs4.promises.writeFile(imagePath, buffer);
     console.log(`[EXULU] Image saved to: ${imagePath}`);
     let json = [{
       page: 1,
@@ -32897,7 +32968,7 @@ async function processImage(buffer, paths, config, verbose = false) {
         verbose,
         config.vlm.concurrency
       );
-      await fs5.promises.writeFile(
+      await fs4.promises.writeFile(
         paths.json,
         JSON.stringify(json, null, 2),
         "utf-8"
@@ -32908,14 +32979,14 @@ async function processImage(buffer, paths, config, verbose = false) {
     } else {
       console.log("[EXULU] No VLM configured, image saved without content extraction");
       console.log("[EXULU] Note: Enable VLM in config to extract text/content from images");
-      await fs5.promises.writeFile(
+      await fs4.promises.writeFile(
         paths.json,
         JSON.stringify(json, null, 2),
         "utf-8"
       );
     }
     const markdown = json.map((p) => p.vlm_corrected_text ?? p.content).join("\n\n\n<!-- END_OF_PAGE -->\n\n\n");
-    await fs5.promises.writeFile(paths.markdown, markdown, "utf-8");
+    await fs4.promises.writeFile(paths.markdown, markdown, "utf-8");
     return {
       markdown,
       json
@@ -32968,7 +33039,7 @@ function reconstructHeadings(correctedText, headingsHierarchy) {
   return result;
 }
 async function validatePageWithVLM(page, imagePath, model) {
-  const imageBuffer = await fs5.promises.readFile(imagePath);
+  const imageBuffer = await fs4.promises.readFile(imagePath);
   const imageBase64 = imageBuffer.toString("base64");
   const mimeType = "image/png";
   const prompt = `You are a document validation assistant. Your task is to analyze a page image and correct the output of an OCR/parsing pipeline. The content may include tables, technical diagrams, schematics, and structured text.
@@ -33303,7 +33374,7 @@ ${setupResult.output || ""}`);
       if (!result.success) {
         throw new Error(`Document processing failed: ${result.stderr}`);
       }
-      const jsonContent = await fs5.promises.readFile(paths.json, "utf-8");
+      const jsonContent = await fs4.promises.readFile(paths.json, "utf-8");
       json = JSON.parse(jsonContent);
     } else if (config?.processor.name === "officeparser") {
       const text = await (0, import_officeparser3.parseOfficeAsync)(buffer, {
@@ -33336,7 +33407,7 @@ ${setupResult.output || ""}`);
             await new Promise((resolve8) => setImmediate(resolve8));
             await new Promise((resolve8) => setTimeout(resolve8, Math.floor(Math.random() * 1e3) + 200));
             console.log(`[EXULU] OCR chunk ${i + 1}/${pdfChunks.length}: pages ${chunk.start_page}\u2013${chunk.end_page - 1}`);
-            const chunkBuffer = await fs5.promises.readFile(chunk.path);
+            const chunkBuffer = await fs4.promises.readFile(chunk.path);
             const chunkBase64 = chunkBuffer.toString("base64");
             const chunkResponse = await withRetry(async () => {
               return await resolved.ocr({
@@ -33353,9 +33424,9 @@ ${setupResult.output || ""}`);
       );
       const parser = new import_liteparse.LiteParse();
       const screenshots = await parser.screenshot(paths.source, void 0);
-      await fs5.promises.mkdir(paths.images, { recursive: true });
+      await fs4.promises.mkdir(paths.images, { recursive: true });
       for (const screenshot of screenshots) {
-        await fs5.promises.writeFile(
+        await fs4.promises.writeFile(
           path3.join(
             paths.images,
             `${screenshot.pageNum}.png`
@@ -33370,15 +33441,15 @@ ${setupResult.output || ""}`);
         image: screenshots.find((s) => s.pageNum === page.index + 1)?.imagePath,
         headings: []
       }));
-      fs5.writeFileSync(paths.json, JSON.stringify(json, null, 2));
+      fs4.writeFileSync(paths.json, JSON.stringify(json, null, 2));
     } else if (config?.processor.name === "liteparse") {
       const parser = new import_liteparse.LiteParse();
       const result = await parser.parse(paths.source);
       const screenshots = await parser.screenshot(paths.source, void 0);
       console.log(`[EXULU] Liteparse screenshots: ${JSON.stringify(screenshots)}`);
-      await fs5.promises.mkdir(paths.images, { recursive: true });
+      await fs4.promises.mkdir(paths.images, { recursive: true });
       for (const screenshot of screenshots) {
-        await fs5.promises.writeFile(path3.join(paths.images, `${screenshot.pageNum}.png`), screenshot.imageBuffer);
+        await fs4.promises.writeFile(path3.join(paths.images, `${screenshot.pageNum}.png`), screenshot.imageBuffer);
         screenshot.imagePath = path3.join(paths.images, `${screenshot.pageNum}.png`);
       }
       json = result.pages.map((page) => ({
@@ -33386,7 +33457,7 @@ ${setupResult.output || ""}`);
         content: page.text,
         image: screenshots.find((s) => s.pageNum === page.pageNum)?.imagePath
       }));
-      fs5.writeFileSync(paths.json, JSON.stringify(json, null, 2));
+      fs4.writeFileSync(paths.json, JSON.stringify(json, null, 2));
     }
     console.log(`[EXULU] 
 \u2713 Document processing completed successfully`);
@@ -33418,13 +33489,13 @@ ${setupResult.output || ""}`);
           console.log(`[EXULU]    Corrected: ${page.vlm_corrected_text.substring(0, 150)}...`);
         });
       }
-      await fs5.promises.writeFile(
+      await fs4.promises.writeFile(
         paths.json,
         JSON.stringify(json, null, 2),
         "utf-8"
       );
     }
-    const markdownStream = fs5.createWriteStream(paths.markdown, { encoding: "utf-8" });
+    const markdownStream = fs4.createWriteStream(paths.markdown, { encoding: "utf-8" });
     for (let i = 0; i < json.length; i++) {
       const p = json[i];
       if (!p) continue;
@@ -33440,7 +33511,7 @@ ${setupResult.output || ""}`);
     });
     console.log(`[EXULU] Validated output saved to: ${paths.json}`);
     console.log(`[EXULU] Validated markdown saved to: ${paths.markdown}`);
-    const markdown = await fs5.promises.readFile(paths.markdown, "utf-8");
+    const markdown = await fs4.promises.readFile(paths.markdown, "utf-8");
     const processedJson = json.map((e) => {
       const finalContent = e.vlm_corrected_text ?? e.content;
       return {
@@ -33471,7 +33542,7 @@ var loadFile = async (file, name, tempDir) => {
   let buffer;
   if (Buffer.isBuffer(file)) {
     filePath = path3.join(tempDir, `${UUID}.${fileType}`);
-    await fs5.promises.writeFile(filePath, file);
+    await fs4.promises.writeFile(filePath, file);
     buffer = file;
   } else {
     filePath = filePath.trim();
@@ -33479,11 +33550,11 @@ var loadFile = async (file, name, tempDir) => {
       const response = await fetch(filePath);
       const array = await response.arrayBuffer();
       const tempFilePath = path3.join(tempDir, `${UUID}.${fileType}`);
-      await fs5.promises.writeFile(tempFilePath, Buffer.from(array));
+      await fs4.promises.writeFile(tempFilePath, Buffer.from(array));
       buffer = Buffer.from(array);
       filePath = tempFilePath;
     } else {
-      buffer = await fs5.promises.readFile(file);
+      buffer = await fs4.promises.readFile(file);
     }
   }
   return { filePath, fileType, buffer };
@@ -33501,9 +33572,9 @@ async function documentProcessor({
   const tempDir = path3.join(process.cwd(), "temp", uuid);
   const localFilesAndFoldersToDelete = [tempDir];
   console.log(`[EXULU] Temporary directory for processing document ${name}: ${tempDir}`);
-  await fs5.promises.mkdir(tempDir, { recursive: true });
+  await fs4.promises.mkdir(tempDir, { recursive: true });
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  await fs5.promises.writeFile(path3.join(tempDir, "created_at.txt"), timestamp);
+  await fs4.promises.writeFile(path3.join(tempDir, "created_at.txt"), timestamp);
   try {
     const {
       filePath,
@@ -33544,7 +33615,7 @@ async function documentProcessor({
     if (config?.debugging?.deleteTempFiles !== false) {
       for (const file2 of localFilesAndFoldersToDelete) {
         try {
-          await fs5.promises.rm(file2, { recursive: true });
+          await fs4.promises.rm(file2, { recursive: true });
           console.log(`[EXULU] Deleted file or folder: ${file2}`);
         } catch (error) {
           console.error(`[EXULU] Error deleting file or folder: ${file2}`, error);