{...}: let
  bild = import ../../Bild.nix {};
  avaPkg = bild.run ../../Ava.hs;

  # Python environment for Ava's python_exec tool
  avaPython = bild.python.pythonWith (p: [
    p.requests # HTTP requests
    p.httpx # Async HTTP
    p.beautifulsoup4 # HTML/XML parsing
    p.lxml # Fast XML/HTML parser
    p.pandas # Data analysis
    p.numpy # Numerical computing
    p.pillow # Image processing
    p.pyyaml # YAML parsing
    p.python-dateutil # Date utilities
  ]);

  # Nixpkgs for CLI tools not in bild.pkgs
  nixpkgs = import ../../Bild/Nixpkgs.nix;
  pkgs = nixpkgs.nixos-24_11;

  # Wrap ava binary with tools in PATH
  avaWithTools = bild.stdenv.mkDerivation {
    name = "ava-wrapped";
    buildInputs = [bild.makeWrapper];
    phases = ["installPhase"];
    installPhase = ''
      mkdir -p $out/bin
      makeWrapper ${avaPkg}/bin/ava $out/bin/ava \
        --prefix PATH : ${bild.lib.makeBinPath [
        avaPython
        bild.pkgs.jq
        bild.pkgs.ripgrep
        bild.pkgs.coreutils
        bild.pkgs.git
        bild.pkgs.sqlite
        bild.pkgs.ffmpeg
        pkgs.curl
        pkgs.pandoc
        pkgs.imagemagick
        pkgs.csvkit
        pkgs.openai-whisper-cpp
        pkgs.direnv
      ]}
    '';
  };
in {
  systemd.services.ava = {
    description = "Ava Telegram assistant";
    after = ["network-online.target" "ollama.service"];
    wants = ["network-online.target" "ollama.service"];
    wantedBy = ["multi-user.target"];

    serviceConfig = {
      Type = "simple";
      User = "ava";
      Group = "users";
      WorkingDirectory = "/home/ava/omni";

      Environment = [
        "AVA_DATA_ROOT=/home/ava"
        "HOME=/home/ava"
        "OLLAMA_URL=http://localhost:11434"
      ];

      EnvironmentFile = "/run/secrets/ava.env";

      ExecStart = "${avaWithTools}/bin/ava";

      StandardOutput = "journal";
      StandardError = "journal";

      Restart = "on-failure";
      RestartSec = 5;

      TimeoutStopSec = 90;
      KillMode = "mixed";
      KillSignal = "SIGTERM";
    };
  };

  systemd.tmpfiles.rules = [
    "d /home/ava 0755 ava users -"
    "d /home/ava/omni 0755 ava users -"
    "d /home/ava/skills 0755 ava users -"
    "d /home/ava/prompts 0755 ava users -"
    "d /home/ava/prompts/agents 0755 ava users -"
    "d /home/ava/prompts/agents/telegram 0755 ava users -"
    "d /home/ava/prompts/shared 0755 ava users -"
    "d /home/ava/prompts/shared/formatting 0755 ava users -"
    "d /home/ava/prompts/subagents 0755 ava users -"
    "d /home/ava/prompts/subagents/generic 0755 ava users -"
    "d /home/ava/prompts/subagents/coder 0755 ava users -"
    "d /home/ava/outreach 0755 ava users -"
    "d /home/ava/outreach/pending 0755 ava users -"
    "d /home/ava/outreach/approved 0755 ava users -"
    "d /home/ava/outreach/rejected 0755 ava users -"
    "d /home/ava/outreach/sent 0755 ava users -"
    "d /home/ava/users 0755 ava users -"
    "d /home/ava/.local/share/omni 0755 ava users -"
    "d /home/ava/models 0755 ava users -"
    "d /home/ava/logs 0755 ava users -"
    "d /home/ava/logs/ava 0755 ava users -"
    "d /home/ava/logs/subagents 0755 ava users -"
  ];

  # Create .bashrc with direnv hook if it doesn't exist
  system.activationScripts.avaBashrc = ''
    if [ ! -f /home/ava/.bashrc ]; then
      echo 'eval "$(direnv hook bash)"' > /home/ava/.bashrc
      chown ava:users /home/ava/.bashrc
    fi
  '';
}