{...}: let
  bild = import ../../Bild.nix {};
  avaPkg = bild.run ../../Ava.hs;

  # Python environment for Ava's python_exec tool
  avaPython = bild.python.pythonWith (p: [
    p.requests # HTTP requests
    p.beautifulsoup4 # HTML/XML parsing
    p.lxml # Fast XML/HTML parser
    p.pandas # Data analysis
    p.numpy # Numerical computing
    p.pyyaml # YAML parsing
    p.python-dateutil # Date utilities
  ]);

  # Wrap ava binary with tools in PATH
  avaWithTools = bild.stdenv.mkDerivation {
    name = "ava-wrapped";
    buildInputs = [bild.makeWrapper];
    phases = ["installPhase"];
    installPhase = ''
      mkdir -p $out/bin
      makeWrapper ${avaPkg}/bin/ava $out/bin/ava \
        --prefix PATH : ${bild.lib.makeBinPath [
        avaPython
        bild.pkgs.jq
        bild.pkgs.ripgrep
        bild.pkgs.coreutils
        bild.pkgs.git
        bild.pkgs.sqlite
      ]}
    '';
  };
in {
  systemd.services.ava = {
    description = "Ava Telegram assistant";
    after = ["network-online.target" "ollama.service"];
    wants = ["network-online.target" "ollama.service"];
    wantedBy = ["multi-user.target"];

    serviceConfig = {
      Type = "simple";
      User = "ava";
      Group = "users";
      WorkingDirectory = "/home/ava/omni";

      Environment = [
        "AVA_DATA_ROOT=/home/ava"
        "HOME=/home/ava"
        "OLLAMA_URL=http://localhost:11434"
      ];

      EnvironmentFile = "/run/secrets/ava.env";

      ExecStart = "${avaWithTools}/bin/ava";

      StandardOutput = "journal";
      StandardError = "journal";

      Restart = "on-failure";
      RestartSec = 5;

      TimeoutStopSec = 90;
      KillMode = "mixed";
      KillSignal = "SIGTERM";
    };
  };

  systemd.tmpfiles.rules = [
    "d /home/ava 0755 ava users -"
    "d /home/ava/omni 0755 ava users -"
    "d /home/ava/skills 0755 ava users -"
    "d /home/ava/outreach 0755 ava users -"
    "d /home/ava/outreach/pending 0755 ava users -"
    "d /home/ava/outreach/approved 0755 ava users -"
    "d /home/ava/outreach/rejected 0755 ava users -"
    "d /home/ava/outreach/sent 0755 ava users -"
    "d /home/ava/users 0755 ava users -"
    "d /home/ava/.local/share/omni 0755 ava users -"
  ];
}