✨(backend) compatible with summary v2 routes

* Track external process (transcribe) status through a webhook and new Enum choices, * Send v2 and v1 summary routes params so that both endpoint can still be used, * Updated dev setup to make it work.
💥(summary) removed summary v1 related code
2026-10-01 23:19:59 +00:00 · 2026-05-26 18:28:08 +02:00 · 2026-05-26 16:59:43 +02:00
729 changed files with 19056 additions and 44643 deletions
@@ -1,9 +0,0 @@
-[codespell]
-# Files that are not English, or generated
-skip = ./.git,*.pdf,*.po,*.pot,*.json,*.lock,package-lock.json,
-  ./LICENSES,
-  ./src/summary/summary/core/locales,
-  ./src/summary/summary/core/prompt.py
-# Valid words in French (connexion) or in the code (statics)
-ignore-words-list = connexion,statics
-check-filenames = true
@@ -1,20 +0,0 @@
-# Debian 13 base image (python:3.14-slim): no fixed version available yet.
-# Review regularly and remove entries once Debian ships a fix.
-
-# util-linux
-CVE-2026-76642
-CVE-2026-78408
-CVE-2026-78409
-CVE-2026-78410
-
-# acl
-CVE-2026-54369
-
-# ncurses
-CVE-2025-69720
-
-# systemd
-CVE-2026-16742
-
-# perl-base (fix deferred by Debian)
-CVE-2026-9538
@@ -0,0 +1,28 @@
+---
+name: 🐛 Bug Report
+about: If something is not working as expected 🤔.
+
+---
+
+## Bug Report
+
+**Problematic behavior**
+A clear and concise description of the behavior.
+
+**Expected behavior/code**
+A clear and concise description of what you expected to happen (or code).
+
+**Steps to Reproduce**
+1. Do this...
+2. Then this...
+3. And then the bug happens!
+
+**Environment**
+- Meet version:
+- Platform:
+
+**Possible Solution**
+<!--- Only if you have suggestions on a fix for the bug -->
+
+**Additional context/Screenshots**
+Add any other context about the problem here. If applicable, add screenshots to help explain.
@@ -0,0 +1,23 @@
+---
+name: ✨ Feature Request
+about: I have a suggestion (and may want to build it 💪)!
+
+---
+
+## Feature Request
+
+**Is your feature request related to a problem or unsupported use case? Please describe.**
+A clear and concise description of what the problem is. For example: I need to do some task and I have an issue...
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen. Add any considered drawbacks.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Discovery, Documentation, Adoption, Migration Strategy**
+If you can, explain how users will be able to use this and possibly write out a version the docs (if applicable).
+Maybe a screenshot or design?
+
+**Do you want to work on it through a Pull Request?**
+<!-- Make sure to coordinate with us before you spend too much time working on an implementation! -->
@@ -0,0 +1,22 @@
+---
+name: 🤗 Support Question
+about: If you have a question 💬, or something was not clear from the docs!
+
+---
+
+<!-- ^ Click "Preview" for a nicer view! ^
+We primarily use GitHub as an issue tracker. If however you're encountering an issue not covered in the docs, we may be able to help! -->
+
+---
+
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/meet).
+
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/meet/issues).
+
+If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
+
+**Topic**
+What's the general area of your question: for example, docker setup, database schema, search functionality,...
+
+**Question**
+Try to be as specific as possible so we can help you as best we can. Please be patient 🙏
@@ -0,0 +1,11 @@
+## Purpose
+
+Description...
+
+
+## Proposal
+
+Description...
+
+- [] item 1...
+- [] item 2...
@@ -1,19 +0,0 @@
-name: Changelog Workflow
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-jobs:
-  changelog:
-    uses: suitenumerique/ci/.github/workflows/_changelog.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
@@ -1,235 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "*"
-permissions:
-  contents: read
-
-jobs:
-
-  lint-python:
-    name: lint ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            working_directory: src/backend
-            pylint_targets: meet demo core
-          - service: agents
-            working_directory: src/agents
-            pylint_targets: ""
-          - service: summary
-            working_directory: src/summary
-            pylint_targets: ""
-    uses: suitenumerique/ci/.github/workflows/_python-lint.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      working_directory: ${{ matrix.working_directory }}
-      python_version: "3.13"
-      pylint_targets: ${{ matrix.pylint_targets }}
-
-  test-back:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/backend
-
-    services:
-      postgres:
-        image: postgres:16
-        env:
-          POSTGRES_DB: meet
-          POSTGRES_USER: dinum
-          POSTGRES_PASSWORD: pass
-        ports:
-          - 5432:5432
-        # needed because the postgres container does not provide a healthcheck
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
-      redis:
-        image: redis:5
-        ports:
-          - 6379:6379
-        # Set health checks to wait until redis has started
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    env:
-      DJANGO_CONFIGURATION: Test
-      DJANGO_SETTINGS_MODULE: meet.settings
-      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
-      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
-      DB_HOST: localhost
-      DB_NAME: meet
-      DB_USER: dinum
-      DB_PASSWORD: pass
-      DB_PORT: 5432
-      REDIS_URL: redis://localhost:6379/1
-      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
-      AWS_S3_ENDPOINT_URL: http://localhost:9000
-      AWS_S3_ACCESS_KEY_ID: meet-access-key
-      AWS_S3_SECRET_ACCESS_KEY: meet-secret-access-key
-      AWS_S3_REGION_NAME: local
-      OIDC_RS_CLIENT_ID: meet
-      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
-      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
-      OIDC_OP_URL: https://oidc.example.com
-      MEDIA_BASE_URL: http://localhost:8083
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Create writable /data
-        run: |
-          sudo mkdir -p /data/media && \
-          sudo mkdir -p /data/static
-
-      - name: Build or restore the mail templates
-        uses: suitenumerique/ci/actions/mail-templates@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-
-      # Creates the access key and the bucket on startup
-      - name: Start Garage
-        run: |
-          docker run -d --name garage \
-            -p 9000:9000 \
-            -v "${GITHUB_WORKSPACE}/docker/files/etc/garage/garage.toml:/etc/garage.toml:ro" \
-            -e "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" \
-            -e "GARAGE_DEFAULT_ACCESS_KEY=meet-access-key" \
-            -e "GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key" \
-            -e "GARAGE_DEFAULT_BUCKET=meet-media-storage" \
-            dxflrs/garage:v2.4.1 \
-            /garage server --single-node --default-bucket
-
-      - name: Wait for Garage to be ready
-        run: |
-          timeout 30 sh -c 'until docker exec garage /garage health; do sleep 1; done'
-
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      - name: Install the dependencies
-        run: uv sync --locked --all-extras
-
-      - name: Install gettext (required to compile messages)
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-
-      - name: Generate a MO file from strings extracted from the project
-        run: uv run --no-sync --no-build python manage.py compilemessages
-
-      - name: Run tests
-        run: uv run --no-sync --no-build pytest -n 2
-
-  test-summary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/summary
-
-    env:
-      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
-      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
-      AWS_S3_ENDPOINT_URL: "garage:9000"
-      AWS_S3_ACCESS_KEY_ID: "meet-access-key"
-      AWS_S3_SECRET_ACCESS_KEY: "meet-secret-access-key"
-      WHISPERX_BASE_URL: "https://configure-your-url.com"
-      WHISPERX_ASR_MODEL: "large-v2"
-      WHISPERX_API_KEY: "test-whisperx-secret"
-      WHISPERX_DEFAULT_LANGUAGE: "fr"
-      LLM_BASE_URL: "https://configure-your-url.com"
-      LLM_API_KEY: "test-llm-secret"
-      LLM_MODEL: "test-llm-model"
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install ffmpeg
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y ffmpeg
-
-      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.13"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-
-      - name: Install the project
-        run: uv sync --locked --all-extras
-
-      - name: Run summary tests
-        run: uv run --no-sync --no-build pytest
-
-  lint-front:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install dependencies
-        run: cd src/frontend/ && npm ci --ignore-scripts
-
-      - name: Check linting
-        run: cd src/frontend/ && npm run lint
-
-      - name: Check format
-        run: cd src/frontend/ && npm run check
-
-  lint-sdk:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: src/sdk/library
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install dependencies
-        run: npm ci --ignore-scripts
-
-      - name: Check linting
-        run: npm run lint
-
-      - name: Check format
-        run: npm run check
-
-  build-sdk:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    needs: lint-sdk
-    defaults:
-      run:
-        working-directory: src/sdk/library
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-
-      - name: Install dependencies
-        run: npm ci --ignore-scripts
-
-      - name: Build SDK
-        run: npm run build
@@ -1,14 +0,0 @@
-name: Project quality Workflow
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  quality:
-    uses: suitenumerique/ci/.github/workflows/_project-quality.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      print_check_paths: src/backend src/summary src/agents
-      codespell_ignore_words: "unsecure"
@@ -0,0 +1,33 @@
+name: Download Crowdin translations
+
+on:
+  workflow_dispatch:
+    types: [file-fully-translated]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  crowdin:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Download Crowdin files
+        uses: crowdin/github-action@v2
+        with:
+          upload_sources: false
+          upload_translations: false
+          download_translations: true
+          localization_branch_name: l10n_crowdin_translations
+          create_pull_request: true
+          pull_request_title: "New Crowdin translations"
+          pull_request_body: "New Crowdin pull request with translations"
+          pull_request_base_branch_name: "main"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_BASE_PATH: ${{ github.workspace }}
@@ -1,5 +1,5 @@
-name: Docker images
-run-name: Docker images
+name: Docker Hub Workflow
+run-name: Docker Hub Workflow

 on:
  workflow_dispatch:
@@ -15,62 +15,258 @@ on:
 permissions:
  contents: read

+env:
+  DOCKER_USER: 1001:127
+  DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io
+  DOCKER_CONTAINER_REGISTRY_NAMESPACE: lasuite
+
 jobs:
-  build-and-push:
-    name: ${{ matrix.service }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - service: backend
-            image_name: lasuite/meet-backend
-            context: .
-            file: ./Dockerfile
-            target: backend-production
-          - service: frontend
-            image_name: lasuite/meet-frontend
-            context: .
-            file: ./src/frontend/Dockerfile
-            target: frontend-production
-          - service: frontend-dinum
-            image_name: lasuite/meet-frontend-dinum
-            context: .
-            file: ./docker/dinum-frontend/Dockerfile
-            target: frontend-production
-          - service: summary
-            image_name: lasuite/meet-summary
-            context: ./src/summary
-            file: ./src/summary/Dockerfile
-            target: production
-          - service: agents
-            image_name: lasuite/meet-agents
-            context: ./src/agents
-            file: ./src/agents/Dockerfile
-            target: production
-    uses: suitenumerique/ci/.github/workflows/_docker-publish.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      image_name: ${{ matrix.image_name }}
-      context: ${{ matrix.context }}
-      file: ${{ matrix.file }}
-      target: ${{ matrix.target }}
-      docker_user: "1001:127"
-      is_multi_platform: ${{ startsWith(github.ref, 'refs/tags/v') }}
-      should_push: ${{ github.event_name != 'pull_request' || startsWith(github.head_ref, 'integration/') }}
-      trivy_scan: true
-      trivy_ignore_files: ./.github/.trivyignore
-    secrets:
-      DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
-      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+  build-and-push-backend:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '--target backend-production -f Dockerfile'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-backend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: backend-production
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-generic:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f src/frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./src/frontend/Dockerfile
+          target: frontend-production
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-frontend-dinum:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        with:
+          docker-build-args: '-f docker/dinum-frontend/Dockerfile --target frontend-production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-frontend-dinum:${{ github.sha }}'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./docker/dinum-frontend/Dockerfile
+          target: frontend-production
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: '${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary'
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/summary/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}'
+          docker-context: './src/summary'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./src/summary
+          file: ./src/summary/Dockerfile
+          target: production
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  build-and-push-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      -
+        name: Checkout repository
+        uses: actions/checkout@v6
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/meet-agents
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USER }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      -
+        name: Run trivy scan
+        uses: numerique-gouv/action-trivy-cache@main
+        continue-on-error: true
+        with:
+          docker-build-args: '-f src/agents/Dockerfile --target production'
+          docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}'
+          docker-context: './src/agents'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./src/agents
+          file: ./src/agents/Dockerfile
+          target: production
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}:-1000
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

  notify-argocd:
    permissions:
      contents: read
    needs:
-      - build-and-push
+      - build-and-push-frontend-generic
+      - build-and-push-frontend-dinum
+      - build-and-push-backend
+      - build-and-push-summary
+      - build-and-push-agents
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
-      - uses: suitenumerique/ci/actions/argocd-webhook-notification@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+      - uses: numerique-gouv/action-argocd-webhook-notification@main
        id: notify
        with:
          deployment_repo_path: "${{ secrets.DEPLOYMENT_REPO_URL }}"
@@ -0,0 +1,395 @@
+name: meet Workflow
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - "*"
+permissions:
+  contents: read
+
+jobs:
+  lint-git:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' # Makes sense only for pull requests
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: show
+        run: git log
+      - name: Enforce absence of print statements in code
+        if: always()
+        run: |
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/meet.yml' | grep "print("
+      - name: Check absence of fixup commits
+        if: always()
+        run: |
+          ! git log | grep 'fixup!'
+      - name: Install gitlint
+        if: always()
+        run: pip install --user requests gitlint
+      - name: Lint commit messages added to main
+        if: always()
+        run: ~/.local/bin/gitlint --commits origin/${{ github.event.pull_request.base.ref }}..HEAD
+
+  check-changelog:
+    runs-on: ubuntu-latest
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'noChangeLog') == false &&
+      github.event_name == 'pull_request'
+    permissions:
+        contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 50
+      - name: Check that the CHANGELOG has been modified in the current branch
+        run: git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.after }} | grep 'CHANGELOG.md'
+
+  lint-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Check CHANGELOG max line length
+        run: |
+          max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
+          if [ $max_line_length -ge 80 ]; then
+            echo "ERROR: CHANGELOG has lines longer than 80 characters."
+            exit 1
+          fi
+
+  build-mails:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/mail
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "18"
+
+      - name: Restore the mail templates
+        uses: actions/cache@v5
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+      - name: Install yarn
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: npm install -g yarn
+
+      - name: Install node dependencies
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn install --frozen-lockfile
+
+      - name: Build mails
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        run: yarn build
+
+      - name: Cache mail templates
+        if: steps.mail-templates.outputs.cache-hit != 'true'
+        uses: actions/cache@v5
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+  lint-back:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/backend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the project
+        run: uv sync --locked --all-extras
+
+      - name: Check code formatting with ruff
+        run: uv run ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run ruff check .
+      - name: Lint code with pylint
+        run: uv run pylint meet demo core
+
+  lint-agents:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/agents
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the project
+        run: uv sync --locked --all-extras
+      - name: Check code formatting with ruff
+        run: uv run ruff format . --diff
+      - name: Lint code with ruff
+        run: uv run ruff check .
+
+  lint-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: "pip"
+      - name: Install development dependencies
+        run: pip install --user .[dev]
+      - name: Check code formatting with ruff
+        run: ~/.local/bin/ruff format . --diff
+      - name: Lint code with ruff
+        run: ~/.local/bin/ruff check .
+
+  test-back:
+    runs-on: ubuntu-latest
+    needs: build-mails
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/backend
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: meet
+          POSTGRES_USER: dinum
+          POSTGRES_PASSWORD: pass
+        ports:
+          - 5432:5432
+        # needed because the postgres container does not provide a healthcheck
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+      redis:
+        image: redis:5
+        ports:
+          - 6379:6379
+        # Set health checks to wait until redis has started
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DJANGO_CONFIGURATION: Test
+      DJANGO_SETTINGS_MODULE: meet.settings
+      DJANGO_SECRET_KEY: ThisIsAnExampleKeyForTestPurposeOnly
+      OIDC_OP_JWKS_ENDPOINT: /endpoint-for-test-purpose-only
+      DB_HOST: localhost
+      DB_NAME: meet
+      DB_USER: dinum
+      DB_PASSWORD: pass
+      DB_PORT: 5432
+      REDIS_URL: redis://localhost:6379/1
+      STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
+      AWS_S3_ENDPOINT_URL: http://localhost:9000
+      AWS_S3_ACCESS_KEY_ID: meet
+      AWS_S3_SECRET_ACCESS_KEY: password
+      OIDC_RS_CLIENT_ID: meet
+      OIDC_RS_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
+      OIDC_OP_INTROSPECTION_ENDPOINT: https://oidc.example.com/introspect
+      OIDC_OP_URL: https://oidc.example.com
+      MEDIA_BASE_URL: http://localhost:8083
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Create writable /data
+        run: |
+          sudo mkdir -p /data/media && \
+          sudo mkdir -p /data/static
+
+      - name: Restore the mail templates
+        uses: actions/cache@v5
+        id: mail-templates
+        with:
+          path: "src/backend/core/templates/mail"
+          key: mail-templates-${{ hashFiles('src/mail/mjml') }}
+
+      - name: Start MinIO
+        run: |
+          docker pull minio/minio
+          docker run -d --name minio \
+            -p 9000:9000 \
+            -e "MINIO_ACCESS_KEY=meet" \
+            -e "MINIO_SECRET_KEY=password" \
+            -v /data/media:/data \
+            minio/minio server --console-address :9001 /data
+
+      # Tool to wait for a service to be ready
+      - name: Install Dockerize
+        run: |
+          curl -sSL https://github.com/jwilder/dockerize/releases/download/v0.8.0/dockerize-linux-amd64-v0.8.0.tar.gz | sudo tar -C /usr/local/bin -xzv
+
+      - name: Wait for MinIO to be ready
+        run: |
+          dockerize -wait tcp://localhost:9000 -timeout 10s
+
+      - name: Configure MinIO
+        run: |
+          MINIO=$(docker ps | grep minio/minio | sed -E 's/.*\s+([a-zA-Z0-9_-]+)$/\1/')
+          docker exec ${MINIO} sh -c \
+            "mc alias set meet http://localhost:9000 meet password && \
+            mc alias ls && \
+            mc mb meet/meet-media-storage"
+
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      - name: Install the dependencies
+        run: uv sync --locked --all-extras
+
+      - name: Install gettext (required to compile messages)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gettext
+
+      - name: Generate a MO file from strings extracted from the project
+        run: uv run python manage.py compilemessages
+
+      - name: Run tests
+        run: uv run pytest -n 2
+
+  test-summary:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/summary
+
+    env:
+      AUTHORIZED_TENANTS: '[{"id": "test-tenant", "api_key": "test-api-token", "webhook_url": "https://example.com/webhook", "webhook_api_key": "test-webhook-api-key"}]'
+      AWS_STORAGE_BUCKET_NAME: "http://meet-media-storage"
+      AWS_S3_ENDPOINT_URL: "minio:9000"
+      AWS_S3_ACCESS_KEY_ID: "meet"
+      AWS_S3_SECRET_ACCESS_KEY: "password"
+      WHISPERX_BASE_URL: "https://configure-your-url.com"
+      WHISPERX_ASR_MODEL: "large-v2"
+      WHISPERX_API_KEY: "test-whisperx-secret"
+      WHISPERX_DEFAULT_LANGUAGE: "fr"
+      LLM_BASE_URL: "https://configure-your-url.com"
+      LLM_API_KEY: "test-llm-secret"
+      LLM_MODEL: "test-llm-model"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install ffmpeg
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ffmpeg
+
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: "pip"
+
+      - name: Install development dependencies
+        run: pip install --user .[dev]
+
+      - name: Run summary tests
+        run: ~/.local/bin/pytest
+
+  lint-front:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install dependencies
+        run: cd src/frontend/ && npm ci
+
+      - name: Check linting
+        run: cd src/frontend/ && npm run lint
+
+      - name: Check format
+        run: cd src/frontend/ && npm run check
+
+  lint-sdk:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: src/sdk/library
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check linting
+        run: npm run lint
+
+      - name: Check format
+        run: npm run check
+
+  build-sdk:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: lint-sdk
+    defaults:
+      run:
+        working-directory: src/sdk/library
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build SDK
+        run: npm run build
@@ -1,17 +1,33 @@
-name: Release Helm chart
+name: Release Chart
+run-name: Release Chart

 on:
  push:
-    branches:
-      - main
    paths:
      - src/helm/meet/**

-permissions:
-  contents: read
-
 jobs:
  release:
    permissions:
      contents: write
-    uses: suitenumerique/ci/.github/workflows/_release-helm-chart.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Cleanup
+        run: rm -rf ./src/helm/extra
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Publish Helm charts
+        uses: numerique-gouv/helm-gh-pages@add-overwrite-option
+        with:
+          charts_dir: ./src/helm
+          linting: on
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,29 @@
+# /!\
+# Security Note: This action is not hardened against prompt injection attacks and should only be used
+# to review trusted PRs. Configure your repository with "Require approval for all external contributors"
+# to ensure workflows only run after a maintainer has reviewed the PR.
+name: Security Review
+
+permissions:
+  pull-requests: write  # Needed for leaving PR comments
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      - uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          exclude-directories: docs,gitlint,LICENSES,bin
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
@@ -1,21 +0,0 @@
-name: Security analysis
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - "**"
-
-permissions: {}
-
-jobs:
-  zizmor:
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
-    uses: suitenumerique/ci/.github/workflows/_zizmor.yml@ca6401ac83e981e5b0a94f06f68baaa6e6d0a436 # v0.0.1
-    with:
-      config: .github/zizmor.yml
@@ -1,5 +0,0 @@
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        "suitenumerique/*": ref-pin
@@ -83,9 +83,3 @@ docker/livekit/out

 # LiveKit CA configuration
 docker/livekit/rootCA.pem
-
-# Frontend rollup-plugin-visualizer
-/src/frontend/rollup-plugin-visualizer/*
-
-# NixOS
-.devenv
@@ -10,472 +10,17 @@ and this project adheres to

 ### Added

- 🔒(backend) throttle meeting link generation
- 🔒️(backend) add a daily cap on room creation
-
-### Fixed
-
- 🐛(frontend) enforce recording-mode permissions on the checkboxes
- 🔒️(agents) fix util-linux CVEs reported by Cyberwatch
- 🔒️(backend) fix HIGH CVEs in Django and urllib3
- 🔒️(agents) upgrade libpcre2-8-0 to fix CVE-2026-103111
-
-## [1.33.0] - 2026-09-30
-
-### Added
-
- ✨(backend) purge rooms inactive for a configurable period
- 🔨(makefile) add targets to list and download files stored in Garage
-
-### Changed
-
- ⬆️(backend) update python dependencies
- ⬆️(summary) update python dependencies
- ⬆️(agents) update python dependencies
- ♻️(agents) replace the minio client by boto3
- 🔧(compose) replace MinIO by Garage for local development
- 🔧(helm) point media services to Garage by default
-
-### Fixed
-
- 🔒️(backend) fix critical and high CVEs in PyJWT
- ⚡️(frontend) disable posthog-js periodic feature flag reloads
-
-## [1.32.1] - 2026-09-25
-
-### Fixed
-
- 🔒️(backend) fix CVE-2026-73228 and CVE-2026-73229 in drf
- 🔒️(agent) fix CRITICAL CVE-2026-63072 / CVE-2026-63073 in libssl3t64
-
-## [1.32.0] - 2026-09-25
-
-### Added
-
- ✨(backend) make the LiveKit default video codec configurable
- 🔧(dev) add support for Bureautix workstations
- ✨(frontend) add screen share zoom controls #1498
-
-### Changed
-
- 🔥(backend) remove unused API viewset and permission helpers
- 🔊(backend) pin the dockerflow logger level to WARNING
- 🚑️(summary) serve health endpoints with the dockerflow router
- ♻️(backend) serve the dockerflow views early in the middleware stack
- 📈(frontend) include LiveKit SIDs in the connection analytics event
- 🔇(backend) silence expected 401 warnings on /me
- 🔇(backend) silence noisy request summary info logs
- ⚡️(frontend) defer loading the Crisp script until idle
- ⬆️(frontend) upgrade react-i18next from 17.0.10 to 17.0.12
- ⬆️(frontend) upgrade posthog-js from 1.414.0 to 1.418.10
- ⬆️(addons) upgrade i18next from 26.3.6 to 26.4.0
- ⬆️(frontend) upgrade humanize-duration from 3.33.2 to 3.34.1
- ⬆️(addons) upgrade i18next from 26.4.0 to 26.4.2
- 🔖(helm) release chart 0.0.28
- ♻️(backend) decouple recording event handling from LiveKit egress statuses
-
-### Fixed
-
- 🐛(helm) probe liveness on __lbheartbeat__ and readiness on __heartbeat__
- 🐛(helm) render periodSeconds and failureThreshold on probes
- 🐛(backend) report the app release to Sentry instead of "NA"
- 🐛(frontend) play the waiting room notification sound on every arrival
- 🐛(frontend) apply saved reception resolution when joining a meeting #1714
- 🐛(backend) acknowledge unknown LiveKit webhook events instead of 422
- 🔒️(backend) enforce display name setting on rename API
- 🔒️(backend) reject inactive users in resource server backend
- 🐛(frontend) fix file permissions in the Docker image
- 🚸(frontend) inform user that recording waits until a track is published
- 🔒(backend) upgrade base image to python:3.13.5-alpine3.24
- 🐛(backend) handle failed and aborted egresses
- 🩹(frontend) notify participants when a recording fails or is aborted
- 🔒️(frontend) fix HIGH CVE-2026-93990 in libexpat
-
-## [1.31.0] - 2026-09-08
-
-### Added
-
- ✨(frontend) add 1080p sending resolution option #1660
- ✨(backend) add Traefik support via configurable media-auth url header #1649
- ✨(backend) update a room's attributes from the external API
- 🔊(backend) log request duration in Gunicorn workers
- 📈(frontend) track missing lobby participant on accept/reject
- ✨(backend) sort waiting participants by their arrival time
-
-### Changed
-
- ⬆️(dev) pin LiveKit server to v1.13.6
- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24
-
-### Fixed
-
- 🐛(backend) allow any printable ASCII characters in user sub field #1673
- 🐛(frontend) keep the sending resolution picked while the camera is off #1667
- 🐛(frontend) restore automatic lower-hand on speaking
- 🐛(frontend) center Avatar initials with a font-aware cap-height ratio
- 🐛(frontend) keep feedback buttons on one line for fr/es/en
- ⚡️(frontend) increase lobby polling interval on both sides
- ⚡️(frontend) add trailing slash on the /me endpoint call
- ⚡️(backend) refactor lobby storage to bound key lookups per room
- ⚡️(backend) refactor presence cache to bound key lookups per room
- 💄(frontend) position the login hint dynamically next to the button
-
-## [1.30.0] - 2026-09-01
-
-### Added
-
- ✨(agent) support Voxtral realtime as inference engine
- 🌐(i18n) add Spanish language support
- ✨(frontend) expose publish permissions on the media state element #1661
-
-### Changed
-
- 🔥(backend) remove the S3 storage-event webhook for recordings
- ♻️(backend) always finalize recordings using the LiveKit egress_ended webhook
- ⬆️(frontend) upgrade posthog-js from 1.409.5 to 1.414.0
- ⬆️(frontend) upgrade @fontsource-variable/lexend from 5.2.11 to 5.3.0
- ⬆️(frontend) upgrade @fontsource/opendyslexic from 5.2.5 to 5.3.0
- ⬆️(addons) upgrade core-js from 3.49.0 to 3.50.0
- ♻️(backend) factorize s3 client creation in utils
- ♿️(frontend) close side panel with Escape key #1507
-
-### Fixed
-
- 🐛(frontend) fix chat text-area bug
-
-## [1.29.0] - 2026-08-25
-
-### Added
-
- ✨(any) let any authenticated user manage the lobby on trusted rooms
-
-### Changed
-
- 📱(frontend) collapse mobile control bar items on narrow viewports
- 📱(frontend) stack idle modal buttons in a column on mobile
- 📱(frontend) improve feedback screen responsiveness on mobile
- ⬆️(frontend) upgrade @fontsource-variable/atkinson-hyperlegible-next
- ⬆️(frontend) upgrade i18next-resources-to-backend from 1.2.1 to 1.2.3
- ⬆️(frontend) upgrade @tanstack/react-query from 5.101.1 to 5.101.4
- ⬆️(frontend) upgrade @pandacss/preset-panda from 1.11.3 to 1.12.0
- ⬆️(frontend) upgrade posthog-js from 1.404.1 to 1.409.5
- ⚡️(frontend) apply frugal constraint to the active meeting audio track
- ⚡️(backend) replace blocking Redis KEYS with cursor-based SCAN
- ✨(summary) add hostname to analytics properties
-
-## [1.28.0] - 2026-08-24
-
-### Added
-
- 📈(frontend) track errors when starting or stopping a recording
- 🚸(frontend) explain camera-in-use failures on the join screen
-
-### Changed
-
- ✨(backend) accept form-urlencoded on the user token endpoint
- ✨(summary) configurable s3 region
- ⬆️(frontend) upgrade i18next and react-i18next patch versions
- ⬆️(frontend) upgrade posthog-js from 1.395.0 to 1.404.1
- ⬆️(frontend) upgrade livekit-client and @livekit/components-react
- 💄(frontend) increase the blur intensity
-
-### Fixed
-
- 📝(docs) fix minor typos in comments and docstrings
- ⬆️(backend) bump sqlparse from 0.5.5 to 0.6.0
- ⬆️(mail) bump @html-to/text-cli from 0.6.0 to 0.6.1
- 🐛(frontend) treat client-initiated connect aborts as events
- 🐛(frontend) use state instead of a ref for MoreControls container
- 🐛(frontend) stop init_virtual_background from firing on blur updates
- 🐛(frontend) hoist mute confirmation dialog to VideoConference level
- 🐛(frontend) fix joined notification tile no longer rendering properly
- 🐛(frontend) handle device-in-use errors on Chrome / Windows 10
- 🐛(frontend) handle Firefox/Windows AbortError on device start
- 🐛(frontend) treat "Timeout starting source" AbortError as device-in-use
- 🔇(frontend) suppress leaked WebSocket error events from livekit-client
-
-## [1.27.0] - 2026-08-14
-
-### Changed
-
- 🔥(frontend) drop unused vendored ConnectionObserver
- 🐛(frontend) vendor formatChatMessageLinks and trim surrounding newlines
-
-### Fixed
-
- 📈(frontend) downgrade unreachable external home URL from error to event
- 🐛(frontend) handle 401 responses when syncing user preferences
- 🐛(frontend) harden speaker test against missing sinks and play errors
- 🐛(frontend) implement hysteresis band for the control bar layout
- 🐛(frontend) fix toolbar ResizeObserver loop and alignment drift
- 🐛(analytics) filter benign ResizeObserver loop error in Sentry/PostHog
- 🐛(frontend) stop reporting screen-share denials as errors
- 🐛(frontend) generalize screen-share error modal beyond macOS
- 📈(frontend) stop double-reporting media device failures
-
-## [1.26.0] - 2026-08-12
-
-### Added
-
- 📈(frontend) capture media diagnostics on media errors
- ✨(frontend) add an audio gauge to the microphone select menu
- ✨(frontend) add a sound tester to the output select menu
- ✨(frontend) prompt for permissions when toggling a denied device
- ⚗️(frontend) capture console.error in PostHog
- 📈(frontend) snapshot media devices on the happy path
- 🚸(frontend) guide users when the OS blocks browser media access
- ✨(frontend) add a silent-microphone watcher on join and room screens
-
-### Changed
-
- ♻️(frontend) encapsulate error tracking behind a telemetry module
- ♻️(frontend) encapsulate PostHog capture calls in the telemetry module
- 🔧(frontend) sync persisted device ids with the actual selected devices
- 💄(frontend) hide the ProConnect button on narrow viewports
- ♻️(frontend) prefer captureMediaEvent over reportError when no-op
-
-### Fixed
-
- 🐛(frontend) drop exact deviceId constraint on dynamic track creation
- 🐛(frontend) fix permission store regression
- 🐛(frontend) handle missing device errors gracefully
- 🐛(frontend) display the meeting id in the join screen page title
-
-## [1.25.2] - 2026-08-06
-
-### Fixed
-
- 🐛(frontend) serve MediaPipe assets under a versioned path
- 🐛(frontend) harmonize cache configuration for MediaPipe assets
-
-## [1.25.1] - 2026-08-06
-
-### Fixed
-
- 🚑️(frontend) fix background crash from MediaPipe WASM version mismatch
-
-## [1.25.0] - 2026-08-05
-
-### Added
-
- ✨(summary) report exception type in failure analytics
- ✨(frontend) add configurable documentation menu item
- ✨(frontend) allow promoting authenticated participants
- ✨(frontend) introduce an "unauthenticated" participant badge
- ✨(backend) add roomkit viewset to start a room without WebRTC join
- ✨(frontend) let users set default configuration for generated links
- ✨(frontend) expose media state to external gateways
- ✨(frontend) add connection test feature
- ✨(sdk) allow passing a background color to the calendar iframe
- ✨(sdk) add a room configuration popup from CreateMeetingButton
-
-### Changed
-
- ⬆️(frontend) upgrade @mediapipe/tasks-vision from 0.10.14 to 0.10.35
- ⬆️(frontend) upgrade i18next from 26.3.1 to 26.3.6
- ⬆️(frontend) upgrade posthog-js from 1.391.2 to 1.395.0
- ⬆️(frontend) upgrade @tanstack/react-query from 5.101.0 to 5.101.1
- ⬆️(frontend) upgrade livekit-client from 2.19.2 to 2.20.0
- ⚡️(frontend) limit unnecessary re-renders #1510
- 📝(legal) update terms of service
- 💄(frontend) render Avatar initials in uppercase
- 💄(frontend) improve participant name rendering in the list
- 🚚(backend) rename TelephonyService to SIPManagement
- ⬆️(dependencies) update python dependencies
-
-### Fixed
-
- 🐛(transcription) fix silent bug in speaker assignment
- 🐛(summary) extend tasks auto retry logic
- 🐛(summary) properly detect when failure webhook should be sent
- 🐛(backend) preserve recording metadata when updating room access
- 🐛(backend) allow any string as sub in the API serializer
- 🐛(frontend) fall back to user.full_name on request-entry
- 🚸(frontend) show two initials in the Avatar when possible
- 🩹(all) clear the SonarCloud reliability finding and the lint debt
- 🐛(frontend) stop the installed app reopening the room it came from
- 🐛(backend) serialize lazy title in summary payload
- 💄(frontend) show pointer cursor on interactive switches
- 🐛(frontend) fix icon centering in the Switch primitive
- 🐛(frontend) keep Unicode initials intact in avatar
- 🐛(frontend) prevent concurrent settings updates from overwriting each other
-
-## [1.24.0] - 2026-07-21
-
-### Added
-
- ✨(backend) allow searching the recording admin table by owner email
- ✨(frontend) add participant color gradient when camera is off #1490
- ✨(all) allow forcing SSO display name for authenticated users
- ➕(frontend) install vite-plugin-static-copy for MediaPipe WASM assets
- ✨(addon) show add-in tools when creating meetings in shared calendars
-
-### Changed
-
- 🗑️(settings) deprecate SUMMARY_SERVICE_VERSION=1
- ⬆️(mail) update mjml to v5 and @html-to/text-cli
- 🚸(frontend) initialize the join input name with the persisted full name
- ♻️(frontend) refactor background processors to use the new API
- ♻️(frontend) inline model weights to avoid loading them from remote
- ♻️(frontend) inline MediaPipe WASM modules to avoid loading from remote
- ⬆️(frontend) upgrade posthog-js from 1.387.0 to 1.391.2
- ⬆️(frontend) upgrade react-stately from 3.47.0 to 3.48.0
- ⬆️(frontend) upgrade react-aria from 3.49.0 to 3.50.0
- ⬆️(frontend) upgrade react-aria-components from 1.18.0 to 1.19.0
-
-### Fixed
-
- 🩹(backend) identify externally provisioned users to PostHog
- 🐛(backend) fix info panel crash for unregistered rooms
- ♿️(frontend) focus side panel container on open #1452
- 🐛(summary) whisper call error handling
-
-## [1.23.0] - 2026-07-08
-
-### Added
-
- ✨(backend) extend analytics module to support feature flags
- ✨(backend) implement feature flags in Posthog analytics backend
- ✨(agents) report errors to Sentry for all LiveKit agents
-
-### Changed
-
- ⬆️(agents) upgrade to python 3.14 slim
- ⬆️(dependencies) update python dependencies
- 💥(summary) remove v1 related code #1362
- ✨(meet) use compatible with summary v2 #1362
- ♻️(backend) refactor analytics backend from Protocol to abstract class
- 🔥(summary) remove call to summary enabled feature flag
- ♻️(frontend) wrap MuteEveryoneButton with AdminOrOwnerOnly
- ⬆️(frontend) upgrade livekit-client from 2.19.0 to 2.19.2
- ⬆️(frontend) upgrade posthog-js from 1.386.5 to 1.387.0
- ⬆️(frontend) upgrade @tanstack/react-query from 5.100.14 to 5.101.0
- ⬆️(frontend) update the frontend build image to Node 22
- 🔒️(frontend) update docker image to nginx-unprivileged:1.30.3-alpine3.23
- ✨(summary) more precise analytics events
-
-### Fixed
-
- 🚀(front) fix frontend build failure
- 🐛(makefile) fix args in make test
- 🩹(backend) fix case-insensitive email deduplication in merge command
- 🐛(summary) support media files with bad streams #1478
-
-## [1.22.0] - 2026-07-03
-
-### Added
-
- ✨(frontend) cap and paginate tiles in picture-in-picture #1383
- 📝(docs) document rebranding the favicon via a volume mount #1443
- ✨(backend) add command to clean pending and deleted files
- 🧱(helm) run clean files command as cronjob
- ✨(backend) add fallback to save recordings without S3/MinIO webhooks
- 🩹(frontend) enable screen share button in PiP #1458
- 🐛(backend) support unencoded S3 notification object keys #1455
- ✨(frontend) prioritize screen share in picture-in-picture layout #1467
-
-### Changed
-
- ✨(summary) generalized stt api call #1420
- ♻️(env) refactor env variables handling
- 🚸(frontend) use "Advanced" instead of "Premium" in the sidepanel
- ♿️(frontend) make fullscreen share warning keyboard accessible #1459
- ⬆️(summary) update docker alpine to 3.24 & ffmpeg to 8.1.2 #1471
-
-### Fixed
-
- 🛂(backend) reject user access tokens on the API
- 🩹(helm) fix Helm ingress rendering when passing multiple hosts
-
-## [1.21.0] - 2026-06-15
-
-### Added
-
- ✨(frontend) allow disabling silent login via a URL parameter
- ✨(frontend) allow hiding the login button via a URL parameter
- ✨(summary) add optional satisfaction survey footer
-
-### Changed
-
- ✨(frontend) enhance noise reduction with BBBA audio processing pipeline
- 🚸(frontend) mute join notification sound in larger rooms
- 🚸(frontend) mute participants by default when joining a large meeting
-
-### Fixed
-
- 🐛(frontend) fix metadata agent collector enabled check
-
-### Fixed
-
- ♿️(frontend) improve accessibility of the Effects panel #1401
-
-## [1.20.0] - 2026-06-12
-
-### Changed
-
- ♻️(addon) improve Outlook add-on: i18n support, feedback link, smarter link
- ⬆️(frontend) upgrade react-i18next from 15.1.1 to 17.0.8
-
-### Fixed
-
- 🐛(frontend) fix noise reduction left-channel-only audio
-
-## [1.19.0] - 2026-06-04
-
-### Added
-
- ✨(backend) add file specific admin #1387
-
-### Changed
-
- 🐛(agents) fix bug when closing metadata-collector
- ⬆️(dependencies) update python dependencies
- ⬆️(frontend) update js dependencies
- ♻️(agents) replace deprecated room options API
-
-### Fixed
-
- 🔇(summary) make ffmpeg quiet #1404
- 🔒️(backend) prevent accessing files if they are not ready #1395
- # ⬆️(backend) upgrade idna to >=3.15 to address CVE-2026-45409
-
-## [1.18.0] - 2026-06-03
-
-### Added
-
- 🔧(backend) backport logging configuration from docs
- 🧑‍💻(backend) add management command to merge duplicate users
- 👷(helm) add Kubernetes job for duplicate user merge command
-
-### Fixed
-
- 🐛(backend) prevent duplicate pending users on concurrent requests
- 🔒️(backend) prevent file change post checks #1377
-
-## [1.17.0] - 2026-05-31
-
-### Added
-
 - ✨(fullstack) allow participants to mute others based on room configuration
 - ✨(frontend) add synchronizer for room metadata updates
 - ✨(frontend) make reaction toolbar responsive on small viewports
 - ✨(frontend) enable reactions on mobile devices
 - ✨(frontend) introduce picture-in-picture meeting
- ✨(backend) add core.recording.event.parsers.S3Parser
- ✨(summary) extended support for all video / audio files #1358

-### Changed
+### Changed 

 - ♻️(fullstack) simplify source serialization
 - ✨(backend) expose room configuration to all API consumers
 - 🩹(frontend) improve reaction toolbar centering with dynamic positioning
- 🚀 (paas) remove buildpack requirements.txt to use the new uv.lock #1349
- ✨(backend) allow room configuration and access level via external api #1260
- ♻️(backend) prefix Swagger routes with /api
-
-### Fixed
-
- 🩹(backend) fix swagger and redoc documentation URLs

 ## [1.16.0] - 2026-05-13

@@ -1,7 +1,7 @@
 # Django Meet

 # ---- base image to inherit from ----
-FROM python:3.13.15-alpine3.24 AS base
+FROM python:3.13.5-alpine3.21 AS base

 # Upgrade pip to its latest release to speed up dependencies installation
 RUN python -m pip install --upgrade pip
@@ -37,13 +37,14 @@ RUN --mount=type=cache,target=/root/.cache/uv \
  uv sync --locked --no-dev

 # ---- mails ----
-FROM node:22-alpine AS mail-builder
+FROM node:20 AS mail-builder

 COPY ./src/mail /mail/app

 WORKDIR /mail/app

-RUN npm ci --ignore-scripts && npm run build
+RUN yarn install --frozen-lockfile && \
+  yarn build


 # ---- static link collector ----
@@ -39,52 +39,21 @@ DB_PORT            = 5432
 DOCKER_UID          = $(shell id -u)
 DOCKER_GID          = $(shell id -g)
 DOCKER_USER         = $(DOCKER_UID):$(DOCKER_GID)
-COMPOSE                  = DOCKER_USER=$(DOCKER_USER) docker compose
-COMPOSE_EXEC             = $(COMPOSE) exec
-COMPOSE_EXEC_APP         = $(COMPOSE_EXEC) app-dev
-COMPOSE_RUN              = $(COMPOSE) run --rm
-COMPOSE_RUN_APP          = $(COMPOSE_RUN) app-dev
-COMPOSE_RUN_LINT_BACK    = $(COMPOSE_RUN) --no-deps app-dev
-COMPOSE_RUN_LINT_AGENTS  = $(COMPOSE_RUN) --no-deps multi-user-transcriber-dev
-COMPOSE_RUN_LINT_SUMMARY = $(COMPOSE_RUN) --no-deps app-summary-dev
-COMPOSE_RUN_CROWDIN      = $(COMPOSE_RUN) crowdin crowdin
-WAIT_DB                  = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s
+COMPOSE             = DOCKER_USER=$(DOCKER_USER) docker compose
+COMPOSE_EXEC        = $(COMPOSE) exec
+COMPOSE_EXEC_APP    = $(COMPOSE_EXEC) app-dev
+COMPOSE_RUN         = $(COMPOSE) run --rm
+COMPOSE_RUN_APP     = $(COMPOSE_RUN) app-dev
+COMPOSE_RUN_CROWDIN = $(COMPOSE_RUN) crowdin crowdin
+WAIT_DB             = @$(COMPOSE_RUN) dockerize -wait tcp://$(DB_HOST):$(DB_PORT) -timeout 60s

 # -- Backend
 MANAGE              = $(COMPOSE_RUN_APP) python manage.py
 MAIL_NPM            = $(COMPOSE_RUN) -w /app/src/mail node npm

-# -- Linters
-LINT_RUFF_FORMAT    = ruff format .
-LINT_RUFF_CHECK     = ruff check . --fix
-LINT_PYLINT         = pylint meet demo core
-LINT_BACK           = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK) \
-  && echo 'lint:pylint started…' && $(LINT_PYLINT)
-LINT_AGENTS         = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
-LINT_SUMMARY        = echo 'lint:ruff-format started…' && $(LINT_RUFF_FORMAT) \
-  && echo 'lint:ruff-check started…' && $(LINT_RUFF_CHECK)
-
 # -- Frontend
 PATH_FRONT          = ./src/frontend

-# -- Storage
-GARAGE_BUCKET       = meet-media-storage
-STORAGE_FOLDERS     = recordings transcripts summaries
-STORAGE_DIRS        = $(addprefix data/,$(STORAGE_FOLDERS))
-COMPOSE_RUN_AWS     = $(COMPOSE_RUN) --user $(DOCKER_USER)
-AWS_CLI             = garage-cors --endpoint-url=http://garage:9000
-# Extensions listed in each folder (skips the Egress manifests in recordings/)
-recordings_EXTENSIONS  = mp4 ogg
-transcripts_EXTENSIONS = json
-summaries_EXTENSIONS   = txt
-# $(1): folder. Lists its objects with a known extension, most recent first
-storage_list        = s3api list-objects-v2 --bucket $(GARAGE_BUCKET) \
-  --prefix $(1)/
-storage_query       = reverse(sort_by(Contents[?$(foreach ext,$($(1)_EXTENSIONS), \
-  ends_with(Key, `".$(ext)"`) ||) `false`] || `[]`, &LastModified))
-
 # ==============================================================================
 # RULES

@@ -93,9 +62,6 @@ default: help
 data/media:
 	@mkdir -p data/media

-$(STORAGE_DIRS):
-	@mkdir -p $@
-
 data/static:
 	@mkdir -p data/static

@@ -104,14 +70,12 @@ data/static:
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
-	env.d/development/garage \
 	env.d/development/crowdin \
 	env.d/development/postgresql \
 	env.d/development/kc_postgresql \
 	env.d/development/summary \
 	env.d/development/kube-secret \
-	env.d/development/multi_user_transcriber \
-	env.d/development/metadata_collector
+	env.d/development/multi_user_transcriber
 .PHONY: create-env-files

 bootstrap: ## Prepare Docker images for the project
@@ -159,7 +123,6 @@ logs: ## display app-dev logs (follow mode)
 run-backend: ## start only the backend application and all needed services
 	@$(COMPOSE) up --force-recreate -d celery-dev --remove-orphans
 	@$(COMPOSE) up --force-recreate -d nginx
-	@$(COMPOSE) up -d livekit
 	@echo "Wait for postgresql to be up..."
 	@$(WAIT_DB)
 .PHONY: run-backend
@@ -224,58 +187,47 @@ demo: ## flush db then create a demo for load testing purpose
 	@$(MANAGE) create_demo
 .PHONY: demo

-lint: ## lint all python sources (back-end, agents, summary)
-	@$(MAKE) lint-back
-	@$(MAKE) lint-agents
-	@$(MAKE) lint-summary
+# Nota bene: Black should come after isort just in case they don't agree...
+lint: ## lint back-end python sources
+lint: \
+  lint-ruff-format \
+  lint-ruff-check \
+  lint-pylint
 .PHONY: lint

-lint-back: ## lint back-end python sources
-	@$(COMPOSE_RUN_LINT_BACK) sh -c "$(LINT_BACK)"
-.PHONY: lint-back
-
-lint-agents: ## lint agents python sources
-	@$(COMPOSE_RUN_LINT_AGENTS) sh -c "$(LINT_AGENTS)"
-.PHONY: lint-agents
-
-lint-summary: ## lint summary python sources
-	@$(COMPOSE_RUN_LINT_SUMMARY) sh -c "$(LINT_SUMMARY)"
-.PHONY: lint-summary
-
 lint-ruff-format: ## format back-end python sources with ruff
 	@echo 'lint:ruff-format started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_FORMAT)
+	@$(COMPOSE_RUN_APP) ruff format .
 .PHONY: lint-ruff-format

 lint-ruff-check: ## lint back-end python sources with ruff
 	@echo 'lint:ruff-check started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_RUFF_CHECK)
+	@$(COMPOSE_RUN_APP) ruff check . --fix
 .PHONY: lint-ruff-check

 lint-pylint: ## lint back-end python sources with pylint only on changed files from main
 	@echo 'lint:pylint started…'
-	@$(COMPOSE_RUN_LINT_BACK) $(LINT_PYLINT)
+	@$(COMPOSE_RUN_APP) pylint meet demo core
 .PHONY: lint-pylint

-test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
-	$(MAKE) test-back-parallel ARGS="$${args}" && \
-	$(MAKE) test-summary ARGS="$${args}"
+test: ## run project tests
+	@$(MAKE) test-back-parallel
+	@$(MAKE) test-summary
 .PHONY: test

-test-back: ## run back-end tests (pass extra pytest args via ARGS)
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest $${args}
+test-back: ## run back-end tests
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest $${args:-${1}}
 .PHONY: test-back

-test-back-parallel: ## run all back-end tests in parallel (pass extra pytest args via ARGS)
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest -n auto $${args}
+test-back-parallel: ## run all back-end tests in parallel
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest -n auto $${args:-${1}}
 .PHONY: test-back-parallel

-test-summary: ## run summary tests (pass extra pytest args via ARGS)
-	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
-	bin/pytest-summary $${args}
+test-summary: ## run summary tests
+	@args="$(filter-out $@,$(MAKECMDGOALS))" && \
+	bin/pytest-summary $${args:-${1}}
 .PHONY: test-summary

 makemigrations:  ## run django makemigrations for the Meet project.
@@ -312,7 +264,7 @@ shell: ## connect to database shell
 # -- Database

 dbshell: ## connect to database shell
-	@$(COMPOSE_EXEC_APP) python manage.py dbshell
+	docker compose exec app-dev python manage.py dbshell
 .PHONY: dbshell

 resetdb: FLUSH_ARGS ?=
@@ -337,38 +289,9 @@ env.d/development/summary:
 env.d/development/kube-secret:
 	cp -n env.d/development/kube-secret.dist env.d/development/kube-secret

-env.d/development/garage:
-	sed "s/^GARAGE_RPC_SECRET=.*/GARAGE_RPC_SECRET=$$(openssl rand -hex 32)/" \
-		env.d/development/garage.dist > env.d/development/garage
-
 env.d/development/multi_user_transcriber:
 	cp -n env.d/development/multi_user_transcriber.dist env.d/development/multi_user_transcriber

-env.d/development/metadata_collector:
-	cp -n env.d/development/metadata_collector.dist env.d/development/metadata_collector
-
-# -- Storage
-
-recordings-download-latest: ## download the latest recording from Garage into data/recordings
-transcripts-download-latest: ## download the latest transcript from Garage into data/transcripts
-summaries-download-latest: ## download the latest summary from Garage into data/summaries
-$(STORAGE_FOLDERS:%=%-download-latest): %-download-latest: data/%
-	@key=$$($(COMPOSE_RUN_AWS) -T $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[0].Key' --output text) && \
-	if [ "$$key" = "None" ]; then echo "No $* found"; exit 1; fi && \
-	$(COMPOSE_RUN_AWS) --volume $(CURDIR)/data/$*:/aws/data/$* \
-		$(AWS_CLI) s3 cp "s3://$(GARAGE_BUCKET)/$$key" data/$*/
-.PHONY: $(STORAGE_FOLDERS:%=%-download-latest)
-
-recordings-list: ## list recordings stored in Garage, most recent first
-transcripts-list: ## list transcripts stored in Garage, most recent first
-summaries-list: ## list summaries stored in Garage, most recent first
-$(STORAGE_FOLDERS:%=%-list): %-list:
-	@$(COMPOSE_RUN_AWS) $(AWS_CLI) $(call storage_list,$*) \
-		--query '$(call storage_query,$*)[].{Date: LastModified, Key: Key, "Size (bytes)": Size}' \
-		--output table
-.PHONY: $(STORAGE_FOLDERS:%=%-list)
-
 # -- Internationalization

 env.d/development/crowdin:
@@ -12,10 +12,7 @@
  <img alt="GitHub closed issues" src="https://img.shields.io/github/issues-closed/suitenumerique/meet"/>
  <a href="https://github.com/suitenumerique/meet/blob/main/LICENSE">
    <img alt="GitHub closed issues" src="https://img.shields.io/github/license/suitenumerique/meet"/>
-  </a>
-  <a href="https://digitalpublicgoods.net/r/la-suite-meet-simple-video-conferencing">
-    <img src="https://img.shields.io/badge/Verified-DPG-3333AB?logo=data:image/svg%2bxml;base64,PHN2ZyB3aWR0aD0iMzEiIGhlaWdodD0iMzMiIHZpZXdCb3g9IjAgMCAzMSAzMyIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTE0LjIwMDggMjEuMzY3OEwxMC4xNzM2IDE4LjAxMjRMMTEuNTIxOSAxNi40MDAzTDEzLjk5MjggMTguNDU5TDE5LjYyNjkgMTIuMjExMUwyMS4xOTA5IDEzLjYxNkwxNC4yMDA4IDIxLjM2NzhaTTI0LjYyNDEgOS4zNTEyN0wyNC44MDcxIDMuMDcyOTdMMTguODgxIDUuMTg2NjJMMTUuMzMxNCAtMi4zMzA4MmUtMDVMMTEuNzgyMSA1LjE4NjYyTDUuODU2MDEgMy4wNzI5N0w2LjAzOTA2IDkuMzUxMjdMMCAxMS4xMTc3TDMuODQ1MjEgMTYuMDg5NUwwIDIxLjA2MTJMNi4wMzkwNiAyMi44Mjc3TDUuODU2MDEgMjkuMTA2TDExLjc4MjEgMjYuOTkyM0wxNS4zMzE0IDMyLjE3OUwxOC44ODEgMjYuOTkyM0wyNC44MDcxIDI5LjEwNkwyNC42MjQxIDIyLjgyNzdMMzAuNjYzMSAyMS4wNjEyTDI2LjgxNzYgMTYuMDg5NUwzMC42NjMxIDExLjExNzdMMjQuNjI0MSA5LjM1MTI3WiIgZmlsbD0id2hpdGUiLz4KPC9zdmc+Cg==" alt="DPG Badge"/>
-  </a>
+  </a>    
 </p>

 <p align="center">
@@ -31,14 +28,6 @@
 ## La Suite Meet: Simple Video Conferencing

 Powered by [LiveKit](https://livekit.io/), La Suite Meet offers Zoom-level performance with high-quality video and audio. No installation required—simply join calls directly from your browser. Check out LiveKit's impressive optimizations in their [blog post](https://blog.livekit.io/livekit-one-dot-zero/).
-
-> [!TIP]
-> New here? Start by introducing yourself in our Matrix channel:
-> **https://matrix.to/#/#meet-official:matrix.org**
->
-> We’re happy to discuss ideas, answer questions, and help to deploy LaSuite Meet.
-
-
 ### Features
 - Optimized for stability in large meetings (+100 p.)
 - Support for multiple screen sharing streams
@@ -63,7 +52,7 @@ We’re continuously adding new features to enhance your experience, with the la

 ### 🚀 Major roll out to all French public servants

-On the 29th of January 2026, Prime Minister Sébastien Lecornu, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in English](https://www.nytimes.com/2026/01/29/world/europe/france-zoom-alternative-visio.html))
+On the 25th of January 2026, David Amiel, France’s Minister for Civil Service and State Reform, announced the full deployment of Visio—the French government’s dedicated Meet platform—to all public servants. ([Source in French](https://www.latribune.fr/article/la-tribune-dimanche/politique/73157688099661/david-amiel-ministre-delegue-de-la-fonction-publique-nous-allons-sortir-de-la-dependance-aux-outils-americains))

 ## Table of Contents

@@ -95,57 +84,22 @@ We use Kubernetes for our [production instance](https://visio.numerique.gouv.fr/
 #### Known instances
 We hope to see many more, here is an incomplete list of public La Suite Meet instances. Feel free to make a PR to add ones that are not listed below🙏

-| Url                                                           | Org          | Access                                                                                                                                        |
-|---------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
-| [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM        | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up     |
-| [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT         | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up |
-| [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop | Free and open demo to all. Content and accounts are reset after one month                                                                     |
-| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud   | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps.                                                         |
-| [Clever Cloud](https://www.clever.cloud/product/visio/)       | clever cloud | Openvisio is a sovereign video conferencing solution based on LaSuite Meet offered by [Clever Cloud](https://www.clever.cloud/).              |
-| [Email.eu](https://email.eu/)                                 | Email.eu     | Sovereign business workspace.                                                                                                                 |
+| Url                                                           | Org | Access |
+|---------------------------------------------------------------| --- | ------- |
+| [visio.numerique.gouv.fr](https://visio.numerique.gouv.fr/)   | DINUM    | French public agents working for the central administration and the extended public sphere. ProConnect is required to login in or sign up|
+| [visio.suite.anct.gouv.fr](https://visio.suite.anct.gouv.fr/) | ANCT    | French public agents working for the territorial administration and the extended public sphere. ProConnect is required to login in or sign up|
+| [visio.lasuite.coop](https://visio.lasuite.coop/)             | lasuite.coop    | Free and open demo to all. Content and accounts are reset after one month |
+| [mosacloud.cloud](https://mosa.cloud/)                        | mosa.cloud    | Demo instance of mosa.cloud, a dutch company providing services around La Suite apps. |


-# Contributing
+## Contributing

-We <3 contributions of all kinds **big or small** and we’re genuinely glad you’re here. 🌱
+We <3 contributions of any kind, big and small:

-### Start by saying hi
+- Vote on features or get early access to beta functionality in our [roadmap](https://github.com/orgs/suitenumerique/projects/11/views/4)
+- Open a PR (see our instructions on [developing La Suite Meet locally](https://github.com/suitenumerique/meet/blob/main/docs/developping_locally.md))
+- Submit a [feature request](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=enhancement&template=Feature_request.md) or [bug report](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md)

-**The best first contribution is simply to come say hi.**
-
-Before opening a PR, especially a larger one, or one written with the help of AI, we encourage you to reach out to a maintainer on our [Matrix channel](https://matrix.to/#/#meet-official:matrix.org) (@antoine.lebaud:matrix.org).
-
-Getting in touch early helps us align on goals, avoid duplicated or wasted effort, and build a community that stays active, welcoming, and fun to be part of. There are no silly questions here: whether you’ve shipped hundreds of PRs or you’re just getting started, you’re welcome.
-
-### AI contributions
-
-AI-assisted contributions are welcome. But code is never the end goal. What matters most is building relationships, sharing knowledge, and growing a sustainable community over time.
-
-If your contribution has been heavily generated with AI, please be transparent about it. This helps maintainers review it with the right context and respects the time they invest in the project.
-
-Using AI does not transfer ownership of the contribution: you should still fully understand the code, the problem it solves, and the reasoning behind the approach you propose. In short, even if AI helped write it, the why should still be yours.
-
-### Contributions beyond code
-
-**Not technical? We need you too.**
-Open source is much more than code. Writing documentation, improving onboarding, translating content, answering questions, reporting bugs, or simply helping others feel welcome all make a huge difference.
-
-### Ways to contribute
-
-When you’re ready, here are a few ways to get involved:
-
-* 👋 **Say hello** and share your ideas with the community and maintainers on our [Matrix channel](https://matrix.to/#/#meet-official:matrix.org)
-* 🛠️ **Open a PR** by following our guide to [develop La Suite Meet locally](https://github.com/suitenumerique/meet/blob/main/docs/developping_locally.md)
-* 💡 **Suggest an idea** by opening a [feature request](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=enhancement&template=Feature_request.md)
-* 🐛 **Report a bug** by opening a [bug report](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md)
-
-Thank you for helping build something open, useful, and human. 💙
-
-### Community call
-
-We host a community call on the first Friday of every month to share updates, discuss ideas, and connect with contributors.
-
-Whether you’re actively contributing or just curious about the project, you’re welcome to join. More details are shared on the [Matrix channel](https://matrix.to/#/#meet-official:matrix.org).

 ## Philosophy

@@ -4,7 +4,7 @@

 Security is very important to us.

-If you have any issue regarding security, please disclose the information responsibly by submitting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at visio@numerique.gouv.fr
+If you have any issue regarding security, please disclose the information responsibly submiting [this form](https://vdp.numerique.gouv.fr/p/Send-a-report?lang=en) and not by creating an issue on the repository. You can also email us at visio@numerique.gouv.fr

 We appreciate your effort to make Visio more secure.

@@ -15,72 +15,3 @@ the following command inside your docker container:
 (Note : in your development environment, you can `make migrate`.)

 ## [Unreleased]
-
-### Purging inactive rooms
-
-Rooms now keep track of the last time they were started (`last_started_at`), fed by LiveKit's `room_started` webhook. A new `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for `ROOM_INACTIVITY_DELETION_DAYS` days. See [the room purge documentation](docs/features/room-purge.md).
-
- The feature is **disabled by default**: nothing is deleted unless you set `ROOM_INACTIVITY_DELETION_DAYS`.
- The migration marks every existing room as started at the time of the upgrade, so no existing room can be purged before a full inactivity period has elapsed after upgrading.
- Rooms holding a saved recording their users may still access are kept: any saved recording, or, when `RECORDING_EXPIRATION_DAYS` is set, a saved recording created within that window.
- Inactivity is measured from LiveKit's `room_started` webhook: if it is not delivered to your backend, rooms in daily use look inactive and get purged.
- When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
-
-### Local development: MinIO replaced by Garage
-
-The development stacks now use [Garage](https://garagehq.deuxfleurs.fr/) instead of MinIO as S3 storage. Garage keeps its own format in `data/media/meta` and `data/media/data` and cannot read what MinIO left there, so local recordings and files will be lost.
-
-To migrate a local environment:
-
-1. Stop the stack and remove its containers, including the former `minio` one: `docker compose down --remove-orphans`
-2. Optionally reclaim the space used by MinIO: `rm -rf data/media && make data/media`
-3. In your `env.d/development/*` files, replace `minio:9000` by `garage:9000`, the `meet` / `password` credentials by `meet-access-key` / `meet-secret-access-key`, and add `AWS_S3_REGION_NAME=local` (or delete these files and run `make create-env-files`)
-4. Run `make create-env-files` to generate `env.d/development/garage`, which holds a random RPC secret for Garage.
-5. Rebuild the images, since the summary and agent images now install boto3 instead of minio
-
-### Summary service and metadata collector: boto3 replaces the minio client
-
-The summary service and the metadata collector agent now talk to S3 through boto3 instead of the minio client, with the same settings.
-Requests are now signed for `AWS_S3_REGION_NAME` as-is. When it is not set, the region is no longer looked up from the bucket: boto3 falls back to `AWS_DEFAULT_REGION`, then to `us-east-1`. If you left `AWS_S3_REGION_NAME` unset, set it to your provider's region before upgrading, or providers that check the signing region will reject the transcripts, summaries and meeting metadata uploads, as well as their signed URLs.
-
-Also:
- Signed URLs to transcripts and summaries are now always path-style (`<endpoint>/<bucket>/<key>`), whereas the minio client used virtual-hosted-style URLs
- The metadata collector now accepts `AWS_S3_ENDPOINT_URL` with or without a scheme, like the summary service: the scheme always follows `AWS_S3_SECURE_ACCESS`.
-
-### Helm chart: media services default to Garage
-
-The `meet` chart now defaults `serviceMedia.host` and `serviceMediaFiles.host` to `garage.meet.svc.cluster.local`, and the `upstream-vhost` annotation of `ingressMedia` and `ingressMediaFiles` to `garage.meet.svc.cluster.local:9000`. If you relied on the former `minio.meet.svc.cluster.local` defaults, set these values explicitly to your S3 service before upgrading, or recordings and files stop being served under `/media`.
-
-## v1.30.0
-
-### Removing S3 storage-event webhooks for recordings
-
-Recordings were previously confirmed as saved by an S3 storage-event webhook posting to `/api/v1.0/recordings/storage-hook/`. That endpoint has been removed: recordings are now always finalized from LiveKit's own `egress_ended` webhook, which has been the default path since v1.22.0.
-
-**Required for every deployment:** LiveKit must be able to deliver webhooks to the backend at `/api/v1.0/rooms/webhooks-livekit/`. This is now the only way a recording reaches a saved state; if `egress_ended` is never delivered, recordings stay in the `active` state.
-
-For hosters who had configured storage-event webhooks:
- Recordings reach the same final state, but they are now finalized when LiveKit reports the egress as ended rather than when the storage backend reports the upload.
- Remove the event notification from your bucket configuration: it now targets a non-existent endpoint and will fail on every delivery.
-
-For hosters who had **not** configured storage-event webhooks:
- Nothing changes. Recordings have been finalized from the `egress_ended` webhook since v1.22.0.
-
-In both cases, the following settings are no longer used and can be removed from your env: `RECORDING_EVENT_PARSER_CLASS`, `RECORDING_ENABLE_STORAGE_EVENT_AUTH`, `RECORDING_STORAGE_EVENT_ENABLE`, `RECORDING_STORAGE_EVENT_TOKEN`.
-
-On completion of the egress, a recording moves to `notification_succeeded`, or to `saved` if notifying external services failed.
-
-## v1.23.0
-
-As part of the 1.23.0 release, the legacy `api/v1` implementation has been removed from the _experimental_ Summary service and Meet has been migrated to the new `api/v2`.
-
-**To avoid a breaking change, the Meet backend continues to use the Summary service's v1-compatible API format by default (`SUMMARY_SERVICE_VERSION` setting defaults to `1`).**
-
-If you are deploying both Meet and Summary from this repository, you must configure the Meet backend to use the v2 API by setting the following environment variable `SUMMARY_SERVICE_VERSION=2`.
-
-If you are upgrading only the Meet deployment while keeping an older Summary v1 compatible deployment, no action is required, as the v1-compatible API remains the default.
-
-Note that we plan on removing the legacy `v1` summary compatibility in a future major version. If you have your own implementation for the summary service, we recommend updating its API contract and setting `SUMMARY_SERVICE_VERSION=2`.
@@ -23,8 +23,8 @@ docker_build(
    live_update=[
        sync('../src/backend', '/app'),
        run(
-            'uv sync --locked --no-dev',
-            trigger=['../src/backend/uv.lock', '../src/backend/pyproject.toml']
+            'pip install -r /app/requirements.txt',
+            trigger=['./api/requirements.txt']
        )
    ]
 )
@@ -104,26 +104,17 @@ k8s_yaml(secret_yaml_generic(

 k8s_yaml(local('cd ../src/helm && helmfile -n meet -e ${DEV_ENV:-dev-keycloak} template .'))

-k8s_resource('garage-cors', resource_deps=['garage'])
-k8s_resource('meet-backend', resource_deps=['postgresql', 'garage-cors', 'redis', 'livekit-livekit-server'])
+k8s_resource('minio-bucket', resource_deps=['minio'])
+k8s_resource('meet-backend', resource_deps=['postgresql', 'minio', 'redis', 'livekit-livekit-server'])
 k8s_resource('meet-celery-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-summarize', resource_deps=['redis'])
 k8s_resource('meet-celery-summary-backend', resource_deps=['redis'])
 k8s_resource('meet-celery-transcribe-default', resource_deps=['redis'])
+k8s_resource('meet-backend-migrate', resource_deps=['meet-backend'])
 k8s_resource('livekit-livekit-server', resource_deps=['redis'])
 k8s_resource('livekit-livekit-server-test-connection', resource_deps=['livekit-livekit-server'])
 k8s_resource('keycloak', resource_deps=['kc-postgresql'])
-# Trigger once on launch
-k8s_resource(
-    'meet-backend-createsuperuser',
-    resource_deps=['meet-backend-migrate'],
-    trigger_mode=TRIGGER_MODE_MANUAL,
-)
-k8s_resource(
-    'meet-backend-migrate',
-    resource_deps=['meet-backend'],
-    trigger_mode=TRIGGER_MODE_MANUAL,
-)
+k8s_resource('meet-backend-createsuperuser', resource_deps=['meet-backend-migrate'])

 migration = '''
 set -eu
@@ -5,7 +5,7 @@ set -eo pipefail
 REPO_DIR="$(cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd)"
 UNSET_USER=0

-export COMPOSE_FILE="${COMPOSE_FILE:-${REPO_DIR}/compose.yml}"
+COMPOSE_FILE="${REPO_DIR}/compose.yml"
 COMPOSE_PROJECT="meet"


@@ -42,6 +42,7 @@ function _docker_compose() {
    echo "🐳(compose) project: '${COMPOSE_PROJECT}' file: '${COMPOSE_FILE}'"
    docker compose \
        -p "${COMPOSE_PROJECT}" \
+        -f "${COMPOSE_FILE}" \
        --project-directory "${REPO_DIR}" \
        "$@"
 }
@@ -55,12 +56,12 @@ function _docker_compose() {
 function _dc_run() {
    _set_user

-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
    fi

-    _docker_compose run --rm "${user_args[@]}" "$@"
+    _docker_compose run --rm $user_args "$@"
 }

 # _dc_exec: wrap docker compose exec command
@@ -74,12 +75,12 @@ function _dc_exec() {

    echo "🐳(compose) exec command: '\$@'"

-    user_args=()
-    if [ -n "$USER_ID" ]; then
-        user_args=("--user=$USER_ID")
+    user_args="--user=$USER_ID"
+    if [ -z $USER_ID ]; then
+        user_args=""
    fi

-    _docker_compose exec "${user_args[@]}" "$@"
+    _docker_compose exec $user_args "$@"
 }

 # _django_manage: wrap django's manage.py command with docker compose
@@ -40,10 +40,11 @@ if [ -n "$CUSTOM_LOGO_URL" ]; then
    [[ "$IS_SVG" == false ]] && echo "[custom-logo] ERROR: not a valid SVG file" >&2 && exit 1

    mv -f "$TMP_FILE" "$LOGO_FILE"
-    echo "[custom-logo] INFO: Custom logo downloaded successfully"
+    echo "[custom-logo] INFO: Custom logo downloaded successfuly"
 fi

 mv src/backend/* ./
 mv deploy/paas/* ./

 echo "3.13" > .python-version
+echo "." > requirements.txt
@@ -7,7 +7,7 @@ gunicorn -b 0.0.0.0:8000 meet.wsgi:application --log-file - &
 bin/run &

 # if the current shell is killed, also terminate all its children     
-trap 'pkill -TERM -P $$' SIGTERM
+trap "pkill SIGTERM -P $$" SIGTERM

 # wait for a single child to finish,
 wait -n
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# shellcheck source=bin/_config.sh
+source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
+
+_docker_compose "$@"
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -o errexit

+CURRENT_DIR=$(pwd)
 NAMESPACE=${1:-meet}
 SECRET_NAME=${2:-bitwarden-cli-meet}
 TEMP_SECRET_FILE=$(mktemp)
@@ -29,10 +30,10 @@ check_secret_exists() {
 # Collect user input securely
 get_user_input() {
    echo "Please provide the following information:"
-    read -r -p "Enter your Vaultwarden email login: " LOGIN
-    read -r -s -p "Enter your Vaultwarden password: " PASSWORD
+    read -p "Enter your Vaultwarden email login: " LOGIN
+    read -s -p "Enter your Vaultwarden password: " PASSWORD
    echo
-    read -r -p "Enter your Vaultwarden server url: " URL
+    read -p "Enter your Vaultwarden server url: " URL
 }

 # Create and apply the secret
@@ -76,7 +77,7 @@ main() {
        exit 0
    fi

-    echo -e "${TEMP_SECRET_FILE}"
+    echo -e ${TEMP_SECRET_FILE}

    get_user_input
    echo -e "\nCreating Vaultwarden secret…"
@@ -3,7 +3,7 @@
 mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
 PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"

-cat <<'EOF' >"$PRE_COMMIT_FILE"
+cat <<'EOF' >$PRE_COMMIT_FILE
 #!/bin/bash

 # directories containing potential secrets
@@ -27,4 +27,4 @@ for d in $DIRS; do
 done
 EOF

-chmod +x "$PRE_COMMIT_FILE"
+chmod +x $PRE_COMMIT_FILE
@@ -68,7 +68,7 @@ fi

 # Ask user for release version number
 echo ""
-read -r -p "Enter release version number (e.g., 1.2.3): " VERSION
+read -p "Enter release version number (e.g., 1.2.3): " VERSION

 # Validate version format (basic semver check)
 if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -110,21 +110,9 @@ cd -
 # Update summary pyproject.toml
 update_python_version "summary"

-# Run uv lock in summary
-print_info "Running uv lock in summary..."
-cd "src/summary"
-uv lock
-cd -
-
 # Update agents pyproject.toml
 update_python_version "agents"

-# Run uv lock in agents
-print_info "Running uv lock in agents..."
-cd "src/agents"
-uv lock
-cd -
-
 # Update CHANGELOG
 print_info "Updating CHANGELOG..."

@@ -169,9 +157,7 @@ echo "      - src/mail/package.json"
 echo "      - src/backend/pyproject.toml"
 echo "      - src/backend/uv.lock"
 echo "      - src/summary/pyproject.toml"
-echo "      - src/summary/uv.lock"
 echo "      - src/agents/pyproject.toml"
-echo "      - src/agents/uv.lock"
 echo "      - CHANGELOG.md"
 echo ""
 print_warning "Next steps:"
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash

 git submodule update --init --recursive
-# shellcheck disable=SC2016
 git submodule foreach 'git fetch origin; git checkout $(git rev-parse --abbrev-ref HEAD); git reset --hard origin/$(git rev-parse --abbrev-ref HEAD); git submodule update --recursive; git clean -dfx'
@@ -8,6 +8,6 @@ environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=

 for env in $environments; do
 	echo "################### $env lint ###################"
-	helmfile -e "$env" -f src/helm/helmfile.yaml lint || exit 1
+	helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
 	echo -e "\n"
 done
@@ -15,44 +15,51 @@ services:
    ports:
      - "1081:1080"

-  garage:
+  minio:
    user: ${DOCKER_USER:-1000}
-    image: dxflrs/garage:v2.4.1
-    command: /garage server --single-node --default-bucket
-    env_file:
-      - env.d/development/garage
+    image: minio/minio
    environment:
-      - GARAGE_DEFAULT_ACCESS_KEY=meet-access-key
-      - GARAGE_DEFAULT_SECRET_KEY=meet-secret-access-key
-      - GARAGE_DEFAULT_BUCKET=meet-media-storage
+      - MINIO_ROOT_USER=meet
+      - MINIO_ROOT_PASSWORD=password
    ports:
-      - '127.0.0.1:9000:9000'
+      - '9000:9000'
+      - '9001:9001'
    healthcheck:
-      test: [ "CMD", "/garage", "health" ]
+      test: [ "CMD", "mc", "ready", "local" ]
      interval: 1s
      timeout: 20s
      retries: 300
+    entrypoint: ""
+    command: minio server --console-address :9001 /data
    volumes:
-      - ./docker/files/etc/garage/garage.toml:/etc/garage.toml:ro
-      - ./data/media:/var/lib/garage
+      - ./data/media:/data

-  # Garage denies cross-origin requests by default: allow the frontend to upload files
-  garage-cors:
-    image: amazon/aws-cli:2.37.1
-    environment:
-      - AWS_ACCESS_KEY_ID=meet-access-key
-      - AWS_SECRET_ACCESS_KEY=meet-secret-access-key
-      - AWS_DEFAULT_REGION=local
+  createbuckets:
+    image: minio/mc
    depends_on:
-      garage:
+      minio:
        condition: service_healthy
        restart: true
-    command:
-      - s3api
-      - put-bucket-cors
-      - --endpoint-url=http://garage:9000
-      - --bucket=meet-media-storage
-      - '--cors-configuration={"CORSRules": [{"AllowedOrigins": ["http://localhost:3000"], "AllowedMethods": ["GET", "HEAD", "PUT"], "AllowedHeaders": ["*"], "ExposeHeaders": ["ETag"]}]}'
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password && \
+      /usr/bin/mc mb meet/meet-media-storage && \
+      exit 0;"
+
+  createwebhook:
+    image: minio/mc
+    depends_on:
+      minio:
+        condition: service_healthy
+        restart: true
+    entrypoint: >
+      sh -c "
+      /usr/bin/mc alias set meet http://minio:9000 meet password &&
+      /usr/bin/mc admin config set meet notify_webhook:meet-webhook endpoint='http://app-dev:8000/api/v1.0/recordings/storage-hook/' auth_token='Bearer password' &&
+      /usr/bin/mc admin service restart meet --wait --json &&
+      sleep 15 &&
+      /usr/bin/mc event add meet/meet-media-storage arn:minio:sqs::meet-webhook:webhook --event put --prefix "recordings" &&
+      exit 0;"

  app-dev:
    build:
@@ -78,17 +85,19 @@ services:
        - postgresql
        - mailcatcher
        - redis
-        - garage-cors
+        - livekit
+        - createbuckets
+        - createwebhook
    extra_hosts:
      - "127.0.0.1.nip.io:host-gateway"
    networks:
      - resource-server
      - default
-
+  
  celery-dev:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-development
-    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG", "--pool=solo"]
+    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "DEBUG"]
    environment:
      - DJANGO_CONFIGURATION=Development
    env_file:
@@ -118,12 +127,12 @@ services:
      - postgresql
      - redis
      - livekit
-      - garage
+      - minio

  celery:
    user: ${DOCKER_USER:-1000}
    image: meet:backend-production
-    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO", "--pool=solo"]
+    command: ["celery", "-A", "meet.celery_app", "worker", "-l", "INFO"]
    environment:
      - DJANGO_CONFIGURATION=Demo
    env_file:
@@ -172,7 +181,7 @@ services:
    working_dir: /app

  node:
-    image: node:22-alpine
+    image: node:18
    user: "${DOCKER_USER:-1000}"
    environment:
      HOME: /tmp
@@ -215,14 +224,12 @@ services:
      - kc_postgresql

  livekit:
-    image: livekit/livekit-server:v1.13.6
+    image: livekit/livekit-server
    entrypoint: /livekit-server --dev --bind 0.0.0.0 --config ./config.yaml
    ports:
      - "7880:7880"
      - "7881:7881"
      - "7882:7882/udp"
-      - "3478:3478/udp"
-      - "30000-30100:30000-30100/udp"
    volumes:
      - ./docker/livekit/config/livekit-server.yaml:/config.yaml
    depends_on:
@@ -230,29 +237,35 @@ services:
      - livekit-egress

  livekit-egress:
-    image: livekit/egress:v1.11.0
-    environment:
-      EGRESS_CONFIG_FILE: ./livekit-egress.yaml
-    volumes:
-      - ./docker/livekit/config/livekit-egress.yaml:/livekit-egress.yaml
-      - ./docker/livekit/out:/out
-    depends_on:
-      - redis
+      image: livekit/egress:v1.11.0
+      environment:
+        EGRESS_CONFIG_FILE: ./livekit-egress.yaml
+      volumes:
+        - ./docker/livekit/config/livekit-egress.yaml:/livekit-egress.yaml
+        - ./docker/livekit/out:/out
+      depends_on:
+        - redis

  metadata-collector-dev:
    build:
      context: ./src/agents
      target: development
-    user: ${DOCKER_USER:-1000}
    command: ["python", "metadata_collector.py", "dev"]
-    env_file:
-      - env.d/development/metadata_collector
+    environment:
+      - LIVEKIT_URL=ws://livekit:7880
+      - LIVEKIT_API_KEY=devkey
+      - LIVEKIT_API_SECRET=secret
+      - AWS_S3_ENDPOINT_URL=minio:9000
+      - AWS_S3_ACCESS_KEY_ID=meet
+      - AWS_S3_SECRET_ACCESS_KEY=password
+      - AWS_STORAGE_BUCKET_NAME=meet-media-storage
+      - AWS_S3_SECURE_ACCESS=False
    volumes:
      - ./src/agents:/app
      - /app/.venv
    depends_on:
      - livekit
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -262,8 +275,6 @@ services:
    build:
      context: ./src/agents
      target: development
-    user: ${DOCKER_USER:-1000}
-    command: ["python", "multi_user_transcriber.py", "dev"]
    env_file:
      - env.d/development/multi_user_transcriber
    volumes:
@@ -271,7 +282,7 @@ services:
      - /app/.venv

  redis-summary:
-    image: redis:5
+    image: redis
    ports:
      - "6379:6379"

@@ -297,7 +308,7 @@ services:
      context: ./src/summary
      dockerfile: Dockerfile
      target: production
-    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q transcribe-queue-v2
+    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q transcribe-queue
    env_file:
      - env.d/development/summary
    volumes:
@@ -305,7 +316,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -317,7 +328,7 @@ services:
      context: ./src/summary
      dockerfile: Dockerfile
      target: production
-    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q summarize-queue-v2
+    command: celery -A summary.core.celery_worker worker --pool=solo --loglevel=debug -Q summarize-queue
    env_file:
      - env.d/development/summary
    volumes:
@@ -325,7 +336,7 @@ services:
    depends_on:
      - redis-summary
      - app-summary-dev
-      - garage
+      - minio
    develop:
      watch:
        - action: rebuild
@@ -1,47 +0,0 @@
-{
-  "nodes": {
-    "devenv": {
-      "locked": {
-        "dir": "src/modules",
-        "lastModified": 1778705847,
-        "narHash": "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=",
-        "ref": "refs/tags/v2.1.2",
-        "rev": "ea3d94ac9d6bf6a1313773170122ca4e2ef5a0be",
-        "revCount": 6569,
-        "type": "git",
-        "url": "https://github.com/cachix/devenv"
-      },
-      "original": {
-        "dir": "src/modules",
-        "ref": "refs/tags/v2.1.2",
-        "type": "git",
-        "url": "https://github.com/cachix/devenv"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1789542786,
-        "narHash": "sha256-ajQuqcxnj6RYnwCjA/9FTCnrdR2+BDzstE8UembXf60=",
-        "ref": "nixos-26.05",
-        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
-        "shallow": true,
-        "type": "git",
-        "url": "https://github.com/NixOS/nixpkgs"
-      },
-      "original": {
-        "ref": "nixos-26.05",
-        "shallow": true,
-        "type": "git",
-        "url": "https://github.com/NixOS/nixpkgs"
-      }
-    },
-    "root": {
-      "inputs": {
-        "devenv": "devenv",
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
@@ -1,265 +0,0 @@
-# =============================================================================
-#  devenv.nix — La Suite Meet ("Visio") developer environment
-# =============================================================================
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-
-let
-  python = pkgs.python313;
-  nodejs = pkgs.nodejs_22;
-
-  backendDir = "src/backend";
-  agentsDir = "src/agents";
-  summaryDir = "src/summary";
-  frontendDir = "src/frontend";
-
-  readDotEnv =
-    file:
-    let
-      lines = lib.splitString "\n" (builtins.readFile file);
-      unquote =
-        v:
-        let
-          len = builtins.stringLength v;
-        in
-        if len >= 2 && lib.hasPrefix "\"" v && lib.hasSuffix "\"" v then
-          builtins.substring 1 (len - 2) v
-        else if len >= 2 && lib.hasPrefix "'" v && lib.hasSuffix "'" v then
-          builtins.substring 1 (len - 2) v
-        else
-          v;
-      parseLine =
-        line:
-        let
-          m = builtins.match "[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(.*)" line;
-        in
-        if m == null then null else { name = builtins.elemAt m 0; value = unquote (builtins.elemAt m 1); };
-    in
-    builtins.listToAttrs (builtins.filter (x: x != null) (map parseLine lines));
-
-  # Reuse existing .env
-  dotEnv =
-    (readDotEnv ./env.d/development/common.dist)
-    // (readDotEnv ./env.d/development/postgresql.dist);
-
-  sharedEnv = builtins.removeAttrs dotEnv [ "PYTHONPATH" ]; # only makes sense inside the backend container.
-in
-{
-  options.meet = {
-    agents.enable = lib.mkEnableOption "tooling for the LiveKit agents in src/agents";
-    summary.enable = lib.mkEnableOption "tooling for the summary service in src/summary";
-    k8s.enable = lib.mkEnableOption "Kubernetes dev utilities";
-  };
-
-  config = {
-    # Profile can be activated with devenv --profile <profile> shell
-    profiles = {
-      agents.module = {
-        meet.agents.enable = true;
-      };
-      summary.module = {
-        meet.summary.enable = true;
-      };
-      k8s.module = {
-        meet.k8s.enable = true;
-      };
-    };
-    languages.python = {
-      enable = true;
-      package = python;
-      directory = backendDir;
-      manylinux.enable = pkgs.stdenv.hostPlatform.isLinux;
-
-      libraries = [
-        "${config.devenv.dotfile}/profile"
-        pkgs.file
-        pkgs.zlib
-        pkgs.libffi
-        pkgs.openssl
-      ];
-
-      uv.enable = true;
-      uv.sync.enable = false;
-      venv.enable = false;
-      lsp.enable = true;
-    };
-
-    languages.javascript = {
-      enable = true;
-      package = nodejs;
-      directory = frontendDir;
-
-      npm.enable = true;
-      yarn.enable = true;
-      corepack.enable = false;
-    };
-
-    languages.typescript.enable = false;
-    languages.nix.enable = true;
-
-    packages =
-      with pkgs;
-      [
-        gnumake
-        file
-        shared-mime-info
-        gettext
-        postgresql_16
-        git
-        curl
-        jq
-        podman
-        podman-compose
-        docker-client
-      ]
-
-      # -- LiveKit agents
-      ++ lib.optionals config.meet.agents.enable [
-        glib
-        portaudio
-        livekit-cli
-      ]
-
-      # -- summary service
-      ++ lib.optionals config.meet.summary.enable [
-        redis
-      ]
-
-      # -- Kubernetes tools
-      ++ lib.optionals config.meet.k8s.enable [
-        kubectl
-        kubernetes-helm
-        helmfile
-        tilt
-        kind
-        mkcert
-      ];
-
-    env = sharedEnv // {
-      UV_LINK_MODE = "copy";
-
-      PYTHONDONTWRITEBYTECODE = "1";
-      PYTHONUNBUFFERED = "1";
-
-      UV_PROJECT_ENVIRONMENT = lib.mkForce ".venv";
-
-      COMPOSE_PROJECT_NAME = "meet";
-
-      DJANGO_DATA_DIR = "${config.devenv.root}/data";
-
-      # Database / Pgsql
-      DB_HOST = "127.0.0.1";
-      DB_PORT = "15432";
-      PGHOST = "127.0.0.1";
-      PGPORT = "15432";
-      PGDATABASE = sharedEnv.DB_NAME;
-      PGUSER = sharedEnv.DB_USER;
-      PGPASSWORD = sharedEnv.DB_PASSWORD;
-
-      REDIS_URL = "redis://127.0.0.1:6379/1";
-      CELERY_BROKER_URL = "redis://127.0.0.1:6379/0";
-
-      # S3 / Garage
-      AWS_S3_ENDPOINT_URL = "http://127.0.0.1:9000";
-
-      # OIDC
-      OIDC_OP_JWKS_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/certs";
-      OIDC_OP_TOKEN_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token";
-      OIDC_OP_USER_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/userinfo";
-      OIDC_OP_INTROSPECTION_ENDPOINT = "http://localhost:8083/realms/meet/protocol/openid-connect/token/introspect";
-
-      # summary service
-      SUMMARY_SERVICE_ENDPOINT = "http://127.0.0.1:8001/api/v2/async-jobs/transcribe/";
-      SUMMARY_SERVICE_VERSION = "2";
-
-      # Mail
-      DJANGO_EMAIL_HOST = "127.0.0.1";
-    };
-
-    scripts = {
-
-      meet-venv = {
-        description = "Create/refresh meet uv virtualenvs for backend, agents and summary";
-        exec = ''
-          set -euo pipefail
-          cd "$DEVENV_ROOT"
-
-          echo "==> ${backendDir} (uv sync --locked, dependency-groups)"
-          ( cd "${backendDir}" && uv sync --locked --all-groups )
-
-          echo "==> ${agentsDir} (uv sync --locked --all-extras)"
-          ( cd "${agentsDir}" && uv sync --locked --all-extras )
-
-          echo "==> ${summaryDir} (uv sync --locked --all-extras)"
-          ( cd "${summaryDir}" && uv sync --locked --all-extras )
-
-          echo
-          echo "Synced the following virtualenvs successfully:"
-          echo "  ${backendDir}/.venv"
-          echo "  ${agentsDir}/.venv"
-          echo "  ${summaryDir}/.venv"
-        '';
-      };
-    };
-
-    enterShell = ''
-      # Make podman socket accessible in order to launch regular docker commands.
-      # Set MEET_PODMAN_SOCKET=0 to keep the DOCKER_HOST of the calling environment.
-      case "''${MEET_PODMAN_SOCKET:-1}" in
-        0|false|no|off) ;;
-        *)
-          _rundir="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
-          export DOCKER_HOST="unix://$_rundir/podman/podman.sock"
-          unset _rundir
-          ;;
-      esac
-
-      # Compose files to merge
-      _compose_dir="${config.devenv.root}/docker/compose.d"
-      _compose_files="${config.devenv.root}/compose.yml"
-
-      export DOCKER_USER="$(id -u):$(id -g)"
-
-      case "''${DOCKER_HOST:-}" in
-        *podman*)
-          _compose_files="$_compose_files:$_compose_dir/compose.podman.yml"
-
-          # Build images with Podman/Buildah rather than BuildKit. `docker
-          # compose build` otherwise has buildx boot a moby/buildkit container,
-          # and that container lands in its own network namespace with neither
-          # the proxy in its environment nor any route to it.
-          # Buildah has neither problem: base images are resolved by the Podman systemd
-          # service, which inherits the proxy from its systemd socket activated unit, and
-          # RUN steps execute in the *host* network namespace
-
-          export DOCKER_BUILDKIT=0
-          export COMPOSE_BAKE=false
-          ;;
-      esac
-
-
-      # Apply Bureautix override
-      if [ -n "''${http_proxy:-}" ]; then
-        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
-      fi
-
-      export COMPOSE_FILE="$_compose_files"
-      unset _compose_dir _compose_files
-
-      # Make binaries accessible
-      for _d in \
-        "$DEVENV_ROOT/${backendDir}/.venv/bin" \
-        "$DEVENV_ROOT/${agentsDir}/.venv/bin" \
-        "$DEVENV_ROOT/${summaryDir}/.venv/bin" \
-        "$DEVENV_ROOT/${frontendDir}/node_modules/.bin"
-      do
-        [ -d "$_d" ] && export PATH="$_d:$PATH"
-      done
-      unset _d
-    '';
-  };
-}
@@ -1,5 +0,0 @@
-inputs:
-  nixpkgs:
-    url: git+https://github.com/NixOS/nixpkgs?ref=nixos-26.05&shallow=1
-  devenv:
-    url: git+https://github.com/cachix/devenv?ref=refs/tags/v2.1.2&dir=src/modules
@@ -1,48 +0,0 @@
-# Bureautix proxy overrides
-#
-# Builds submitted through the Docker API of the Podman service get none of
-# the proxy variables in their RUN steps. We need to pass the http_proxy explicitly
-# otherwise all connections fail during the build.
-
-x-proxy-vars: &proxy-vars
-  http_proxy: ${http_proxy:-}
-  https_proxy: ${https_proxy:-}
-  no_proxy: ${no_proxy:-}
-
-services:
-  app:
-    build:
-      args:
-        <<: *proxy-vars
-  app-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  frontend:
-    build:
-      args:
-        <<: *proxy-vars
-  metadata-collector-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  multi-user-transcriber-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  app-summary-dev:
-    build:
-      args:
-        <<: *proxy-vars
-  celery-summary-transcribe:
-    build:
-      args:
-        <<: *proxy-vars
-  celery-summary-summarize:
-    build:
-      args:
-        <<: *proxy-vars
-  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
-  keycloak:
-    ports: !override
-      - "8081:8080"
@@ -1,35 +0,0 @@
-# Rootless Podman override for compose.yml.
-#
-# Rootless Podman maps container UID 0 to the host user and every other
-# container UID to a subuid that owns nothing in the worktree. Meet compose.ymlruns
-# its containers as DOCKER_USER=$(id -u):$(id -g), which would land on such a
-# subuid and make every bind mount effectively read-only.
-#
-# `userns_mode: keep-id` maps the host user to the same UID and GID inside the
-# container instead, so DOCKER_USER keeps its Docker value and files written
-# through a bind mount are owned by the host user on both sides.
-#
-# Only the services that mount the worktree and run as DOCKER_USER are listed.
-
-x-keep-id: &keep-id
-  userns_mode: keep-id
-
-services:
-  app-dev:
-    <<: *keep-id
-  celery-dev:
-    <<: *keep-id
-  garage:
-    <<: *keep-id
-  garage-cors:
-    <<: *keep-id
-  node:
-    <<: *keep-id
-  crowdin:
-    <<: *keep-id
-  metadata-collector-dev:
-    <<: *keep-id
-  multi-user-transcriber-dev:
-    <<: *keep-id
-  app-summary-dev:
-    <<: *keep-id
@@ -1,5 +1,5 @@
 # ---- Front-end image ----
-FROM node:22-alpine AS frontend-deps
+FROM node:20-alpine AS frontend-deps

 WORKDIR /home/frontend/

@@ -54,12 +54,16 @@ RUN npx webpack --mode production


 # ---- Front-end image ----
-FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
+FROM nginxinc/nginx-unprivileged:alpine3.23 AS frontend-production

 USER root
-RUN apk upgrade --no-cache libexpat && \
-    apk del curl
-USER nginx
+
+# Security patches for known CVEs
+RUN apk update && apk upgrade  \
+    musl \
+    musl-utils \
+    zlib>=1.3.2-r0 \
+    && apk del curl

 USER nginx

@@ -1,6 +1,5 @@
 :root {
    --fonts-sans: 'Marianne', ui-sans-serif, system-ui, sans-serif;
-    --avatar-cap-height: 0.7;
 }

 .Header-beforeLogo {
@@ -48,12 +48,9 @@ server {

      set $nonce $request_id;

-      set $csp "default-src 'self'; upgrade-insecure-requests; ";
+      set $csp "upgrade-insecure-requests; ";
      set $csp "${csp}frame-ancestors ${ms_domains}; ";
      set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
-      set $csp "${csp}style-src 'self' 'unsafe-inline'; ";
-      set $csp "${csp}img-src 'self' data:; ";
-      set $csp "${csp}font-src 'self' data:; ";
      set $csp "${csp}connect-src 'self' ${ms_domains}; ";
      set $csp "${csp}frame-src 'none'; ";
      set $csp "${csp}object-src 'none'; ";
@@ -65,11 +62,6 @@ server {
      sub_filter_once off;
  }

-  location ^~ /assets/mediapipe/wasm/ {
-      expires 30d;
-      add_header Cache-Control "public, max-age=2592000";
-  }
-
  # Serve static files with caching
  location ~* ^/assets/.*\.(css|js|json|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
      expires 30d;
@@ -1,15 +0,0 @@
-# Garage configuration for local development only: single node, no replication.
-# See https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "lmdb"
-
-replication_factor = 1
-
-rpc_bind_addr = "127.0.0.1:3901"
-rpc_public_addr = "127.0.0.1:3901"
-
-[s3_api]
-api_bind_addr = "[::]:9000"
-# Clients must sign their requests for this region (AWS_S3_REGION_NAME)
-s3_region = "local"
@@ -17,9 +17,9 @@ server {
        proxy_set_header X-Amz-Date $authDate;
        proxy_set_header X-Amz-Content-SHA256 $authContentSha256;

-        # Get resource from Garage
-        proxy_pass http://garage:9000/meet-media-storage/;
-        proxy_set_header Host garage:9000;
+        # Get resource from Minio
+        proxy_pass http://minio:9000/meet-media-storage/;
+        proxy_set_header Host minio:9000;
        # To use with ds_proxy
        # proxy_pass http://ds-proxy:4444/upstream/meet-media-storage/;
        # proxy_set_header Host ds-proxy:4444;
@@ -14,4 +14,3 @@ accesslog = "-"
 # Using '-' for the error log file makes gunicorn log errors to stderr
 errorlog = "-"
 loglevel = "info"
-access_log_format = '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" %(M)s'
@@ -1,4 +1,4 @@
-FROM livekit/livekit-server:v1.13.6
+FROM livekit/livekit-server:v1.9.4

 # We inject the nip.io certificate manually because the livekit chart doesn't support volume mounting
 COPY rootCA.pem /etc/ssl/certs/
@@ -8,23 +8,3 @@ webhook:
  api_key: devkey
  urls:
      - http://app-dev:8000/api/v1.0/rooms/webhooks-livekit/
-
-turn:
-  enabled: true
-  domain: turn.127.0.0.1.nip.io
-  udp_port: 3478
-  tls_port: 0
-  external_tls: false
-  relay_range_start: 30000
-  relay_range_end: 30100
-  allow_restricted_peer_cidrs:
-    - 192.168.0.0/16
-    - 172.16.0.0/12
-
-rtc:
-  node_ip: 127.0.0.1
-  advertise_internal_ip: true
-  udp_port: 7882
-  tcp_port: 7881
-  use_external_ip: false
-
@@ -13,7 +13,7 @@ These components rely on a few key services:

 - PostgreSQL for storing data (users, rooms, recordings)
 - Redis for caching and inter-service communication
- Garage for storing files (room recordings)
+- MinIO for storing files (room recordings)
 - Celery workers for meeting transcript (optional, required for AI beta features)

 We provide two stack options for getting Visio up and running for development:
@@ -23,11 +23,14 @@ It uses LiveKit Egress to record room sessions. For reference, see the [LiveKit
 To use the room recording feature, the following components are required:

 - A running [LiveKit Egress](https://github.com/livekit/egress) server capable of handling room composite recordings.
- A S3-compatible object storage where the egress uploads the recorded files.
+- A S3-compatible object storage that supports webhook events to notify the backend when recordings are uploaded.
 - An email service to notify room owners when a recording is available for download.
 - Webhook events configured between LiveKit Server and the backend.


+> [!CAUTION]
+>  Minio supports lifecycle events; other providers may not work out of the box. There is currently a dependency on Minio, which is planned to be refactored in the future.
+
 > [!NOTE]
 > Celery isn’t in use for these async tasks yet. It’s something we’d like to add, but it’s not planned at this stage.

@@ -72,7 +75,7 @@ sequenceDiagram
    LiveKit->>Egress: Stop recording
    Egress->>Storage: Upload recorded file
    
-    LiveKit->>Backend: POST /api/v1.0/rooms/webhooks-livekit/ (egress_ended)
+    Storage->>Backend: Storage event notification
    Backend->>Backend: Update Recording status to SAVED
    Backend->>Email: Send notification to room owner
    
@@ -91,6 +94,10 @@ sequenceDiagram
 | **RECORDING_ENABLE**                    | Boolean     | `False`                                                                                                                                                            | Enable or disable the room recording feature.                                                                                                                                                                                                                                                      |
 | **RECORDING_OUTPUT_FOLDER**             | String      | `"recordings"`                                                                                                                                                     | Folder/prefix where recordings are stored in the object storage.                                                                                                                                                                                                                                   |
 | **RECORDING_WORKER_CLASSES**            | Dict        | `{ "screen_recording": "core.recording.worker.services.VideoCompositeEgressService", "transcript": "core.recording.worker.services.AudioCompositeEgressService" }` | Maps recording types to their worker service classes.                                                                                                                                                                                                                                              |
+| **RECORDING_EVENT_PARSER_CLASS**        | String      | `"core.recording.event.parsers.MinioParser"`                                                                                                                       | Class responsible for parsing storage events and updating the backend.                                                                                                                                                                                                                             |
+| **RECORDING_ENABLE_STORAGE_EVENT_AUTH** | Boolean     | `True`                                                                                                                                                             | Enable authentication for storage event webhook requests.                                                                                                                                                                                                                                          |
+| **RECORDING_STORAGE_EVENT_ENABLE**      | Boolean     | `False`                                                                                                                                                            | Enable handling of storage events (must configure webhook in storage).                                                                                                                                                                                                                             |
+| **RECORDING_STORAGE_EVENT_TOKEN**       | Secret/File | `None`                                                                                                                                                             | Token used to authenticate storage webhook requests, if `RECORDING_ENABLE_STORAGE_EVENT_AUTH` is enabled.                                                                                                                                                                                          |
 | **RECORDING_EXPIRATION_DAYS**           | Integer     | `None`                                                                                                                                                             | Number of days before recordings expire. Should match bucket lifecycle policy. Set to `None` for no expiration.                                                                                                                                                                                    |
 | **RECORDING_MAX_DURATION**              | Integer     | `None`                                                                                                                                                             | Maximum duration of a recording in milliseconds. Must be synced with the LiveKit Egress configuration. Set to None for unlimited duration. When the maximum duration is reached, the recording is automatically stopped and saved, and the user is prompted in the frontend with an alert message. |
 | **RECORDING_ENCODING_ENABLED**          | Boolean     | `False`                                                                                                                                                            | When `False`, LiveKit Egress uses its built-in `H264_720P_30` preset. When `True`, the `RECORDING_ENCODING_*` values below are sent to LiveKit as advanced `EncodingOptions`. See [Tuning recording encoding](#tuning-recording-encoding).                                                          |
@@ -102,6 +109,19 @@ sequenceDiagram
 | **RECORDING_ENCODING_KEY_FRAME_INTERVAL_S** | Float   | `4.0`                                                                                                                                                              | Keyframe interval in seconds. Drives seek granularity in the recorded MP4 (a player can only seek to keyframe boundaries). Larger values give the encoder slightly more bits for non-keyframe content at a fixed bitrate. `4.0` is a standard VOD value. Only applied when `RECORDING_ENCODING_ENABLED` is `True`. |


+### Manual Storage Webhook
+
+Storage events must be configured manually; the Kubernetes chart does not do this automatically.
+
+1. Configure your S3 bucket to send file creation events to the backend webhook.
+2. Enable events and token in settings:
+
+```python
+RECORDING_STORAGE_EVENT_ENABLE = True
+RECORDING_ENABLE_STORAGE_EVENT_AUTH = True
+RECORDING_STORAGE_EVENT_TOKEN = <token>
+```
+
 > [!NOTE]
 > Questions? Open an issue on [GitHub](https://github.com/suitenumerique/meet/issues/new?assignees=&labels=bug&template=Bug_report.md) or join our [Matrix community](https://matrix.to/#/#meet-official:matrix.org).

@@ -1,40 +0,0 @@
-# Room purge
-
-Rooms pile up over time and most of them are only used once. The `purge_inactive_rooms` management command permanently deletes the rooms that have not been started for a configurable number of days. It is disabled by default.
-
-## How it works
-
-Each time LiveKit tells the backend that a room has started (`room_started` webhook), the backend records the date on the room (`last_started_at`).
-A room is inactive when:
-
- it was last started more than `ROOM_INACTIVITY_DELETION_DAYS` days ago, or
- it was never started and was created more than `ROOM_INACTIVITY_DELETION_DAYS` days ago.
-
-Rooms that existed before this feature was deployed are considered started on the day of the release, so none of them can be purged before a full inactivity period has elapsed.
-
-The command is meant to run once a day. The Helm chart schedules it in `backend.cronjobs` (`purge-inactive-rooms`, 01:00); it does nothing until `ROOM_INACTIVITY_DELETION_DAYS` is set.
-
-```bash
-python manage.py purge_inactive_rooms            # delete the inactive rooms
-python manage.py purge_inactive_rooms --dry-run  # only list the rooms that would be deleted
-```
-
-## Rooms that are kept
-
-A recording can only be reached through its room. An inactive room is kept as long as it holds a saved recording its users may still access:
-
- with `RECORDING_EXPIRATION_DAYS` set, a saved recording created less than that many days ago,
- with `RECORDING_EXPIRATION_DAYS` unset, any saved recording.
-
-## What happens to a purged room
-
-The room is deleted from the database, along with its accesses, its telephony PIN code, and the recording entries it still holds — the expired ones and those that were never saved, since any other recording would have protected the room — together with their own accesses.
-
-The recording **files in the bucket are left untouched**: the backend never deletes anything from the storage, it only drops the database entries pointing at it. Removing the files is the job of the bucket lifecycle policy, which should match `RECORDING_EXPIRATION_DAYS` (see the [recording documentation](recording.md)). When the two do not match, the purge leaves objects behind: they become unreachable, since serving a recording requires its database entry, but they keep costing storage.
-
-⚠️ When a room is purged, all it's configuration and access rights are also deleted. Its slug becomes available again
-and can be reused when a meeting is created from that same URL.
-
-* With `ALLOW_UNREGISTERED_ROOMS=false`, only an authenticated user can navigate to a previously existing link after the room has been purged. Doing so recreates the room in the database with a fresh configuration, with that user associated with it and granted admin rights.
-
-* With `ALLOW_UNREGISTERED_ROOMS=true`, any user can reopen the purged room by navigating to the same URL. In that case, the room is created dynamically and no corresponding room entry is persisted in the database.
@@ -42,7 +42,7 @@ sequenceDiagram
  participant Backend as Backend API
  participant Summary as Summary Service
  participant Celery as Celery Workers (transcribe-queue)
-  participant S3 as S3 (Object Storage)
+  participant MinIO as MinIO (Object Storage)
  participant STT as WhisperX API
  participant Docs as LaSuite Docs

@@ -50,7 +50,7 @@ sequenceDiagram
  Note right of Backend: Payload contains 7 params: owner_id, filename, email, sub, room, recording_date, recording_time

  Summary->>Celery: Register task (transcribe-queue)
-  Celery->>S3: Fetch audio file
+  Celery->>MinIO: Fetch audio file
  Celery->>STT: Transcribe audio (WhisperX)
  STT-->>Celery: Segmented transcript

@@ -72,15 +72,15 @@ sequenceDiagram
 | celery_result_backend    | String    | `"redis://redis/0"`                                                   | Celery result backend URL.                                                                                                                                              |
 | celery_max_retries       | Integer   | `1`                                                                   | Maximum number of retries for Celery tasks.                                                                                                                             |
 | transcribe_queue         | String    | `"transcribe-queue"`                                                  | Name of the Celery queue for transcription tasks.                                                                                                                       |
-| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3 bucket used for storing recordings.                                                                                                                      |
-| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3 storage.                                                                                                                                         |
-| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3.                                                                                                                                                      |
-| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3.                                                                                                                                                      |
-| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3 requests.                                                                                                                                              |
-| aws_s3_region_name       | String    | —                                                                     | Region used to sign S3 requests, passed as-is to boto3.                                                                                                                 |
+| aws_storage_bucket_name  | String    | —                                                                     | Name of the S3/MinIO bucket used for storing recordings.                                                                                                                |
+| aws_s3_endpoint_url      | String    | —                                                                     | Endpoint URL of the S3/MinIO storage.                                                                                                                                   |
+| aws_s3_access_key_id     | String    | —                                                                     | Access key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secret_access_key | Secret    | —                                                                     | Secret key for S3/MinIO.                                                                                                                                                |
+| aws_s3_secure_access     | Boolean   | `True`                                                                | Use HTTPS for S3/MinIO requests.                                                                                                                                        |
 | whisperx_api_key         | Secret    | —                                                                     | API key for accessing WhisperX.                                                                                                                                         |
 | whisperx_base_url        | String    | `"https://api.whisperx.com/v1"`                                       | Base URL for the WhisperX API.                                                                                                                                          |
 | whisperx_asr_model       | String    | `"whisper-1"`                                                         | ASR model used for transcription.                                                                                                                                       |
+| whisperx_max_retries     | Integer   | `0`                                                                   | Maximum number of retries for WhisperX API requests.                                                                                                                    |
 | webhook_max_retries      | Integer   | `2`                                                                   | Maximum retries for webhook requests.                                                                                                                                   |
 | webhook_status_forcelist | List[Int] | `[502, 503, 504]`                                                     | HTTP status codes triggering webhook retry.                                                                                                                             |
 | webhook_backoff_factor   | Float     | `0.1`                                                                 | Exponential backoff factor for webhook retries.                                                                                                                         |
@@ -14,7 +14,7 @@ All services are required to run the minimalist instance of LaSuite Meet. Click
 | **OIDC Provider** | User authentication | [Keycloak setup](../examples/compose/keycloak/README.md) |
 | **SMTP Service**  | Email notifications | -                                                        |

-> [!NOTE] Some advanced features, as Recording and transcription, require additional services (S3-compatible object storage, email). See `/features` folder for details.
+> [!NOTE] Some advanced features, as Recording and transcription, require additional services (MinIO, email). See `/features` folder for details.


 ## Software Requirements
@@ -14,7 +14,7 @@ This document is a step-by-step guide that describes how to install LaSuite Meet

 If you do not have a kubernetes test cluster, you can install everything on a local kind cluster. In this case, the simplest way is to use our script located in this repo under **bin/start-kind.sh**.

-IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed.
+IMPORTANT: The kind method will only deploy meet as a local instance(127.0.0.1) that can only be accessed from the device where it has been deployed. 

 To be able to use the script, you will need to install the following components:

@@ -244,189 +244,126 @@ meet-admin               <none>   meet.127.0.0.1.nip.io       localhost   80, 44

 You can use LaSuite Meet on https://meet.127.0.0.1.nip.io from the local device. The provisioning user in keycloak is meet/meet.

-## Rebranding the favicon
-
-The favicon is bundled into the frontend image and served as a set of static
-files from `/usr/share/nginx/html` (`favicon.ico`, `favicon-16x16.png`,
-`favicon-32x32.png`, `apple-touch-icon.png`, `android-chrome-192x192.png`,
-`android-chrome-512x512.png`, `icon.png`). To rebrand without forking and
-rebuilding the image, overlay your own icons onto those paths with a volume —
-this serves the right icon from the first byte (no rebuild, no flash) and
-covers every variant, including the iOS home-screen and Android/PWA icons.
-
-Put your icons in a `ConfigMap` (`binaryData` keeps the PNGs intact)…
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: meet-favicon
-binaryData:
-  # base64 of each replacement icon
-  favicon.ico: <base64…>
-  favicon-16x16.png: <base64…>
-  favicon-32x32.png: <base64…>
-  apple-touch-icon.png: <base64…>
-  android-chrome-192x192.png: <base64…>
-  android-chrome-512x512.png: <base64…>
-```
-
-```bash
-# e.g. build the ConfigMap straight from a directory of icons
-$ kubectl create configmap meet-favicon --from-file=./my-icons/
-```
-
-…then mount each file over the bundled one via the chart's
-`frontend.extraVolumes` / `frontend.extraVolumeMounts` (the `subPath` mounts
-the single file without hiding the rest of `html/`):
-
-```yaml
-frontend:
-  extraVolumes:
-    - name: favicon
-      configMap:
-        name: meet-favicon
-  extraVolumeMounts:
-    - name: favicon
-      mountPath: /usr/share/nginx/html/favicon.ico
-      subPath: favicon.ico
-    - name: favicon
-      mountPath: /usr/share/nginx/html/favicon-16x16.png
-      subPath: favicon-16x16.png
-    - name: favicon
-      mountPath: /usr/share/nginx/html/favicon-32x32.png
-      subPath: favicon-32x32.png
-    - name: favicon
-      mountPath: /usr/share/nginx/html/apple-touch-icon.png
-      subPath: apple-touch-icon.png
-    - name: favicon
-      mountPath: /usr/share/nginx/html/android-chrome-192x192.png
-      subPath: android-chrome-192x192.png
-    - name: favicon
-      mountPath: /usr/share/nginx/html/android-chrome-512x512.png
-      subPath: android-chrome-512x512.png
-```
-
 ## All options

 These are the environmental options available on meet backend.

-| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                      |
-|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                        |
-| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                           |
-| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                              |
-| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                           |
-| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                        |
-| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                       |
-| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                         |
-| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                        |
-| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                         |
-| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                    |
-| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                         |
-| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                      |
-| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                              |
-| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                              |
-| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                              |
-| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                              |
-| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                           |
-| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                        |
-| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                         |
-| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                             |
-| ROOM_CREATION_THROTTLE_RATES                    | Room creation throttle rate per authenticated user | 50/minute                                                                                               | 50/minute                                                                                                                                                    |
-| ROOM_CREATION_DAILY_THROTTLE_RATES              | Daily room creation cap per authenticated user                                                                                                               | 1000/day                                                                                                                                                     |
-| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                   |
-| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                   |
-| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                        |
-| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                           |
-| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                              |
-| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                           |
-| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                           |
-| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                           |
-| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                        |
-| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                         |
-| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                           |
-| FRONTEND_DOCUMENTATION_URL                      | URL of the documentation opened from the room options menu. If unset, the documentation menu item is hidden                                                  |                                                                                                                                                              |
-| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                        |
-| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                        |
-| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                  |
-| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                              |
-| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                              |
-| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                              |
-| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                              |
-| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                        |
-| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                        |
-| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                             |
-| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                              |
-| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                              |
-| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                              |
-| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                              |
-| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                              |
-| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                        |
-| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                           |
-| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                           |
-| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                              |
-| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                         |
-| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                           |
-| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                         |
-| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                         |
-| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                        |
-| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                        |
-| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                         |
-| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                              |
-| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                              |
-| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                              |
-| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                              |
-| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                              |
-| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                         |
-| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                              |
-| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                           |
-| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                 |
-| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                         |
-| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                        |
-| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                           |
-| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                         |
-| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                     |
-| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                 |
-| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                   |
-| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                           |
-| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                        |
-| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                         |
-| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                           |
-| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                              |
-| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                              |
-| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                              |
-| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                         |
-| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                              |
-| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                              |
-| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                              |
-| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                         |
-| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                        |
-| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                        |
-| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                       |
-| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                         |
-| ROOM_INACTIVITY_DELETION_DAYS                   | Days without being started after which a room is purged. Unset to never purge                                                                                |                                                                                                                                                              |
-| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                        |
-| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                   |
+| Option                                          | Description                                                                                                                                                  | default                                                                                                                                                       |
+|-------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| DATA_DIR                                        | Data directory location                                                                                                                                      | /data                                                                                                                                                         |
+| DJANGO_ALLOWED_HOSTS                            | Hosts that are allowed                                                                                                                                       | []                                                                                                                                                            |
+| DJANGO_SECRET_KEY                               | Secret key used for Django security                                                                                                                          |                                                                                                                                                               |
+| DJANGO_SILENCED_SYSTEM_CHECKS                   | Silence Django system checks                                                                                                                                 | []                                                                                                                                                            |
+| DJANGO_ALLOW_UNSECURE_USER_LISTING              | Allow unsecure user listing                                                                                                                                  | false                                                                                                                                                         |
+| DB_ENGINE                                       | Database engine used                                                                                                                                         | django.db.backends.postgresql_psycopg2                                                                                                                        |
+| DB_NAME                                         | Name of the database                                                                                                                                         | meet                                                                                                                                                          |
+| DB_USER                                         | User used to connect to database                                                                                                                             | dinum                                                                                                                                                         |
+| DB_PASSWORD                                     | Password used to connect to the database                                                                                                                     | pass                                                                                                                                                          |
+| DB_HOST                                         | Hostname of the database                                                                                                                                     | localhost                                                                                                                                                     |
+| DB_PORT                                         | Port to connect to database                                                                                                                                  | 5432                                                                                                                                                          |
+| STORAGES_STATICFILES_BACKEND                    | Static file serving engine                                                                                                                                   | whitenoise.storage.CompressedManifestStaticFilesStorage                                                                                                       |
+| AWS_S3_ENDPOINT_URL                             | S3 host endpoint                                                                                                                                             |                                                                                                                                                               |
+| AWS_S3_ACCESS_KEY_ID                            | S3 access key                                                                                                                                                |                                                                                                                                                               |
+| AWS_S3_SECRET_ACCESS_KEY                        | S3 secret key                                                                                                                                                |                                                                                                                                                               |
+| AWS_S3_REGION_NAME                              | S3 region                                                                                                                                                    |                                                                                                                                                               |
+| AWS_STORAGE_BUCKET_NAME                         | S3 bucket name                                                                                                                                               | meet-media-storage                                                                                                                                            |
+| DJANGO_LANGUAGE_CODE                            | Default language                                                                                                                                             | en-us                                                                                                                                                         |
+| REDIS_URL                                       | Redis endpoint                                                                                                                                               | redis://redis:6379/1                                                                                                                                          |
+| SESSION_COOKIE_AGE                              | Session cookie expiration in seconds                                                                                                                         | 43200 (12 hours)                                                                                                                                              |
+| REQUEST_ENTRY_THROTTLE_RATES                    | Entry request throttle rates                                                                                                                                 | 150/minute                                                                                                                                                    |
+| CREATION_CALLBACK_THROTTLE_RATES                | Creation callback throttle rates                                                                                                                             | 600/minute                                                                                                                                                    |
+| SPECTACULAR_SETTINGS_ENABLE_DJANGO_DEPLOY_CHECK | Enable Django deploy check                                                                                                                                   | false                                                                                                                                                         |
+| CSRF_TRUSTED_ORIGINS                            | CSRF trusted origins list                                                                                                                                    | []                                                                                                                                                            |
+| FRONTEND_CUSTOM_CSS_URL                         | URL of an additional CSS file to load in the frontend app. If set, a `<link>` tag with this URL as href is added to the `<head>` of the frontend app         |                                                                                                                                                               |
+| FRONTEND_ANALYTICS                              | Analytics information                                                                                                                                        | {}                                                                                                                                                            |
+| FRONTEND_SUPPORT                                | Crisp frontend support configuration, also you can pass help articles, with `help_article_transcript`, `help_article_recording`, `help_article_more_tools`   | {}                                                                                                                                                            |
+| FRONTEND_MANIFEST_LINK                          | Link to the "Learn more" button on the homepage                                                                                                              | {}                                                                                                                                                            |
+| FRONTEND_SILENCE_LIVEKIT_DEBUG                  | Silence LiveKit debug logs                                                                                                                                   | false                                                                                                                                                         |
+| FRONTEND_IS_SILENT_LOGIN_ENABLED                | Enable silent login feature                                                                                                                                  | true                                                                                                                                                          |
+| FRONTEND_FEEDBACK                               | Frontend feedback configuration                                                                                                                              | {}                                                                                                                                                            |
+| FRONTEND_USE_FRENCH_GOV_FOOTER                  | Show the French government footer in the homepage                                                                                                            | false                                                                                                                                                         |
+| FRONTEND_USE_PROCONNECT_BUTTON                  | Show a "Login with ProConnect" button in the homepage instead of a "Login" button                                                                            | false                                                                                                                                                         |
+| DJANGO_EMAIL_BACKEND                            | Email backend library                                                                                                                                        | django.core.mail.backends.smtp.EmailBackend                                                                                                                   |
+| DJANGO_EMAIL_HOST                               | Host of the email server                                                                                                                                     |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_USER                          | User to connect to the email server                                                                                                                          |                                                                                                                                                               |
+| DJANGO_EMAIL_HOST_PASSWORD                      | Password to connect to the email server                                                                                                                      |                                                                                                                                                               |
+| DJANGO_EMAIL_PORT                               | Port to connect to the email server                                                                                                                          |                                                                                                                                                               |
+| DJANGO_EMAIL_USE_TLS                            | Enable TLS on email connection                                                                                                                               | false                                                                                                                                                         |
+| DJANGO_EMAIL_USE_SSL                            | Enable SSL on email connection                                                                                                                               | false                                                                                                                                                         |
+| DJANGO_EMAIL_FROM                               | Email from account                                                                                                                                           | from@example.com                                                                                                                                              |
+| EMAIL_BRAND_NAME                                | Email branding name                                                                                                                                          |                                                                                                                                                               |
+| EMAIL_SUPPORT_EMAIL                             | Support email address                                                                                                                                        |                                                                                                                                                               |
+| EMAIL_LOGO_IMG                                  | Email logo image                                                                                                                                             |                                                                                                                                                               |
+| EMAIL_DOMAIN                                    | Email domain                                                                                                                                                 |                                                                                                                                                               |
+| EMAIL_APP_BASE_URL                              | Email app base URL                                                                                                                                           |                                                                                                                                                               |
+| DJANGO_CORS_ALLOW_ALL_ORIGINS                   | Allow all CORS origins                                                                                                                                       | false                                                                                                                                                         |
+| DJANGO_CORS_ALLOWED_ORIGINS                     | Origins to allow (string list)                                                                                                                               | []                                                                                                                                                            |
+| DJANGO_CORS_ALLOWED_ORIGIN_REGEXES              | Origins to allow (regex patterns)                                                                                                                            | []                                                                                                                                                            |
+| SENTRY_DSN                                      | Sentry server DSN                                                                                                                                            |                                                                                                                                                               |
+| DJANGO_CELERY_BROKER_URL                        | Celery broker host                                                                                                                                           | redis://redis:6379/0                                                                                                                                          |
+| DJANGO_CELERY_BROKER_TRANSPORT_OPTIONS          | Celery broker options                                                                                                                                        | {}                                                                                                                                                            |
+| OIDC_CREATE_USER                                | Create OIDC user if not exists                                                                                                                               | true                                                                                                                                                          |
+| OIDC_VERIFY_SSL                                 | Verify SSL for OIDC                                                                                                                                          | true                                                                                                                                                          |
+| OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION       | Fallback to email for identification                                                                                                                         | false                                                                                                                                                         |
+| OIDC_RP_SIGN_ALGO                               | Token verification algorithm used by OIDC                                                                                                                    | RS256                                                                                                                                                         |
+| OIDC_RP_CLIENT_ID                               | OIDC client ID                                                                                                                                               | meet                                                                                                                                                          |
+| OIDC_RP_CLIENT_SECRET                           | OIDC client secret                                                                                                                                           |                                                                                                                                                               |
+| OIDC_OP_JWKS_ENDPOINT                           | OIDC endpoint for JWKS                                                                                                                                       |                                                                                                                                                               |
+| OIDC_OP_AUTHORIZATION_ENDPOINT                  | OIDC endpoint for authorization                                                                                                                              |                                                                                                                                                               |
+| OIDC_OP_TOKEN_ENDPOINT                          | OIDC endpoint for token                                                                                                                                      |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT                           | OIDC endpoint for user                                                                                                                                       |                                                                                                                                                               |
+| OIDC_OP_USER_ENDPOINT_FORMAT                    | OIDC endpoint format (AUTO, JWT, JSON)                                                                                                                       | AUTO                                                                                                                                                          |
+| OIDC_OP_LOGOUT_ENDPOINT                         | OIDC endpoint for logout                                                                                                                                     |                                                                                                                                                               |
+| OIDC_AUTH_REQUEST_EXTRA_PARAMS                  | Extra parameters for OIDC request                                                                                                                            | {}                                                                                                                                                            |
+| OIDC_RP_SCOPES                                  | OIDC scopes                                                                                                                                                  | openid email                                                                                                                                                  |
+| OIDC_USE_NONCE                                  | Use nonce for OIDC                                                                                                                                           | true                                                                                                                                                          |
+| OIDC_REDIRECT_REQUIRE_HTTPS                     | Require HTTPS for OIDC                                                                                                                                       | false                                                                                                                                                         |
+| OIDC_REDIRECT_ALLOWED_HOSTS                     | Allowed redirect hosts for OIDC                                                                                                                              | []                                                                                                                                                            |
+| OIDC_STORE_ID_TOKEN                             | Store OIDC ID token                                                                                                                                          | true                                                                                                                                                          |
+| OIDC_REDIRECT_FIELD_NAME                        | Redirect field for OIDC                                                                                                                                      | returnTo                                                                                                                                                      |
+| OIDC_USERINFO_FULLNAME_FIELDS                   | Full name claim from OIDC token                                                                                                                              | ["given_name", "usual_name"]                                                                                                                                  |
+| OIDC_USERINFO_SHORTNAME_FIELD                   | Short name claim from OIDC token                                                                                                                             | given_name                                                                                                                                                    |
+| OIDC_USERINFO_ESSENTIAL_CLAIMS                  | Required claims from OIDC token                                                                                                                              | []                                                                                                                                                            |
+| OIDC_USE_PKCE                                   | Enable the use of PKCE (Proof Key for Code Exchange) during the OAuth 2.0 authorization code flow. Recommended for enhanced security.                        | False                                                                                                                                                         |
+| OIDC_PKCE_CODE_CHALLENGE_METHOD                 | Method used to generate the PKCE code challenge. Common values include S256 and plain. Refer to the mozilla-django-oidc documentation for supported options. | S256                                                                                                                                                          |
+| OIDC_PKCE_CODE_VERIFIER_SIZE                    | Length of the random string used as the PKCE code verifier. Must be an integer between 43 and 128, inclusive.                                                | 64                                                                                                                                                            |
+| LOGIN_REDIRECT_URL                              | Login redirect URL                                                                                                                                           |                                                                                                                                                               |
+| LOGIN_REDIRECT_URL_FAILURE                      | Login redirect URL for failure                                                                                                                               |                                                                                                                                                               |
+| LOGOUT_REDIRECT_URL                             | URL to redirect to on logout                                                                                                                                 |                                                                                                                                                               |
+| ALLOW_LOGOUT_GET_METHOD                         | Allow logout through GET method                                                                                                                              | true                                                                                                                                                          |
+| LIVEKIT_API_KEY                                 | LiveKit API key                                                                                                                                              |                                                                                                                                                               |
+| LIVEKIT_API_SECRET                              | LiveKit API secret                                                                                                                                           |                                                                                                                                                               |
+| LIVEKIT_API_URL                                 | LiveKit API URL                                                                                                                                              |                                                                                                                                                               |
+| LIVEKIT_VERIFY_SSL                              | Verify SSL for LiveKit connections                                                                                                                           | true                                                                                                                                                          |
+| LIVEKIT_FORCE_WSS_PROTOCOL                      | Enables WSS protocol conversion for legacy browser compatibility (Firefox <124, Chrome <125, Edge <125) where HTTPS URLs fail in WebSocket() constructor.    | false                                                                                                                                                         |
+| LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND         | Firefox-only connection warmup: pre-calls WebSocket endpoint (expecting 401) to initialize cache, resolving proxy/network connectivity issues.               | false                                                                                                                                                         |
+| RESOURCE_DEFAULT_ACCESS_LEVEL                   | Default resource access level for rooms                                                                                                                      | public                                                                                                                                                        |
+| ALLOW_UNREGISTERED_ROOMS                        | Allow usage of unregistered rooms                                                                                                                            | true                                                                                                                                                          |
+| RECORDING_ENABLE                                | Record meeting option                                                                                                                                        | false                                                                                                                                                         |
+| RECORDING_OUTPUT_FOLDER                         | Folder to store meetings                                                                                                                                     | recordings                                                                                                                                                    |
 | RECORDING_WORKER_CLASSES                        | Worker classes for recording                                                                                                                                 | {"screen_recording": "core.recording.worker.services.VideoCompositeEgressService","transcript": "core.recording.worker.services.AudioCompositeEgressService"} |
-| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                              |
-| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                              |
-| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                              |
-| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                              |
-| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                              |
-| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                        |
-| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                |
-| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                              |
-| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                           |
-| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                         |
-| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                            |
-| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                   |
-| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                            |
-| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                            |
-| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                              |
-| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                           |
-| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                           |
-| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                             |
-| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                        |
-| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                           |
-| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                            |
+| RECORDING_EVENT_PARSER_CLASS                    | Storage event engine for recording                                                                                                                           | core.recording.event.parsers.MinioParser                                                                                                                      |
+| RECORDING_ENABLE_STORAGE_EVENT_AUTH             | Enable storage event authorization                                                                                                                           | true                                                                                                                                                          |
+| RECORDING_STORAGE_EVENT_ENABLE                  | Enable recording storage events                                                                                                                              | false                                                                                                                                                         |
+| RECORDING_STORAGE_EVENT_TOKEN                   | Recording storage event token                                                                                                                                |                                                                                                                                                               |
+| RECORDING_EXPIRATION_DAYS                       | Recording expiration in days                                                                                                                                 |                                                                                                                                                               |
+| RECORDING_MAX_DURATION                          | Maximum recording duration in milliseconds. Must match LiveKit Egress configuration exactly.                                                                 |                                                                                                                                                               |
+| SCREEN_RECORDING_BASE_URL                       | Screen recording base URL                                                                                                                                    |                                                                                                                                                               |
+| SUMMARY_SERVICE_ENDPOINT                        | Summary service endpoint                                                                                                                                     |                                                                                                                                                               |
+| SUMMARY_SERVICE_API_TOKEN                       | API token for summary service                                                                                                                                |                                                                                                                                                               |
+| SIGNUP_NEW_USER_TO_MARKETING_EMAIL              | Signup users to marketing emails                                                                                                                             | false                                                                                                                                                         |
+| MARKETING_SERVICE_CLASS                         | Marketing service class                                                                                                                                      | core.services.marketing.BrevoMarketingService                                                                                                                 |
+| BREVO_API_KEY                                   | Brevo API key for marketing emails                                                                                                                           |                                                                                                                                                               |
+| BREVO_API_CONTACT_LIST_IDS                      | Brevo API contact list IDs                                                                                                                                   | []                                                                                                                                                            |
+| DJANGO_BREVO_API_CONTACT_ATTRIBUTES             | Brevo contact attributes                                                                                                                                     | {"VISIO_USER": true}                                                                                                                                          |
+| BREVO_API_TIMEOUT                               | Brevo timeout in seconds                                                                                                                                     | 1                                                                                                                                                             |
+| LOBBY_KEY_PREFIX                                | Lobby key prefix                                                                                                                                             | room_lobby                                                                                                                                                    |
+| LOBBY_WAITING_TIMEOUT                           | Lobby waiting timeout in seconds                                                                                                                             | 3                                                                                                                                                             |
+| LOBBY_DENIED_TIMEOUT                            | Lobby deny timeout in seconds                                                                                                                                | 5                                                                                                                                                             |
+| LOBBY_ACCEPTED_TIMEOUT                          | Lobby accept timeout in seconds                                                                                                                              | 21600 (6 hours)                                                                                                                                               |
+| LOBBY_NOTIFICATION_TYPE                         | Lobby notification types                                                                                                                                     | participantWaiting                                                                                                                                            |
+| LOBBY_COOKIE_NAME                               | Lobby cookie name                                                                                                                                            | lobbyParticipantId                                                                                                                                            |
+| ROOM_CREATION_CALLBACK_CACHE_TIMEOUT            | Room creation callback cache timeout                                                                                                                         | 600 (10 minutes)                                                                                                                                              |
+| ROOM_TELEPHONY_ENABLED                          | Enable SIP telephony feature                                                                                                                                 | false                                                                                                                                                         |
+| ROOM_TELEPHONY_PIN_LENGTH                       | Telephony PIN length                                                                                                                                         | 10                                                                                                                                                            |
+| ROOM_TELEPHONY_PIN_MAX_RETRIES                  | Telephony PIN maximum retries                                                                                                                                | 5                                                                                                                                                             |
@@ -16,11 +16,11 @@ info:
    * `rooms:list` – List rooms accessible to the delegated user.
    * `rooms:retrieve` – Retrieve details of a specific room.
    * `rooms:create` – Create new rooms.
-    * `rooms:update` – Update the access level and configuration of existing rooms.
+    * `rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `rooms:delete` – **Coming soon** Delete rooms generated by the application.
-
+    
    #### Upcoming Features
-
+    
    * **Add attendees to a room:** You will be able to update a room to include a list of attendees, allowing them to bypass the lobby system automatically.
    * **Delete application-generated rooms:** Rooms created via the application can be deleted when no longer needed.

@@ -50,24 +50,10 @@ paths:
        
        The application must be authorized for the user's email domain.
        The returned token expires after a configured duration and must be refreshed by calling this endpoint again.
-
-        Request parameters may be sent either as "application/x-www-form-urlencoded"
-        (as specified by RFC 6749 for OAuth 2.0 token endpoints) or as "application/json".
      operationId: generateToken
      requestBody:
        required: true
        content:
-          application/x-www-form-urlencoded:
-            schema:
-              $ref: '#/components/schemas/TokenRequest'
-            examples:
-              tokenRequest:
-                summary: Request token for user delegation
-                value:
-                  client_id: "550e8400-e29b-41d4-a716-446655440000"
-                  client_secret: "1234567890abcdefghijklmnopqrstuvwxyz"
-                  grant_type: "client_credentials"
-                  scope: "user@example.com"
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
@@ -131,19 +117,6 @@ paths:
                  summary: Domain not authorized
                  value:
                    error: "This application is not authorized for this email domain."
-        '415':
-          description: |
-            Unsupported media type. The request body must be sent as
-            "application/x-www-form-urlencoded" or "application/json".
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-              examples:
-                unsupportedMediaType:
-                  summary: Unsupported request content type
-                  value:
-                    detail: 'Unsupported media type "text/plain" in request.'

  /rooms:
    get:
@@ -212,7 +185,6 @@ paths:
                          pin_code: "123456"
                          phone_number: "+1-555-0100"
                          default_country: "US"
-                        configuration: {}
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
@@ -226,6 +198,10 @@ paths:
      description: |
        Creates a new room with secure defaults for external API usage.
        
+        **Restrictions:**
+        - Rooms are always created with `trusted` access (no public rooms via API)
+        - Room access_level can be updated from the webapp interface.
+        
        **Defaults:**
        - Delegated user is set as owner
        - Room slug auto-generated for uniqueness
@@ -242,17 +218,8 @@ paths:
              $ref: '#/components/schemas/RoomCreate'
            examples:
              emptyBody:
-                summary: No parameters (use all defaults)
-                value: { }
-              withAccessLevel:
-                summary: Specify access level
-                value:
-                  access_level: "trusted"
-              withConfiguration:
-                summary: Provide room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
+                summary: No parameters (default)
+                value: {}
      responses:
        '201':
          description: Room created successfully
@@ -302,7 +269,6 @@ paths:
                      pin_code: "123456"
                      phone_number: "+1-555-0100"
                      default_country: "US"
-                    configuration: {}
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
@@ -310,67 +276,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only the delegated user's rooms where they are
-        administrator or owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -439,70 +344,8 @@ components:

    RoomCreate:
      type: object
-      description: |
-        Optional fields for room creation. All fields have secure defaults if omitted.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomConfiguration:
-      type: object
-      description: |
-        Optional room behaviour settings. Unknown fields are rejected.
-        All fields are optional and default to `null` (server-side defaults apply).
-      properties:
-        can_publish_sources:
-          type: array
-          nullable: true
-          description: |
-            Restricts which media tracks participants are allowed to publish.
-            If `null`, all sources are permitted.
-          items:
-            type: string
-            enum:
-              - camera
-              - microphone
-              - screen_share
-              - screen_share_audio
-          example: [ "camera", "microphone" ]
-        everyone_can_mute:
-          type: boolean
-          nullable: true
-          description: |
-            Whether any participant can mute others, or only the room owner/moderator.
-            If `null`, the server default applies.
-          example: true
-      additionalProperties: false
-
-    RoomAccessLevel:
-      type: string
-      enum:
-        - public
-        - trusted
-        - restricted
-      description: |
-        Controls who can join the room without going through the lobby.
-
-        - `public`: Anyone with the room link can join directly, no authentication required.
-        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
-        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
-      example: "trusted"
+      description: Empty object - all room properties are auto-generated
+      properties: {}

    Room:
      type: object
@@ -519,7 +362,10 @@ components:
          description: URL-friendly room identifier (auto-generated)
          example: "aze-eere-zer"
        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
+          type: string
+          readOnly: true
+          description: Room access level (always 'trusted' for API-created rooms)
+          example: "trusted"
        url:
          type: string
          format: uri
@@ -547,8 +393,6 @@ components:
              type: string
              description: Default country code
              example: "US"
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'

    OAuthError:
      type: object
@@ -20,7 +20,7 @@ info:
    * `lasuite_visio:rooms:list` – List rooms accessible to the delegated user.
    * `lasuite_visio:rooms:retrieve` – Retrieve details of a specific room.
    * `lasuite_visio:rooms:create` – Create new rooms.
-    * `lasuite_visio:rooms:update` – Update the access level and configuration of existing rooms.
+    * `lasuite_visio:rooms:update` – **Coming soon** Update existing rooms, e.g., add attendees to a room.
    * `lasuite_visio:rooms:delete` – **Coming soon** Delete rooms generated by the application.
    
    #### Upcoming Features
@@ -48,7 +48,7 @@ paths:
      summary: List rooms
      description: |
        Returns a list of rooms accessible to the authenticated user.
-        Only rooms where the user has access will be returned.
+        Only rooms where the delegated user has access will be returned.
      operationId: listRooms
      security:
        - BearerAuth: [rooms:list]
@@ -108,7 +108,6 @@ paths:
                          pin_code: "123456"
                          phone_number: "+1-555-0100"
                          default_country: "US"
-                        configuration: { }
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
@@ -121,9 +120,13 @@ paths:
      summary: Create a room
      description: |
        Creates a new room with secure defaults for external API usage.
-
+        
+        **Restrictions:**
+        - Rooms are always created with `trusted` access (no public rooms via API)
+        - Room access_level can be updated from the webapp interface.
+        
        **Defaults:**
-        - user is set as owner
+        - Delegated user is set as owner
        - Room slug auto-generated for uniqueness
        - Telephony PIN auto-generated when enabled
        - Creation tracked with application client_id for auditing
@@ -138,17 +141,8 @@ paths:
              $ref: '#/components/schemas/RoomCreate'
            examples:
              emptyBody:
-                summary: No parameters (use all defaults)
-                value: { }
-              withAccessLevel:
-                summary: Specify access level
-                value:
-                  access_level: "trusted"
-              withConfiguration:
-                summary: Provide room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
+                summary: No parameters (default)
+                value: {}
      responses:
        '201':
          description: Room created successfully
@@ -198,7 +192,6 @@ paths:
                      pin_code: "123456"
                      phone_number: "+1-555-0100"
                      default_country: "US"
-                    configuration: { }
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
@@ -206,67 +199,6 @@ paths:
        '404':
          $ref: '#/components/responses/RoomNotFoundError'

-    patch:
-      tags:
-        - Rooms
-      summary: Update a room
-      description: |
-        Partially updates a room. Only rooms where the user is administrator or
-        owner can be updated; any other role gets a `403`.
-
-        **Updatable fields:** `access_level` and `configuration`. Every other field
-        (`id`, `name`, `slug`, `pin_code`) is read-only and silently ignored when sent.
-
-        `configuration` is replaced as a whole, it is not merged with the stored one.
-        Send the complete object you want the room to end up with.
-
-        Full replacement (`PUT`) is not supported. Use `PATCH` instead.
-      operationId: updateRoom
-      security:
-        - BearerAuth: [rooms:update]
-      parameters:
-        - name: id
-          in: path
-          required: true
-          description: Room UUID
-          schema:
-            type: string
-            format: uuid
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RoomUpdate'
-            examples:
-              accessLevelOnly:
-                summary: Change the access level
-                value:
-                  access_level: "restricted"
-              configurationOnly:
-                summary: Replace the room configuration
-                value:
-                  configuration:
-                    everyone_can_mute: true
-      responses:
-        '200':
-          description: Room updated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Room'
-        '400':
-          $ref: '#/components/responses/BadRequestError'
-        '401':
-          $ref: '#/components/responses/UnauthorizedError'
-        '403':
-          $ref: '#/components/responses/ForbiddenError'
-        '404':
-          $ref: '#/components/responses/RoomNotFoundError'
-        '405':
-          description: |
-            Method not allowed, `PUT` is not supported on this endpoint.
-
 components:
  securitySchemes:
    BearerAuth:
@@ -278,72 +210,65 @@ components:
        Include in requests as: `Authorization: Bearer <token>`

  schemas:
+    TokenRequest:
+      type: object
+      required:
+        - client_id
+        - client_secret
+        - grant_type
+        - scope
+      properties:
+        client_id:
+          type: string
+          description: Application client identifier
+          example: "550e8400-e29b-41d4-a716-446655440000"
+        client_secret:
+          type: string
+          format: password
+          writeOnly: true
+          description: Application secret key
+          example: "1234567890abcdefghijklmnopqrstuvwxyz"
+        grant_type:
+          type: string
+          enum:
+            - client_credentials
+          description: OAuth2 grant type (must be 'client_credentials')
+          example: "client_credentials"
+        scope:
+          type: string
+          format: email
+          description: |
+            Email address of the user to delegate.
+            The application will act on behalf of this user.
+            Note: This parameter is named 'scope' to align with OAuth2 conventions,
+            but accepts an email address to identify the user. This design allows
+            for future extensibility.
+          example: "user@example.com"
+
+    TokenResponse:
+      type: object
+      properties:
+        access_token:
+          type: string
+          description: JWT access token
+          example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZWV0LWFwaSIsImF1ZCI6Im1lZXQtY2xpZW50cyIsImlhdCI6MTcwOTQ5MTIwMCwiZXhwIjoxNzA5NDk0ODAwLCJjbGllbnRfaWQiOiI1NTBlODQwMC1lMjliLTQxZDQtYTcxNi00NDY2NTU0NDAwMDAiLCJzY29wZSI6InJvb21zOmxpc3Qgcm9vbXM6cmV0cmlldmUgcm9vbXM6Y3JlYXRlIiwidXNlcl9pZCI6IjdiOGQ5YzQwLTNhMmItNGVkZi04NzFjLTJmM2Q0ZTVmNmE3YiIsImRlbGVnYXRlZCI6dHJ1ZX0.signature"
+        token_type:
+          type: string
+          description: Token type (always 'Bearer')
+          example: "Bearer"
+        expires_in:
+          type: integer
+          description: Token lifetime in seconds
+          example: 3600
+        scope:
+          type: string
+          description: Space-separated list of granted permission scopes
+          example: "rooms:list rooms:retrieve rooms:create"
+
    RoomCreate:
      type: object
-      description: |
-        Optional fields for room creation. All fields have secure defaults if omitted.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomUpdate:
-      type: object
-      description: |
-        Fields that can be updated on an existing room. Both are optional, omitted
-        fields keep their current value.
-      properties:
-        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'
-
-    RoomConfiguration:
-      type: object
-      description: |
-        Optional room behaviour settings. Unknown fields are rejected.
-        All fields are optional and default to `null` (server-side defaults apply).
-      properties:
-        can_publish_sources:
-          type: array
-          nullable: true
-          description: |
-            Restricts which media tracks participants are allowed to publish.
-            If `null`, all sources are permitted.
-          items:
-            type: string
-            enum:
-              - camera
-              - microphone
-              - screen_share
-              - screen_share_audio
-          example: [ "camera", "microphone" ]
-        everyone_can_mute:
-          type: boolean
-          nullable: true
-          description: |
-            Whether any participant can mute others, or only the room owner/moderator.
-            If `null`, the server default applies.
-          example: true
-      additionalProperties: false
-
-    RoomAccessLevel:
-      type: string
-      enum:
-        - public
-        - trusted
-        - restricted
-      description: |
-        Controls who can join the room without going through the lobby.
-
-        - `public`: Anyone with the room link can join directly, no authentication required.
-        - `trusted`: Authenticated users join directly. Unauthenticated users wait in the lobby for approval.
-        - `restricted`: Only participants explicitly trusted by the owner bypass the lobby. Everyone else waits for approval regardless of authentication.
-
-        `public` is rejected with a `400` unless the deployment explicitly enables it
-        for this API. This applies both when creating a room and when updating one.
-      example: "trusted"
+      description: Empty object - all room properties are auto-generated
+      properties: {}

    Room:
      type: object
@@ -360,7 +285,10 @@ components:
          description: URL-friendly room identifier (auto-generated)
          example: "aze-eere-zer"
        access_level:
-          $ref: '#/components/schemas/RoomAccessLevel'
+          type: string
+          readOnly: true
+          description: Room access level (always 'trusted' for API-created rooms)
+          example: "trusted"
        url:
          type: string
          format: uri
@@ -388,8 +316,6 @@ components:
              type: string
              description: Default country code
              example: "US"
-        configuration:
-          $ref: '#/components/schemas/RoomConfiguration'

    OAuthError:
      type: object
@@ -11,14 +11,14 @@ There are two ways to customize LaSuite Meet:

 ### How to Use

-To use this feature, simply set the `FRONTEND_CUSTOM_CSS_URL` environment variable (of the **backend** service) to the URL of your custom CSS file. For example:
+To use this feature, simply set the `FRONTEND_CSS_URL` environment variable to the URL of your custom CSS file. For example:

 ```javascript
-FRONTEND_CUSTOM_CSS_URL=https://example.com/custom-style.css
+FRONTEND_CSS_URL=https://example.com/custom-style.css
 ```

 > [!TIP]
-> If you serve your CSS file on the same domain as LaSuite Meet, paths are supported, i.e. `FRONTEND_CUSTOM_CSS_URL=/custom/style.css` will load `https://your-domain.com/custom/style.css`.
+> If you serve your CSS file on the same domain as LaSuite Meet, paths are supported, i.e. `FRONTEND_CSS_URL=/custom/style.css` will load `https://your-domain.com/custom/style.css`.

 Setting this variable makes the app load your CSS at runtime, adding a `<link>` to `<head>` so you can override CSS variables and customize the frontend without rebuilding.

@@ -34,11 +34,10 @@ Let's say you want to change the font of our application to a custom font. You c

 :root {
  --fonts-sans: 'Roboto', ui-sans-serif, system-ui, sans-serif;
-  --avatar-cap-height: 0.7;
 }
 ```

-Then, set the `FRONTEND_CUSTOM_CSS_URL` environment variable to the URL of your custom CSS file. Once you've done this, our application will load your custom CSS file and apply the styles, changing the default font to the one you specified.
+Then, set the `FRONTEND_CSS_URL` environment variable to the URL of your custom CSS file. Once you've done this, our application will load your custom CSS file and apply the styles, changing the default font to the one you specified.

 > [!IMPORTANT]
 > You can override any CSS token—semantic or palette. See [panda.config.ts](../src/frontend/panda.config.ts) for all defined semantic tokens.
@@ -24,10 +24,9 @@ MEET_BASE_URL="http://localhost:8072"
 # Media
 STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
 AWS_S3_DOMAIN_REPLACE=http://localhost:9000
-AWS_S3_ENDPOINT_URL=http://garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
+AWS_S3_ENDPOINT_URL=http://minio:9000
+AWS_S3_ACCESS_KEY_ID=meet
+AWS_S3_SECRET_ACCESS_KEY=password
 MEDIA_BASE_URL=http://localhost:3000
 FILE_UPLOAD_ENABLED=True

@@ -58,14 +57,14 @@ OIDC_RS_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
 LIVEKIT_API_SECRET=secret
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_URL=http://127.0.0.1.nip.io:7880
-LIVEKIT_INTERNAL_URL=http://livekit:7880
 LIVEKIT_VERIFY_SSL=False
 ALLOW_UNREGISTERED_ROOMS=False

 # Recording
 RECORDING_ENABLE=True
-SUMMARY_SERVICE_VERSION=2
-SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe
+RECORDING_STORAGE_EVENT_ENABLE=True
+RECORDING_STORAGE_EVENT_TOKEN=password
+SUMMARY_SERVICE_ENDPOINT=http://app-summary-dev:8000/api/v2/async-jobs/transcribe/
 SUMMARY_SERVICE_API_TOKEN=password
 SUMMARY_SERVICE_WEBHOOK_API_TOKEN=webhook-password
 RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
@@ -85,16 +84,9 @@ RECORDING_DOWNLOAD_BASE_URL=http://localhost:3000/recording
 # Telephony
 ROOM_TELEPHONY_ENABLED=True

-# RoomKit
-# ROOMKIT_ENABLED = True
-# ROOMKIT_SERVER_TO_SERVER_API_TOKEN = ThisIsAnExampleKeyForDevPurposeOnly
-
 # Metadata
 METADATA_COLLECTOR_ENABLED=True

-# Subtitle
-ROOM_SUBTITLE_ENABLED=False
-
 FRONTEND_USE_FRENCH_GOV_FOOTER=False
 FRONTEND_USE_PROCONNECT_BUTTON=False

@@ -103,7 +95,3 @@ EXTERNAL_API_ENABLED=True
 APPLICATION_JWT_AUDIENCE=http://localhost:8071/external-api/v1.0/
 APPLICATION_JWT_SECRET_KEY=devKey
 APPLICATION_BASE_URL=http://localhost:3000
-
-# Diagnostics
-CONNECTION_TEST_ENABLED = True
-
@@ -1,2 +0,0 @@
-# Filled with a random value by `make create-env-files`
-GARAGE_RPC_SECRET=
@@ -1,10 +0,0 @@
-LIVEKIT_URL=ws://livekit:7880
-LIVEKIT_API_KEY=devkey
-LIVEKIT_API_SECRET=secret
-
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
-AWS_STORAGE_BUCKET_NAME=meet-media-storage
-AWS_S3_SECURE_ACCESS=False
@@ -1,24 +1,9 @@
-AWS_S3_ENDPOINT_URL=garage:9000
-AWS_S3_ACCESS_KEY_ID=meet-access-key
-AWS_S3_SECRET_ACCESS_KEY=meet-secret-access-key
-AWS_S3_REGION_NAME=local
-
 LIVEKIT_URL=ws://livekit:7880
 LIVEKIT_API_KEY=devkey
 LIVEKIT_API_SECRET=secret

-STT_PROVIDER=voxtral-vllm # voxtral-vllm, kyutai, deepgram
+STT_PROVIDER=kyutai
 ENABLE_SILERO_VAD=False

-DEEPGRAM_API_KEY=your-deepgram-api-key
-
-KYUTAI_STT_BASE_URL=url
-KYUTAI_API_KEY=your-kyutai-api-key
-
-VOXTRAL_VLLM_BASE_URL=wss://<host>/v1/realtime
-VOXTRAL_VLLM_MODEL=voxtral-mini-4b-realtime-2602
-VOXTRAL_VLLM_API_KEY=your-vllm-api-key
-VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS=480
-
-SENTRY_DSN=
-SENTRY_ENVIRONMENT=
+KYUTAI_STT_BASE_URL=
+KYUTAI_API_KEY=
@@ -1,13 +1,12 @@
 APP_NAME="meet-app-summary-dev"
 APP_API_TOKEN="password"

-AWS_STORAGE_BUCKET_NAME="meet-media-storage"
-AWS_S3_ENDPOINT_URL="garage:9000"
+AWS_STORAGE_BUCKET_NAME="http://meet-media-storage"
+AWS_S3_ENDPOINT_URL="minio:9000"
 AWS_S3_SECURE_ACCESS=false

-AWS_S3_ACCESS_KEY_ID="meet-access-key"
-AWS_S3_SECRET_ACCESS_KEY="meet-secret-access-key"
-AWS_S3_REGION_NAME="local"
+AWS_S3_ACCESS_KEY_ID="meet"
+AWS_S3_SECRET_ACCESS_KEY="password"

 WHISPERX_BASE_URL="https://configure-your-url.com"
 WHISPERX_ASR_MODEL="large-v2"
@@ -21,14 +20,5 @@ LLM_MODEL="albert-large"
 WEBHOOK_API_TOKEN="secret"
 WEBHOOK_URL="https://configure-your-url.com"

-IS_RESOLVE_SPEAKER_IDENTITIES_ENABLED=true
-RESOLVE_SPEAKER_IDENTITIES_DEFAULT_OVERLAP=0.5
-RESOLVE_SPEAKER_ENABLE_SPLIT_ON_WORDS=true
-RESOLVE_SPEAKER_MAX_WORD_DURATION=1
-
 POSTHOG_API_KEY="your-posthog-key"
 POSTHOG_ENABLED="False"
-
-# Transcription
-TRANSCRIPTION_SATISFACTION_FORM_BASE_URL=
-AUTHORIZED_TENANTS='[{"id": "meet","api_key": "password","webhook_url": "https://configure-your-url.com/api/v1.0/recordings/external-process-hook/","webhook_api_key": "webhook-password","allowed_push_to_docs": true}]'
@@ -3,14 +3,14 @@ Gitlint extra rule to validate that the message title is of the form
 "<gitmoji>(<scope>) <subject>"
 """

-import json
+from __future__ import unicode_literals
+
 import re
-import urllib.request
+
+import requests

 from gitlint.rules import CommitMessageTitle, LineRule, RuleViolation

-GITMOJIS_URL = "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
-

 class GitmojiTitle(LineRule):
    """
@@ -28,9 +28,10 @@ class GitmojiTitle(LineRule):
        Download the list possible gitmojis from the project's github repository and check that
        title contains one of them.
        """
-        with urllib.request.urlopen(GITMOJIS_URL, timeout=10) as response:
-            gitmojis = json.load(response)["gitmojis"]
-        emojis = [re.escape(item["emoji"]) for item in gitmojis]
+        gitmojis = requests.get(
+            "https://raw.githubusercontent.com/carloscuesta/gitmoji/master/packages/gitmojis/src/gitmojis.json"
+        ).json()["gitmojis"]
+        emojis = [item["emoji"] for item in gitmojis]
        pattern = r"^({:s})\(.*\)\s[a-z].*$".format("|".join(emojis))
        if not re.search(pattern, title):
            violation_msg = 'Title does not match regex "<gitmoji>(<scope>) <subject>"'
@@ -1,52 +0,0 @@
-publiccodeYmlVersion: 0.5.0
-name: LaSuite Meet
-applicationSuite: LaSuite
-url: https://github.com/suitenumerique/meet
-releaseDate: 2026-07-22
-platforms:
-  - web
-organisation:
-  name: DINUM
-  uri: https://numerique.gouv.fr
-fundedBy:
-  - name: Direction interministérielle du numérique (DINUM)
-    uri: https://www.numerique.gouv.fr
-developmentStatus: stable
-softwareType: standalone/web
-intendedAudience:
-  countries:
-    - FR
-description:
-  en:
-    localisedName: LaSuite Meet
-    shortDescription: "Open Source video conference solution, based on LiveKit"
-    longDescription: "Open Source video conference application, based on LiveKit,
-      Django and React. It is the official web video conference application of
-      French Ministries."
-    features:
-      - Optimized for stability in large meetings (+100 p.)
-      - Support for multiple screen sharing streams
-      - Non-persistent, secure chat
-      - Meeting recording
-      - Meeting transcription & Summary
-      - Telephony integration
-      - Secure participation with robust authentication and access control
-      - Customizable frontend style
-legal:
-  license: MIT
-maintenance:
-  type: internal
-  contacts:
-    - name: "Samuel Paccoud"
-      email: samuel.paccoud@numerique.gouv.fr
-      affiliation: DINUM
-    - name: "Antoine Lebaud"
-      email: antoine.lebaud.ext@numerique.gouv.fr
-      affiliation: DINUM
-localisation:
-  localisationReady: true
-  availableLanguages:
-    - fr
-    - de
-    - en
-    - nl
@@ -1,5 +1,5 @@
 {
-  "extends": ["github>suitenumerique/ci//renovate/default"],
+  "extends": ["github>numerique-gouv/renovate-configuration"],
  "dependencyDashboard": true,
  "labels": ["dependencies", "noChangeLog"],
  "packageRules": [
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:mailappor="http://schemas.microsoft.com/office/mailappversionoverrides/1.0" xsi:type="MailApp">
  <Id>a025f0f6-757a-4790-97f3-99c66c4a5795</Id>
-  <Version>1.0.0.0</Version>
+  <Version>0.0.1.0</Version>
  <ProviderName>__APP_NAME__</ProviderName>
  <DefaultLocale>fr-FR</DefaultLocale>
  <DisplayName DefaultValue="__APP_NAME__"/>
@@ -87,9 +87,9 @@
                    <Description resid="GenerateLink.Tooltip"/>
                  </Supertip>
                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
+                    <bt:Image size="16" resid="Add.16x16"/>
+                    <bt:Image size="32" resid="Add.32x32"/>
+                    <bt:Image size="80" resid="Add.80x80"/>
                  </Icon>
                  <Action xsi:type="ExecuteFunction">
                    <FunctionName>generateMeetingLinkFromMail</FunctionName>
@@ -126,9 +126,9 @@
                    <Description resid="GenerateLink.Tooltip"/>
                  </Supertip>
                  <Icon>
-                    <bt:Image size="16" resid="Icon.16x16"/>
-                    <bt:Image size="32" resid="Icon.32x32"/>
-                    <bt:Image size="80" resid="Icon.80x80"/>
+                    <bt:Image size="16" resid="Add.16x16"/>
+                    <bt:Image size="32" resid="Add.32x32"/>
+                    <bt:Image size="80" resid="Add.80x80"/>
                  </Icon>
                  <Action xsi:type="ExecuteFunction">
                    <FunctionName>generateMeetingLinkFromCalendar</FunctionName>
@@ -175,204 +175,16 @@
        <bt:Url id="Taskpane.Url" DefaultValue="https://localhost:3000/taskpane.html"/>
      </bt:Urls>
      <bt:ShortStrings>
-        <!-- Default (French) -->
        <bt:String id="GroupLabel" DefaultValue="__APP_NAME__"/>
-        <bt:String id="GenerateLink.Label" DefaultValue="Ajouter un lien __APP_NAME__">
-          <bt:Override Locale="en-US" Value="Add a __APP_NAME__ link"/>
-          <bt:Override Locale="de-DE" Value="__APP_NAME__-Link hinzufügen"/>
-        </bt:String>
-        <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir les paramètres">
-          <bt:Override Locale="en-US" Value="Open settings"/>
-          <bt:Override Locale="de-DE" Value="Einstellungen öffnen"/>
-        </bt:String>
-        <bt:String id="OpenSettings.Label" DefaultValue="Paramètres">
-          <bt:Override Locale="en-US" Value="Settings"/>
-          <bt:Override Locale="de-DE" Value="Einstellungen"/>
-        </bt:String>
+        <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir les paramètres"/>
+        <bt:String id="GenerateLink.Label" DefaultValue="Ajouter un lien __APP_NAME__"/>
+        <bt:String id="OpenSettings.Label" DefaultValue="Paramètres"/>
      </bt:ShortStrings>
      <bt:LongStrings>
-        <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion __APP_NAME__ et l'insère dans l'événement.">
-          <bt:Override Locale="de-DE" Value="Generiert einen __APP_NAME__-Besprechungslink und fügt ihn in den Termin ein."/>
-          <bt:Override Locale="en-US" Value="Generates a __APP_NAME__ meeting link and inserts it into the item."/>
-        </bt:String>
-        <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-          <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-          <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-        </bt:String>
-        <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-          <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-          <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-        </bt:String>
+        <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__."/>
+        <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion __APP_NAME__ et l'insère dans l'événement."/>
+        <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__."/>
      </bt:LongStrings>
    </Resources>
-
-    <!-- ─── V1.1 override: required for shared folder / delegate support ─── -->
-    <VersionOverrides xmlns="http://schemas.microsoft.com/office/mailappversionoverrides/1.1" xsi:type="VersionOverridesV1_1">
-      <Requirements>
-        <bt:Sets DefaultMinVersion="1.8">
-          <bt:Set Name="Mailbox"/>
-        </bt:Sets>
-      </Requirements>
-      <Hosts>
-        <Host xsi:type="MailHost">
-          <DesktopFormFactor>
-            <FunctionFile resid="Commands.Url"/>
-            <SupportsSharedFolders>true</SupportsSharedFolders>
-
-            <!-- ─── Mail: Read ─────────────────────────────────────────── -->
-            <ExtensionPoint xsi:type="MessageReadCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="msgReadGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="msgReadOpenPaneButton">
-                    <Label resid="TaskpaneButton.Label"/>
-                    <Supertip>
-                      <Title resid="TaskpaneButton.Label"/>
-                      <Description resid="TaskpaneButton.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-            <!-- ─── Mail: Compose ─────────────────────────────────────── -->
-            <ExtensionPoint xsi:type="MessageComposeCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="msgComposeGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="msgComposeGenerateLinkButton">
-                    <Label resid="GenerateLink.Label"/>
-                    <Supertip>
-                      <Title resid="GenerateLink.Label"/>
-                      <Description resid="GenerateLink.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ExecuteFunction">
-                      <FunctionName>generateMeetingLinkFromMail</FunctionName>
-                    </Action>
-                  </Control>
-                  <Control xsi:type="Button" id="msgComposeOpenPaneButton">
-                    <Label resid="TaskpaneButton.Label"/>
-                    <Supertip>
-                      <Title resid="TaskpaneButton.Label"/>
-                      <Description resid="TaskpaneButton.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Settings.16x16"/>
-                      <bt:Image size="32" resid="Settings.32x32"/>
-                      <bt:Image size="80" resid="Settings.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-            <!-- ─── Calendar: Compose (New/Edit appointment) ──────────── -->
-            <ExtensionPoint xsi:type="AppointmentOrganizerCommandSurface">
-              <OfficeTab id="TabDefault">
-                <Group id="apptComposeGroup">
-                  <Label resid="GroupLabel"/>
-                  <Control xsi:type="Button" id="apptGenerateLinkButton">
-                    <Label resid="GenerateLink.Label"/>
-                    <Supertip>
-                      <Title resid="GenerateLink.Label"/>
-                      <Description resid="GenerateLink.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Icon.16x16"/>
-                      <bt:Image size="32" resid="Icon.32x32"/>
-                      <bt:Image size="80" resid="Icon.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ExecuteFunction">
-                      <FunctionName>generateMeetingLinkFromCalendar</FunctionName>
-                    </Action>
-                  </Control>
-
-                  <Control xsi:type="Button" id="apptOpenSettingsButton">
-                    <Label resid="OpenSettings.Label"/>
-                    <Supertip>
-                      <Title resid="OpenSettings.Label"/>
-                      <Description resid="OpenSettings.Tooltip"/>
-                    </Supertip>
-                    <Icon>
-                      <bt:Image size="16" resid="Settings.16x16"/>
-                      <bt:Image size="32" resid="Settings.32x32"/>
-                      <bt:Image size="80" resid="Settings.80x80"/>
-                    </Icon>
-                    <Action xsi:type="ShowTaskpane">
-                      <SourceLocation resid="Taskpane.Url"/>
-                    </Action>
-                  </Control>
-
-                </Group>
-              </OfficeTab>
-            </ExtensionPoint>
-
-          </DesktopFormFactor>
-        </Host>
-      </Hosts>
-      <Resources>
-        <bt:Images>
-          <bt:Image id="Settings.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-16.png"/>
-          <bt:Image id="Settings.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-32.png"/>
-          <bt:Image id="Settings.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/settings-80.png"/>
-          <bt:Image id="Add.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/add-16.png"/>
-          <bt:Image id="Add.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/add-32.png"/>
-          <bt:Image id="Add.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/add-80.png"/>
-          <bt:Image id="Icon.16x16" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-16.png"/>
-          <bt:Image id="Icon.32x32" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-32.png"/>
-          <bt:Image id="Icon.80x80" DefaultValue="https://localhost:3000/addons/outlook/assets/icon-80.png"/>
-        </bt:Images>
-        <bt:Urls>
-          <bt:Url id="Commands.Url" DefaultValue="https://localhost:3000/addons/outlook/commands.html"/>
-          <bt:Url id="Taskpane.Url" DefaultValue="https://localhost:3000/addons/outlook/taskpane.html"/>
-        </bt:Urls>
-        <bt:ShortStrings>
-          <!-- Default (French) -->
-          <bt:String id="GroupLabel" DefaultValue="__APP_NAME__"/>
-          <bt:String id="GenerateLink.Label" DefaultValue="Ajouter un lien __APP_NAME__">
-            <bt:Override Locale="en-US" Value="Add a __APP_NAME__ link"/>
-            <bt:Override Locale="de-DE" Value="__APP_NAME__-Link hinzufügen"/>
-          </bt:String>
-          <bt:String id="TaskpaneButton.Label" DefaultValue="Ouvrir les paramètres">
-            <bt:Override Locale="en-US" Value="Open settings"/>
-            <bt:Override Locale="de-DE" Value="Einstellungen öffnen"/>
-          </bt:String>
-          <bt:String id="OpenSettings.Label" DefaultValue="Paramètres">
-            <bt:Override Locale="en-US" Value="Settings"/>
-            <bt:Override Locale="de-DE" Value="Einstellungen"/>
-          </bt:String>
-        </bt:ShortStrings>
-        <bt:LongStrings>
-          <bt:String id="GenerateLink.Tooltip" DefaultValue="Génère un lien de réunion __APP_NAME__ et l'insère dans l'événement.">
-            <bt:Override Locale="de-DE" Value="Generiert einen __APP_NAME__-Besprechungslink und fügt ihn in den Termin ein."/>
-            <bt:Override Locale="en-US" Value="Generates a __APP_NAME__ meeting link and inserts it into the item."/>
-          </bt:String>
-          <bt:String id="TaskpaneButton.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-            <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-            <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-          </bt:String>
-          <bt:String id="OpenSettings.Tooltip" DefaultValue="Ouvre les paramètres de connexion __APP_NAME__.">
-            <bt:Override Locale="de-DE" Value="Öffnet die __APP_NAME__-Verbindungseinstellungen."/>
-            <bt:Override Locale="en-US" Value="Opens the __APP_NAME__ connection settings."/>
-          </bt:String>
-        </bt:LongStrings>
-      </Resources>
-    </VersionOverrides>
  </VersionOverrides>
 </OfficeApp>
@@ -9,35 +9,33 @@
      "version": "0.0.1",
      "license": "MIT",
      "dependencies": {
-        "core-js": "3.50.0",
-        "i18next": "26.4.2",
-        "i18next-browser-languagedetector": "8.2.1",
-        "regenerator-runtime": "0.14.1"
+        "core-js": "^3.36.0",
+        "regenerator-runtime": "^0.14.1"
      },
      "devDependencies": {
-        "@babel/core": "7.29.0",
-        "@babel/preset-env": "7.29.0",
-        "@types/office-js": "1.0.582",
-        "@types/office-runtime": "1.0.36",
-        "acorn": "8.16.0",
-        "babel-loader": "9.2.1",
-        "copy-webpack-plugin": "14.0.0",
-        "eslint-plugin-office-addins": "4.0.6",
-        "file-loader": "6.2.0",
-        "html-loader": "5.1.0",
-        "html-webpack-inject-attributes-plugin": "1.0.6",
-        "html-webpack-plugin": "5.6.6",
-        "office-addin-cli": "2.0.6",
-        "office-addin-debugging": "6.0.6",
-        "office-addin-dev-certs": "2.0.6",
-        "office-addin-lint": "3.0.6",
-        "office-addin-manifest": "2.1.2",
-        "office-addin-prettier-config": "2.0.1",
-        "os-browserify": "0.3.0",
-        "process": "0.11.10",
-        "source-map-loader": "5.0.0",
-        "webpack": "5.105.4",
-        "webpack-cli": "5.1.4",
+        "@babel/core": "^7.24.0",
+        "@babel/preset-env": "^7.25.4",
+        "@types/office-js": "^1.0.377",
+        "@types/office-runtime": "^1.0.35",
+        "acorn": "^8.11.3",
+        "babel-loader": "^9.1.3",
+        "copy-webpack-plugin": "^14.0.0",
+        "eslint-plugin-office-addins": "^4.0.3",
+        "file-loader": "^6.2.0",
+        "html-loader": "^5.0.0",
+        "html-webpack-inject-attributes-plugin": "^1.0.6",
+        "html-webpack-plugin": "^5.6.0",
+        "office-addin-cli": "^2.0.3",
+        "office-addin-debugging": "^6.0.3",
+        "office-addin-dev-certs": "^2.0.3",
+        "office-addin-lint": "^3.0.3",
+        "office-addin-manifest": "^2.0.3",
+        "office-addin-prettier-config": "^2.0.1",
+        "os-browserify": "^0.3.0",
+        "process": "^0.11.10",
+        "source-map-loader": "^5.0.0",
+        "webpack": "^5.95.0",
+        "webpack-cli": "^5.1.4",
        "webpack-dev-server": "5.2.4"
      }
    },
@@ -2113,7 +2111,9 @@
      "version": "7.28.6",
      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
+      "dev": true,
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=6.9.0"
      }
@@ -6863,14 +6863,11 @@
      }
    },
    "node_modules/core-js": {
-      "version": "3.50.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.50.0.tgz",
-      "integrity": "sha512-BRWgOLKkFeCgRudR6zrs8p9XJZcE14grzKMMssoYrk6krtuEZ7MTKPIY5RzOnqsEKIR9kst7wNzphttraT+Yqw==",
+      "version": "3.48.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
+      "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
      "hasInstallScript": true,
      "license": "MIT",
-      "engines": {
-        "node": "*"
-      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/core-js"
@@ -9366,43 +9363,6 @@
        "node": ">=10.18"
      }
    },
-    "node_modules/i18next": {
-      "version": "26.4.2",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.2.tgz",
-      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://www.locize.com/i18next"
-        },
-        {
-          "type": "individual",
-          "url": "https://www.i18next.com/how-to/faq#i18next-is-awesome.-how-can-i-support-the-project"
-        },
-        {
-          "type": "individual",
-          "url": "https://www.locize.com"
-        }
-      ],
-      "license": "MIT",
-      "peerDependencies": {
-        "typescript": "^5 || ^6 || ^7"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/i18next-browser-languagedetector": {
-      "version": "8.2.1",
-      "resolved": "https://registry.npmjs.org/i18next-browser-languagedetector/-/i18next-browser-languagedetector-8.2.1.tgz",
-      "integrity": "sha512-bZg8+4bdmaOiApD7N7BPT9W8MLZG+nPTOFlLiJiT8uzKXFjhxw4v2ierCXOwB5sFDMtuA5G4kgYZ0AznZxQ/cw==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.23.2"
-      }
-    },
    "node_modules/iconv-lite": {
      "version": "0.6.3",
      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
@@ -15253,7 +15213,7 @@
      "version": "5.9.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "devOptional": true,
+      "dev": true,
      "license": "Apache-2.0",
      "bin": {
        "tsc": "bin/tsc",
@@ -26,35 +26,33 @@
    "watch": "webpack --mode development --watch"
  },
  "dependencies": {
-    "core-js": "3.50.0",
-    "i18next": "26.4.2",
-    "i18next-browser-languagedetector": "8.2.1",
-    "regenerator-runtime": "0.14.1"
+    "core-js": "^3.36.0",
+    "regenerator-runtime": "^0.14.1"
  },
  "devDependencies": {
-    "@babel/core": "7.29.0",
-    "@babel/preset-env": "7.29.0",
-    "@types/office-js": "1.0.582",
-    "@types/office-runtime": "1.0.36",
-    "acorn": "8.16.0",
-    "babel-loader": "9.2.1",
-    "copy-webpack-plugin": "14.0.0",
-    "eslint-plugin-office-addins": "4.0.6",
-    "file-loader": "6.2.0",
-    "html-loader": "5.1.0",
-    "html-webpack-inject-attributes-plugin": "1.0.6",
-    "html-webpack-plugin": "5.6.6",
-    "office-addin-cli": "2.0.6",
-    "office-addin-debugging": "6.0.6",
-    "office-addin-dev-certs": "2.0.6",
-    "office-addin-lint": "3.0.6",
-    "office-addin-manifest": "2.1.2",
-    "office-addin-prettier-config": "2.0.1",
-    "os-browserify": "0.3.0",
-    "process": "0.11.10",
-    "source-map-loader": "5.0.0",
-    "webpack": "5.105.4",
-    "webpack-cli": "5.1.4",
+    "@babel/core": "^7.24.0",
+    "@babel/preset-env": "^7.25.4",
+    "@types/office-js": "^1.0.377",
+    "@types/office-runtime": "^1.0.35",
+    "acorn": "^8.11.3",
+    "babel-loader": "^9.1.3",
+    "copy-webpack-plugin": "^14.0.0",
+    "eslint-plugin-office-addins": "^4.0.3",
+    "file-loader": "^6.2.0",
+    "html-loader": "^5.0.0",
+    "html-webpack-inject-attributes-plugin": "^1.0.6",
+    "html-webpack-plugin": "^5.6.0",
+    "office-addin-cli": "^2.0.3",
+    "office-addin-debugging": "^6.0.3",
+    "office-addin-dev-certs": "^2.0.3",
+    "office-addin-lint": "^3.0.3",
+    "office-addin-manifest": "^2.0.3",
+    "office-addin-prettier-config": "^2.0.1",
+    "os-browserify": "^0.3.0",
+    "process": "^0.11.10",
+    "source-map-loader": "^5.0.0",
+    "webpack": "^5.95.0",
+    "webpack-cli": "^5.1.4",
    "webpack-dev-server": "5.2.4"
  },
  "prettier": "office-addin-prettier-config",
@@ -1,18 +1,12 @@
 /* global Office */
-const { APP_NAME } = require("../common/index");
 const { createRoom, initSession } = require("../common/api");
 const { startPolling } = require("../common/polling");
 const { saveSession, loadSession } = require("../common/session");
 const { openTransitDialog } = require("../common/transitDialog");
 const { buildMeetingMessage } = require("../common/messageBuilder");
 const { applyAppName } = require("../common/helpers");
-const { initI18n, t } = require("../common/i18n");
-const { isMeetingAlreadyAdded } = require("../common/meetingDetector");
-
-Office.onReady(async function (info) {
-
-  await initI18n()

+Office.onReady(function (info) {
  if (info.host === Office.HostType.Outlook) {
    applyAppName();
  }
@@ -28,52 +22,41 @@ function notify(message) {
 }

 function insertMeetingLink(event, session) {
-  const item = Office.context.mailbox.item;
-
-  isMeetingAlreadyAdded(item)
-    .then((alreadyAdded) => {
-      if (alreadyAdded) {
-        notify(t("meeting.already_added", { app_name: APP_NAME }));
-        event.completed();
-        return;
-      }
-      return _doInsertMeetingLink(event, session);
-    })
-    .catch((err) => {
-      notify(t("meeting.error.details", { message: err.message }));
-      event.completed();
-    });
-}
-
-function _doInsertMeetingLink(event, session) {
  createRoom(session)
    .then((data) => {
-      const isWeb = Office.context.diagnostics.platform === "OfficeOnline";
-      const { url, text } = buildMeetingMessage(data, isWeb);
+      const { url, message } = buildMeetingMessage(data);
      const item = Office.context.mailbox.item;
-      const coercionType = isWeb ? Office.CoercionType.Html : Office.CoercionType.Text;

      return new Promise((resolve, reject) => {
-        item.body.setSelectedDataAsync(text, { coercionType }, (setResult) => {
-          if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
-            notify(t("meeting.error.details", { message: setResult.error.message }));
+        item.body.getAsync(Office.CoercionType.Html, (getResult) => {
+          if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
+            notify(`Erreur de lecture : ${getResult.error.message}`);
            resolve();
            return;
          }

-          if (item.itemType !== Office.MailboxEnums.ItemType.Appointment) {
-            notify(t("meeting.link_inserted"));
-            resolve();
-            return;
-          }
-
-          item.location.setAsync(url, (locationResult) => {
-            if (locationResult.status !== Office.AsyncResultStatus.Succeeded) {
-              notify(t("meeting.error.details", { message: locationResult.error.message }));
-            } else {
-              notify(t("meeting.link_inserted"));
+          const newBody = getResult.value + message;
+          item.body.setAsync(newBody, { coercionType: Office.CoercionType.Html }, (setResult) => {
+            if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
+              notify(`Erreur d'insertion : ${setResult.error.message}`);
+              resolve();
+              return;
            }
-            resolve();
+
+            if (item.itemType !== Office.MailboxEnums.ItemType.Appointment) {
+              notify("Lien de réunion inséré !");
+              resolve();
+              return;
+            }
+
+            item.location.setAsync(url, (locationResult) => {
+              if (locationResult.status !== Office.AsyncResultStatus.Succeeded) {
+                notify(`Erreur de localisation : ${locationResult.error.message}`);
+              } else {
+                notify("Lien de réunion inséré !");
+              }
+              resolve();
+            });
          });
        });
      });
@@ -96,11 +79,11 @@ function connect(event) {
          });
        },
        onTimeout: () => {
-          notify(t("meeting.error.auth"));
+          notify("Connexion expirée, veuillez réessayer.");
          event.completed();
        },
        onError: (err) => {
-          notify(t("meeting.error.retry"));
+          notify("Une erreur est survenue, veuillez ré-essayer");
          event.completed();
        },
      });
@@ -116,7 +99,7 @@ function connect(event) {
      });
    })
    .catch((err) => {
-      notify(t("meeting.error.details", { message: err.message }));
+      notify(`Erreur : ${err.message}`);
      event.completed();
    });
 }
@@ -1,48 +0,0 @@
-const { APP_NAME } = require("../common");
-
-const i18nextModule = require("i18next");
-const i18next = i18nextModule.default || i18nextModule;
-
-const fr = require("../locales/fr/translation.json");
-const en = require("../locales/en/translation.json");
-const de = require("../locales/de/translation.json");
-
-async function initI18n() {
-  const lng = typeof Office !== "undefined" ? Office.context.displayLanguage : navigator.language;
-
-  await i18next.init({
-    lng,
-    fallbackLng: "fr",
-    interpolation: { escapeValue: false },
-    resources: {
-      fr: { translation: fr },
-      en: { translation: en },
-      de: { translation: de },
-    },
-  });
-}
-
-function t(key, vars) {
-  return i18next.t(key, vars);
-}
-
-function translateUI() {
-  document.querySelectorAll("[data-i18n]").forEach((el) => {
-    const key = el.getAttribute("data-i18n");
-    el.textContent = t(key, { app_name: APP_NAME });
-  });
-
-  document.querySelectorAll("[data-i18n-attr]").forEach((el) => {
-    const pairs = el.getAttribute("data-i18n-attr").split(",");
-    pairs.forEach((pair) => {
-      const [attr, key] = pair.split(":");
-      el.setAttribute(attr, t(key, { app_name: APP_NAME }));
-    });
-  });
-
-  document.querySelectorAll("[data-i18n-aria]").forEach((el) => {
-    el.setAttribute("aria-label", t(el.getAttribute("data-i18n-aria")));
-  });
-}
-
-module.exports = { initI18n, t, translateUI };
@@ -1,11 +1,7 @@
 const BASE_URL = window.__APP_CONFIG__?.BASE_URL || "https://meet.127.0.0.1.nip.io";
 const APP_NAME = window.__APP_CONFIG__?.APP_NAME || "LaSuite Meet";
-const ENABLE_SOURCE_TRACKING = window.__APP_CONFIG__?.ENABLE_SOURCE_TRACKING === "true";
-const FEEDBACK_FORM = window.__APP_CONFIG__?.FEEDBACK_FORM || null;

 module.exports = {
  BASE_URL,
  APP_NAME,
-  ENABLE_SOURCE_TRACKING,
-  FEEDBACK_FORM
 };
@@ -1,107 +0,0 @@
-const { BASE_URL } = require("./index");
-
-/**
- * Returns a promise that resolves to true if a meeting link is already present
- */
-function isMeetingAlreadyAdded(item) {
-  return Promise.all([_checkBody(item), _checkLocation(item)]).then(
-    ([inBody, inLocation]) => inBody || inLocation
-  );
-}
-
-function _checkBody(item) {
-  return new Promise((resolve) => {
-    item.body.getAsync(Office.CoercionType.Text, (result) => {
-      if (result.status !== Office.AsyncResultStatus.Succeeded) {
-        resolve(false);
-        return;
-      }
-      resolve(_containsMeetingUrl(result.value));
-    });
-  });
-}
-
-function _checkLocation(item) {
-  // Location only exists on appointments
-  if (item.itemType !== Office.MailboxEnums.ItemType.Appointment) {
-    return Promise.resolve(false);
-  }
-  return new Promise((resolve) => {
-    item.location.getAsync((result) => {
-      if (result.status !== Office.AsyncResultStatus.Succeeded) {
-        resolve(false);
-        return;
-      }
-      resolve(_containsMeetingUrl(result.value));
-    });
-  });
-}
-
-function _containsMeetingUrl(text) {
-  if (!text) return false;
-  return text.includes(BASE_URL);
-}
-
-function removeMeetingLink(item) {
-  return Promise.all([_removeFromBody(item), _removeFromLocation(item)]);
-}
-
-function _removeFromBody(item) {
-  return new Promise((resolve) => {
-    item.body.getAsync(Office.CoercionType.Html, (result) => {
-      if (result.status !== Office.AsyncResultStatus.Succeeded) {
-        resolve();
-        return;
-      }
-      const cleaned = _cleanBody(result.value || "");
-      if (cleaned === null) {
-        resolve();
-        return;
-      }
-      item.body.setAsync(cleaned, { coercionType: Office.CoercionType.Html }, () => resolve());
-    });
-  });
-}
-
-function _removeFromLocation(item) {
-  if (item.itemType !== Office.MailboxEnums.ItemType.Appointment) {
-    return Promise.resolve();
-  }
-  return new Promise((resolve) => {
-    item.location.getAsync((result) => {
-      if (
-        result.status === Office.AsyncResultStatus.Succeeded &&
-        _containsMeetingUrl(result.value)
-      ) {
-        item.location.setAsync("", () => resolve());
-      } else {
-        resolve();
-      }
-    });
-  });
-}
-
-const SEPARATOR = /─{10,}/;
-
-/**
- * Returns cleaned HTML, or null if no meeting block was found.
- */
-function _cleanBody(html) {
-  const doc = new DOMParser().parseFromString(html, "text/html");
-
-  const hits = [];
-  const walker = doc.createTreeWalker(doc.body, NodeFilter.SHOW_TEXT);
-  while (walker.nextNode()) {
-    if (SEPARATOR.test(walker.currentNode.nodeValue)) hits.push(walker.currentNode);
-  }
-  if (hits.length < 2) return null;
-
-  const range = doc.createRange();
-  range.setStartBefore(hits[0]);
-  range.setEndAfter(hits[hits.length - 1]);
-  range.deleteContents();
-
-  return doc.documentElement.outerHTML;
-}
-
-module.exports = { isMeetingAlreadyAdded, removeMeetingLink };
@@ -1,5 +1,4 @@
-const { APP_NAME, ENABLE_SOURCE_TRACKING } = require("./index");
-const { t } = require("./i18n");
+const { APP_NAME } = require("./index");

 function _formatPin(pin) {
  if (!pin) return "";
@@ -21,59 +20,33 @@ function _formatPhone(phone) {
  return clean;
 }

-function _appendTrackingParams(url) {
-  if (!ENABLE_SOURCE_TRACKING) return url;
-  const u = new URL(url);
-  u.searchParams.set("from", "outlook-addin");
-  return u.toString();
-}
-
-
 // todo - escape html / link
-function buildMeetingMessage(data, isWeb) {
+function buildMeetingMessage(data) {
  if (!data?.url) {
    throw new Error("buildMeetingMessage: missing url in data");
  }

-  const url = _appendTrackingParams(data.url);
+  const url = data.url;
  const phone = _formatPhone(data.telephony?.phone_number);
  const pin = _formatPin(data.telephony?.pin_code);

-  let textLines = "";
-  let phoneLines = [];
+  const telephonyBlock =
+    phone && pin
+      ? `

-  const join = t("meeting_message.join", { app_name: APP_NAME });
-  const phoneOnly = t("meeting_message.phone_only");
-  const phoneFr = t("meeting_message.phone_fr", { phone });
-  const pinCode = t("meeting_message.pin_code", { pin });
+Ou appelez (audio uniquement)
+(FR) ${phone}
+Code : ${pin}`
+      : "";

-  if (isWeb) {
-    phoneLines = phone && pin ? [`<br><br>${phoneOnly}`, `<br>${phoneFr}`, `<br>${pinCode}`] : [];
+  const message = `<pre style="font-family:inherit; font-size:inherit; border:none; background:none; margin:16px 0;">
+────────────────────────────────────────
+Rejoindre la réunion ${APP_NAME}

-    textLines = [
-      "<br><br>────────────────────────────────────────",
-      `<br>${join}`,
-      `<br><br><a href="${url}" target="_blank">${url}</a>`,
-      ...phoneLines,
-      "<br>────────────────────────────────────────<br>",
-    ];
+<a href="${url}">${url}</a>${telephonyBlock}
+────────────────────────────────────────</pre>`;

-  } else {
-
-    phoneLines = phone && pin ? [`\n\n${phoneOnly}`, `\n${phoneFr}`, `\n${pinCode}`] : [];
-
-    textLines = [
-      "\n\n────────────────────────────────────────",
-      `\n${join}`,
-      `\n\n${url}`,
-      ...phoneLines,
-      "\n────────────────────────────────────────\n",
-    ];
-  }
-
-  const text = textLines.join("");
-
-  return { url, text };
+  return { url, message };
 }

 module.exports = { buildMeetingMessage };
@@ -1,40 +0,0 @@
-{
-  "app": {
-    "sideload": "Laden Sie das Add-In.",
-    "loading": "Wird geladen..."
-  },
-  "unauth": {
-    "intro": "Fügen Sie Ihren Outlook-Terminen ganz einfach einen {{app_name}}-Besprechungslink hinzu.",
-    "proconnect_btn": "Aanmelden met ProConnect",
-    "proconnect_link": "Wat is ProConnect?",
-    "proconnect_link_title": "Wat is ProConnect? - nieuw venster"
-  },
-  "success": {
-    "close_window": "Falls sich dieses Fenster nicht automatisch schließt, schließen Sie es bitte manuell."
-  },
-  "auth": {
-    "disconnect": "Abmelden"
-  },
-  "meeting": {
-    "already_added": "Es wurde bereits ein {{app_name}}-Meeting hinzugefügt.",
-    "link_inserted": "Besprechungslink erfolgreich eingefügt",
-    "generating": "Wird erstellt...",
-    "add_meeting": "{{app_name}}-Besprechung hinzufügen",
-    "remove_meeting": "{{app_name}}-Besprechung entfernen",
-    "removing": "Wird entfernt...",
-    "error": {
-      "auth": "Ihre Sitzung ist abgelaufen. Bitte versuchen Sie es erneut.",
-      "retry": "Es ist ein Fehler aufgetreten. Bitte versuchen Sie es erneut.",
-      "details": "Fehler: {{message}}"
-    }
-  },
-  "meeting_message": {
-    "join": "An der {{app_name}}-Besprechung teilnehmen",
-    "phone_only": "Oder per Telefon teilnehmen (nur Audio)",
-    "phone_fr": "(FR) {{phone}}",
-    "pin_code": "Code {{pin}}"
-  },
-  "footer": {
-    "feedback": "Teilen Sie uns Ihr Feedback mit"
-  }
-}
@@ -1,40 +0,0 @@
-{
-  "app": {
-    "sideload": "Please load the add-in.",
-    "loading": "Loading..."
-  },
-  "unauth": {
-    "intro": "Easily add a {{app_name}} meeting link to your Outlook events.",
-    "proconnect_btn": "Sign in with ProConnect",
-    "proconnect_link": "What is ProConnect?",
-    "proconnect_link_title": "What is ProConnect? - new window"
-  },
-  "success": {
-    "close_window": "If this window does not close automatically, please close it manually."
-  },
-  "auth": {
-    "disconnect": "Sign out"
-  },
-  "meeting": {
-    "already_added": "A {{app_name}} meeting has already been added.",
-    "link_inserted": "Meeting link inserted successfully",
-    "generating": "Generating...",
-    "add_meeting": "Add a {{app_name}} meeting",
-    "remove_meeting": "Remove the {{app_name}} meeting",
-    "removing": "Removing...",
-    "error": {
-      "auth": "Your session has expired. Please try again.",
-      "retry": "An error occurred. Please try again.",
-      "details": "Error: {{message}}"
-    }
-  },
-  "meeting_message": {
-    "join": "Join the {{app_name}} meeting",
-    "phone_only": "Or call in (audio only)",
-    "phone_fr": "(FR) {{phone}}",
-    "pin_code": "Code {{pin}}"
-  },
-  "footer": {
-    "feedback": "Share your feedback"
-  }
-}
@@ -1,40 +0,0 @@
-{
-  "app": {
-    "sideload": "Veuillez charger le complément.",
-    "loading": "Chargement..."
-  },
-  "unauth": {
-    "intro": "Ajoutez facilement un lien de réunion {{app_name}} à vos événements Outlook.",
-    "proconnect_btn": "S'identifier avec ProConnect",
-    "proconnect_link": "Qu'est-ce que ProConnect ?",
-    "proconnect_link_title": "Qu'est-ce que ProConnect ? - nouvelle fenêtre"
-  },
-  "success": {
-    "close_window": "Si cette fenêtre ne se ferme pas toute seule, veuillez la fermer manuellement."
-  },
-  "auth": {
-    "disconnect": "Se déconnecter"
-  },
-  "meeting": {
-    "already_added": "Une réunion {{app_name}} a déjà été ajoutée.",
-    "link_inserted": "Lien de réunion inséré avec succès",
-    "generating": "Génération...",
-    "add_meeting": "Ajouter une réunion {{app_name}}",
-    "remove_meeting": "Supprimer la réunion {{app_name}}",
-    "removing": "Suppression en cours...",
-    "error": {
-      "auth": "Connexion expirée, veuillez réessayer.",
-      "retry": "Une erreur est survenue, veuillez ré-essayer",
-      "details": "Erreur : {{message}}"
-    }
-  },
-  "meeting_message": {
-    "join": "Rejoindre la réunion {{app_name}}",
-    "phone_only": "Ou appelez (audio uniquement)",
-    "phone_fr": "(FR) {{phone}}",
-    "pin_code": "Code {{pin}}"
-  },
-  "footer": {
-    "feedback": "Partagez-nous vos retours"
-  }
-}
@@ -9,10 +9,10 @@
    <script nonce="NONCE_PLACEHOLDER" src="/addons/outlook/config.js"></script>
 </head>
    <body>
-        <div id="sideload-msg" data-i18n="app.sideload"></div>
+        <div id="sideload-msg">Veuillez charger le complément.</div>
        <div class="spinner-container"
             role="progressbar"
-             data-i18n-aria="app.loading"
+             aria-label="Chargement..."
        >
            <svg class="spinner-svg"
                 viewBox="0 0 28 28"
@@ -40,6 +40,5 @@
                        </svg>
                    </span>
        </div>
-        <p id="close-msg" style="display: none; text-align: center; font-size: 13px; color: #666; margin-top: 16px;" data-i18n="success.close_window"></p>
    </body>
 </html>
@@ -1,35 +1,20 @@
 const { applyAppName } = require("../common/helpers");
 const { exchangeSession } = require("../common/api");
 const { consume } = require("../common/transitToken");
-const { initI18n, translateUI } = require("../common/i18n");

-(async () => {
-  await initI18n();
+applyAppName();

-  applyAppName();
-  translateUI();
+const transitToken = consume();

-  const transitToken = consume();
-
-  if (!transitToken) {
-    console.error("Transit token not found in sessionStorage");
-    window.close();
-  } else {
-    exchangeSession(transitToken)
-      .then(() => {
-        document.querySelector(".spinner-container").style.display = "none";
-        document.querySelector("#close-msg").style.display = "block";
-      })
-      .catch((e) => {
-        console.error(`Error occurred: ${e}`);
-      })
-      .finally(() => {
-        // NOTE: doesn't work with the desktop client — the browser considers
-        // this window wasn't opened by this script (it was opened externally),
-        // so it blocks window.close() for security reasons. The "#close-msg"
-        // shown above is the fallback for that case.g
-
-        window.close();
-      });
-  }
-})();
+if (!transitToken) {
+  console.error("Transit token not found in sessionStorage");
+  window.close();
+} else {
+  exchangeSession(transitToken)
+    .catch((e) => {
+      console.error(`Error occured: ${e}`);
+    })
+    .finally(() => {
+      window.close();
+    });
+}
@@ -115,39 +115,15 @@ button {
    background-color: #f5f5f5;
 }

-/* ── Danger button (remove meeting) ── */
-
-#btn-remove {
-    background-color: #CA3632; /* error.400 */
-    color: #FFFFFF;
-    border: none;
-}
-
-#btn-remove:hover {
-    background-color: #EE6A66; /* error.600 */
-}
-
-#btn-remove:active {
-    background-color: #F28D8A; /* error.700 */
-    color: #F6AFAD;            /* error.200 */
-}
-
-#btn-remove:disabled {
-    background-color: #F6AFAD; /* error.800 */
-    color: #FAD2D1;            /* error.900 */
-    cursor: not-allowed;
-}
-
 /* ── Version ── */

 #version-tag {
    position: fixed;
    bottom: 8px;
-    left: 8px;
    right: 8px;
-    display: flex;
-    justify-content: space-between;
+    display: inline-flex;
    align-items: center;
+    gap: 4px;
    font-size: 11px;
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
    color: #6b7280;
@@ -155,29 +131,9 @@ button {
    pointer-events: none;
 }

-#feedback-link {
-    font-size: 11px;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-    color: #6b7280;
-    text-decoration: underline;
-    pointer-events: all; /* override parent's pointer-events: none */
-    cursor: pointer;
-}
-
-#feedback-link:hover {
-    color: #374151;
-}
-
-#footer-right {
-    display: inline-flex;
-    align-items: center;
-    gap: 4px;
-    margin-left: auto;
-}
-
 .version-badge {
-    background: #EEF1F4;
-    color: #2845C1;
+    background: #fef3c7;
+    color: #92400e;
    padding: 1px 6px;
    border-radius: 3px;
    font-weight: 600;
@@ -10,55 +10,47 @@
    <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
 </head>
 <body>
-<div id="sideload-msg" data-i18n="app.sideload"></div>
+<div id="sideload-msg">Veuillez charger le complément.</div>

 <div id="app-body">

    <!-- Loading -->
    <div id="view-loading">
-        <p class="intro-text" data-i18n="app.loading"></p>
+        <p class="intro-text">Chargement...</p>
    </div>

    <!-- Unauthenticated -->
    <div id="view-unauth" style="display:none;">
        <p class="intro-text">
-            <span data-i18n="unauth.intro"></span>
+            <span>Ajoutez facilement un lien de réunion <span data-app-name></span> à vos événements Outlook.</span>
        </p>
        <hr class="divider" />
        <button class="proconnect-button" id="btn-connect">
-            <span class="proconnect-sr-only" data-i18n="unauth.proconnect_btn"></span>
+            <span class="proconnect-sr-only">S'identifier avec ProConnect</span>
        </button>
        <p>
-            <a href="https://www.proconnect.gouv.fr/"
-               target="_blank"
-               rel="noopener noreferrer"
-               data-i18n-attr="title:unauth.proconnect_link_title"
-               data-i18n="unauth.proconnect_link"
-            ></a>
+            <a
+                    href="https://www.proconnect.gouv.fr/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    title="Qu’est-ce que ProConnect ? - nouvelle fenêtre"
+            >
+                Qu’est-ce que ProConnect ?
+            </a>
        </p>
    </div>

    <!-- Authenticated -->
    <div id="view-auth" style="display:none;">
        <div id="btn-container">
-            <!-- shown when no meeting is present -->
-            <button id="btn-generate" data-i18n="meeting.add_meeting"></button>
-            <!-- shown when a meeting is already present -->
-            <button id="btn-remove" style="display:none;" data-i18n="meeting.remove_meeting"></button>
-            <button id="btn-disconnect" data-i18n="auth.disconnect"></button>
+            <button id="btn-generate">Ajouter une réunion <span data-app-name></span></button>
+            <button id="btn-disconnect">Se déconnecter</button>
        </div>
    </div>
 </div>
 <footer id="version-tag">
-    <a id="feedback-link"
-       style="display:none;"
-       target="_blank"
-       rel="noopener noreferrer"
-       data-i18n="footer.feedback"
-    ></a>
-    <div id="footer-right">
-        <span class="version-number">1.0.0</span>
-    </div>
+    <span class="version-badge">alpha</span>
+    <span class="version-number">0.0.1</span>
 </footer>
 </body>
 </html>
@@ -1,77 +1,22 @@
-/* global Office */
-const { APP_NAME, FEEDBACK_FORM } = require("../common");
+const { APP_NAME } = require("../common");
+
 const { applyAppName } = require("../common/helpers");
 const { initSession, createRoom } = require("../common/api");
 const { startPolling } = require("../common/polling");
 const { openTransitDialog } = require("../common/transitDialog");
 const { loadSession, saveSession, clearSession } = require("../common/session");
+
 const { buildMeetingMessage } = require("../common/messageBuilder");
-const { initI18n, t, translateUI } = require("../common/i18n");
-const { isMeetingAlreadyAdded, removeMeetingLink } = require("../common/meetingDetector");
-
-// ── Views ────────────────────────────────────────────────────

+// todo - support loading view while polling
+// todo - support error view
 function showView(name) {
  document.getElementById("view-loading").style.display = "none";
  document.getElementById("view-unauth").style.display = "none";
  document.getElementById("view-auth").style.display = "none";
  document.getElementById(`view-${name}`).style.display = "block";
-
-  if (name === "auth") {
-    _refreshMeetingButtonState();
-  }
 }

-// ── Button state ─────────────────────────────────────────────
-
-function _showAddButton() {
-  document.getElementById("btn-generate").style.display = "block";
-  document.getElementById("btn-remove").style.display = "none";
-}
-
-function _showRemoveButton() {
-  document.getElementById("btn-generate").style.display = "none";
-  document.getElementById("btn-remove").style.display = "block";
-}
-
-function _setButtonLoading() {
-  const btn = document.getElementById("btn-generate");
-  btn.disabled = true;
-  btn.textContent = t("meeting.generating");
-}
-
-function _setButtonIdle() {
-  const btn = document.getElementById("btn-generate");
-  btn.disabled = false;
-  btn.textContent = t("meeting.add_meeting", { app_name: APP_NAME });
-}
-
-function _setRemoveLoading() {
-  const btn = document.getElementById("btn-remove");
-  btn.disabled = true;
-  btn.textContent = t("meeting.removing");
-}
-
-function _setRemoveIdle() {
-  const btn = document.getElementById("btn-remove");
-  btn.disabled = false;
-  btn.textContent = t("meeting.remove_meeting", { app_name: APP_NAME });
-}
-
-function _refreshMeetingButtonState() {
-  const item = Office.context.mailbox.item;
-  if (!item) return;
-  isMeetingAlreadyAdded(item).then((alreadyAdded) => {
-    if (alreadyAdded) {
-      _showRemoveButton();
-    } else {
-      _showAddButton();
-    }
-  });
-}
-
-// ── Auth ─────────────────────────────────────────────────────
-
 function connect() {
  initSession()
    .then((data) => {
@@ -102,11 +47,22 @@ function disconnect() {
  clearSession().finally(() => showView("unauth"));
 }

-// ── Meeting ──────────────────────────────────────────────────
+function _setButtonLoading() {
+  const btn = document.getElementById("btn-generate");
+  btn.disabled = true;
+  btn.textContent = "Génération...";
+}
+
+function _setButtonIdle() {
+  const btn = document.getElementById("btn-generate");
+  btn.disabled = false;
+  btn.textContent = `Ajouter une réunion ${APP_NAME}`;
+}

 function generateMeetingLink() {
  const session = loadSession();
  if (!session?.access_token) {
+    console.error("Session introuvable. Veuillez vous reconnecter.");
    showView("unauth");
    return;
  }
@@ -115,28 +71,36 @@ function generateMeetingLink() {

  createRoom(session)
    .then((data) => {
-      const isWeb = Office.context.diagnostics.platform === "OfficeOnline";
-      const { url, text } = buildMeetingMessage(data, isWeb);
+      const { url, message } = buildMeetingMessage(data);
      const item = Office.context.mailbox.item;
-      const coercionType = isWeb ? Office.CoercionType.Html : Office.CoercionType.Text;
-
      return new Promise((resolve, reject) => {
-        item.body.setSelectedDataAsync(text, { coercionType }, (setResult) => {
-          if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
-            reject(setResult.error);
+        item.body.getAsync(Office.CoercionType.Html, (getResult) => {
+          if (getResult.status !== Office.AsyncResultStatus.Succeeded) {
+            reject(getResult.error);
            return;
          }
-          if (item.itemType === Office.MailboxEnums.ItemType.Appointment) {
-            item.location.setAsync(url, () => resolve());
-            return;
-          }
-          resolve();
+
+          item.body.setAsync(
+            getResult.value + message,
+            { coercionType: Office.CoercionType.Html },
+            (setResult) => {
+              if (setResult.status !== Office.AsyncResultStatus.Succeeded) {
+                reject(setResult.error);
+                return;
+              }
+
+              // ─── If calendar event, also set location ──────────────
+              if (item.itemType === Office.MailboxEnums.ItemType.Appointment) {
+                item.location.setAsync(url, () => resolve());
+                return;
+              }
+
+              resolve();
+            }
+          );
        });
      });
    })
-    .then(() => {
-      _showRemoveButton();
-    })
    .catch((err) => {
      console.error(err);
    })
@@ -145,41 +109,7 @@ function generateMeetingLink() {
    });
 }

-function removeMeetingLinkFromItem() {
-  const session = loadSession();
-  if (!session?.access_token) {
-    showView("unauth");
-    return;
-  }
-
-  _setRemoveLoading();
-
-  const item = Office.context.mailbox.item;
-
-  removeMeetingLink(item)
-    .then(() => {
-      _showAddButton();
-    })
-    .catch((err) => {
-      console.error(err);
-    })
-    .finally(() => {
-      _setRemoveIdle();
-    });
-}
-
-// ── Init ─────────────────────────────────────────────────────
-
-Office.onReady(async (info) => {
-  await initI18n();
-  translateUI();
-
-  if (FEEDBACK_FORM) {
-    const link = document.getElementById("feedback-link");
-    link.href = FEEDBACK_FORM;
-    link.style.display = "inline";
-  }
-
+Office.onReady((info) => {
  if (info.host === Office.HostType.Outlook) {
    applyAppName();
    document.getElementById("sideload-msg").style.display = "none";
@@ -187,11 +117,10 @@ Office.onReady(async (info) => {
    document.getElementById("btn-connect").onclick = connect;
    document.getElementById("btn-disconnect").onclick = disconnect;
    document.getElementById("btn-generate").onclick = generateMeetingLink;
-    document.getElementById("btn-remove").onclick = removeMeetingLinkFromItem;

    const session = loadSession();
    if (session?.state === "authenticated" && session?.access_token) {
-      showView("auth"); // this already calls _refreshMeetingButtonState internally
+      showView("auth");
    } else {
      showView("unauth");
    }
@@ -10,11 +10,11 @@
        <script nonce="NONCE_PLACEHOLDER" src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js"></script>
    </head>
    <body>
-        <div id="sideload-msg" data-i18n="app.sideload"></div>
+        <div id="sideload-msg">Veuillez charger le complément.</div>
        <div
            class="spinner-container"
            role="progressbar"
-            data-i18n-aria="app.loading"
+            aria-label="Chargement..."
        >
            <svg
                class="spinner-svg"
@@ -2,7 +2,6 @@ const { applyAppName } = require("../common/helpers");
 const { URLS } = require("../common/urls");
 const { save } = require("../common/transitToken");
 const { DIALOG_SIGNALS } = require("../common/transitDialog");
-const { initI18n, translateUI } = require("../common/i18n");

 // Initiate the authentication flow, then return to the success page
 function getAuthenticateUrl() {
@@ -11,11 +10,7 @@ function getAuthenticateUrl() {
  return url.toString();
 }

-Office.onReady(async function (info) {
-
-  await initI18n();
-  translateUI();
-
+Office.onReady(function (info) {
  if (info.host === Office.HostType.Outlook) {
    applyAppName();
  }
@@ -1,12 +1,9 @@
-FROM python:3.14.7-slim AS base
+FROM python:3.13.13-slim AS base

-# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
-RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
-    && apt-get update && apt-get install -y --no-install-recommends  \
+# Install system dependencies required by LiveKit
+RUN apt-get update && apt-get install -y \
    libglib2.0-0 \
    libgobject-2.0-0 \
-    libpcre2-8-0 \
-    libssl3t64 \
    && rm -rf /var/lib/apt/lists/*


@@ -6,11 +6,9 @@ import logging
 import os
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
+from io import BytesIO
 from typing import List, Optional

-import boto3
-from botocore.config import Config
-from botocore.exceptions import BotoCoreError, ClientError
 from dotenv import load_dotenv
 from livekit import api, rtc
 from livekit.agents import (
@@ -21,19 +19,18 @@ from livekit.agents import (
    JobContext,
    JobProcess,
    JobRequest,
+    RoomInputOptions,
    RoomIO,
+    RoomOutputOptions,
    WorkerPermissions,
    cli,
    utils,
 )
-from livekit.agents import (
-    room_io as lk_room_io,
-)
 from livekit.plugins import silero
+from minio import Minio
+from minio.error import S3Error

 from exceptions import MissingConfigError
-from observability import configure_sentry, set_job_context
-from tasks import done_callback

 load_dotenv()

@@ -44,7 +41,6 @@ AGENT_NAME = os.getenv("METADATA_COLLECTOR_AGENT_NAME", "metadata-collector")

 def prewarm(proc: JobProcess):
    """Preload voice activity detection model."""
-    configure_sentry(AGENT_NAME)
    proc.userdata["vad"] = silero.VAD.load()


@@ -59,30 +55,6 @@ server = AgentServer(
 server.setup_fnc = prewarm


-def create_s3_client():
-    """Create an S3 client for the configured endpoint and region.
-
-    The endpoint may be given with or without a scheme: the scheme always
-    follows AWS_S3_SECURE_ACCESS.
-    """
-    endpoint = (
-        os.getenv("AWS_S3_ENDPOINT_URL", "")
-        .removeprefix("https://")
-        .removeprefix("http://")
-        .rstrip("/")
-    )
-    secure = os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true"
-
-    return boto3.client(
-        "s3",
-        endpoint_url=f"{'https' if secure else 'http'}://{endpoint}",
-        aws_access_key_id=os.getenv("AWS_S3_ACCESS_KEY_ID"),
-        aws_secret_access_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
-        region_name=os.getenv("AWS_S3_REGION_NAME"),
-        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
-    )
-
-
@dataclass
 class MetadataEvent:
    """A single timestamped event recorded during a meeting."""
@@ -145,13 +117,18 @@ class MetadataCollector:

    def __init__(self, ctx: JobContext, recording_id: str):
        """Initialize metadata agent."""
+        self.minio_client = Minio(
+            endpoint=os.getenv("AWS_S3_ENDPOINT_URL"),
+            access_key=os.getenv("AWS_S3_ACCESS_KEY_ID"),
+            secret_key=os.getenv("AWS_S3_SECRET_ACCESS_KEY"),
+            secure=os.getenv("AWS_S3_SECURE_ACCESS", "False").lower() == "true",
+        )
+
        if (bucket_name := os.getenv("AWS_STORAGE_BUCKET_NAME")) is not None:
            self.bucket_name = bucket_name
        else:
            raise MissingConfigError

-        self.s3_client = create_s3_client()
-
        self.ctx = ctx
        self._sessions: dict[str, AgentSession] = {}
        self._tasks: set[asyncio.Task] = set()
@@ -196,13 +173,7 @@ class MetadataCollector:
            self.on_chat_message_received(reader, participant_identity)
        )
        self._tasks.add(task)
-        task.add_done_callback(
-            done_callback(
-                logger,
-                self._tasks,
-                f"process chat stream from {participant_identity}",
-            )
-        )
+        task.add_done_callback(lambda _: self._tasks.remove(task))

    def save(self):
        """Serialize collected events and upload as JSON to S3."""
@@ -220,18 +191,20 @@ class MetadataCollector:
        }

        data = json.dumps(payload, indent=2).encode("utf-8")
+        stream = BytesIO(data)

        try:
-            self.s3_client.put_object(
-                Bucket=self.bucket_name,
-                Key=self.output_filename,
-                Body=data,
-                ContentType="application/json",
+            self.minio_client.put_object(
+                self.bucket_name,
+                self.output_filename,
+                stream,
+                length=len(data),
+                content_type="application/json",
            )
            logger.info(
                "Uploaded speaker meeting metadata",
            )
-        except (BotoCoreError, ClientError):
+        except S3Error:
            logger.exception(
                "Failed to upload meeting metadata",
            )
@@ -296,18 +269,16 @@ class MetadataCollector:
        logger.info("Participant disconnected: %s", participant.identity)
        task = asyncio.create_task(self._close_session(session))
        self._tasks.add(task)
-        task.add_done_callback(
-            done_callback(
-                logger,
-                self._tasks,
-                f"close VAD session for {participant.identity}",
-                on_success=lambda _: logger.info(
-                    "VAD session closed for %s (remaining sessions: %d)",
-                    participant.identity,
-                    len(self._sessions),
-                ),
+
+        def on_close_done(_):
+            self._tasks.discard(task)
+            logger.info(
+                "VAD session closed for %s (remaining sessions: %d)",
+                participant.identity,
+                len(self._sessions),
            )
-        )
+
+        task.add_done_callback(on_close_done)

    def on_participant_name_changed(self, participant: rtc.RemoteParticipant):
        """Update stored participant name when it changes."""
@@ -331,11 +302,13 @@ class MetadataCollector:
            agent_session=session,
            room=self.ctx.room,
            participant=participant,
-            options=lk_room_io.RoomOptions(
-                audio_input=lk_room_io.AudioInputOptions(),
-                text_input=False,
-                audio_output=False,
-                text_output=False,
+            input_options=RoomInputOptions(
+                audio_enabled=True,
+                text_enabled=False,
+            ),
+            output_options=RoomOutputOptions(
+                audio_enabled=False,
+                transcription_enabled=False,
            ),
        )

@@ -351,6 +324,7 @@ class MetadataCollector:
    async def _close_session(self, session: AgentSession) -> None:
        """Close and cleanup VAD monitoring session."""
        try:
+            await session.drain()
            await session.aclose()
        except Exception:
            logger.exception("Error closing session")
@@ -388,8 +362,6 @@ async def handle_job_request(job_req: JobRequest) -> None:
@server.rtc_session(agent_name=AGENT_NAME, on_request=handle_job_request)
 async def entrypoint(ctx: JobContext):
    """Initialize and run the metadata collector."""
-    set_job_context(room=ctx.room.name, job_id=ctx.job.id)
-
    logger.info("Starting metadata agent in room: %s", ctx.room.name)
    recording_id = ctx.job.metadata
    metadata_collector = MetadataCollector(ctx, recording_id)
@@ -407,7 +379,4 @@ async def entrypoint(ctx: JobContext):


 if __name__ == "__main__":
-    # Initialize Sentry for the worker process. Each job runs in its own
-    # (forked) process and re-initializes Sentry via prewarm().
-    configure_sentry(AGENT_NAME)
    cli.run_app(server)
@@ -1,7 +1,6 @@
 """Multi user transcription agent."""

 import asyncio
-import contextlib
 import logging
 import os

@@ -26,10 +25,6 @@ from livekit.agents import (
 )
 from livekit.plugins import deepgram, silero

-import voxtral_vllm_stt
-from observability import configure_sentry, set_job_context
-from tasks import done_callback
-
 load_dotenv()

 logger = logging.getLogger("transcriber")
@@ -38,18 +33,9 @@ TRANSCRIBER_AGENT_NAME = os.getenv("TRANSCRIBER_AGENT_NAME", "multi-user-transcr
 STT_PROVIDER = os.getenv("STT_PROVIDER", "deepgram")
 ENABLE_SILERO_VAD = os.getenv("ENABLE_SILERO_VAD", "true").lower() == "true"

-SESSION_DRAIN_TIMEOUT_S = 15.0

-
-def create_stt_provider(vad: silero.VAD | None = None):
-    """Create STT provider based on environment configuration.
-
-    Args:
-        vad: Shared, prewarmed VAD instance. Required in practice for
-            voxtral-vllm (no server-side endpointing): if omitted, the plugin
-            loads its own Silero model synchronously on the event loop, once
-            per participant, freezing all active sessions for the duration.
-    """
+def create_stt_provider():
+    """Create STT provider based on environment configuration."""
    if STT_PROVIDER == "deepgram":
        # Note: Not all Deepgram API parameters are supported by the LiveKit plugin
        # detect_language is NOT supported for real-time streaming
@@ -60,9 +46,6 @@ def create_stt_provider(vad: silero.VAD | None = None):
        )
    elif STT_PROVIDER == "kyutai":
        _stt_instance = kyutai.STT(base_url=os.getenv("KYUTAI_STT_BASE_URL"))
-    elif STT_PROVIDER == "voxtral-vllm":
-        # The plugin resolves base_url / model / api_key from the environment.
-        _stt_instance = voxtral_vllm_stt.STT(vad=vad)
    else:
        raise ValueError(f"Unknown STT_PROVIDER: {STT_PROVIDER}")

@@ -72,9 +55,9 @@ def create_stt_provider(vad: silero.VAD | None = None):
 class Transcriber(Agent):
    """Create a transcription agent for a specific participant."""

-    def __init__(self, *, participant_identity: str, vad: silero.VAD | None = None):
+    def __init__(self, *, participant_identity: str):
        """Init transcription agent."""
-        stt = create_stt_provider(vad=vad)
+        stt = create_stt_provider()

        super().__init__(
            instructions="not-needed",
@@ -90,7 +73,6 @@ class MultiUserTranscriber:
        """Init multi user transcription agent."""
        self.ctx = ctx
        self._sessions: dict[str, AgentSession] = {}
-        self._starting: dict[str, asyncio.Task] = {}
        self._tasks: set[asyncio.Task] = set()

    def start(self):
@@ -111,51 +93,36 @@ class MultiUserTranscriber:

    def on_participant_connected(self, participant: rtc.RemoteParticipant):
        """Handle new participant connection by starting transcription session."""
-        identity = participant.identity
-        if identity in self._sessions or identity in self._starting:
+        if participant.identity in self._sessions:
            return

-        logger.info(f"starting session for {identity}")
+        logger.info(f"starting session for {participant.identity}")
        task = asyncio.create_task(self._start_session(participant))
-        self._starting[identity] = task
        self._tasks.add(task)
-        task.add_done_callback(lambda t, i=identity: self._starting.pop(i, None))
-        task.add_done_callback(
-            done_callback(
-                logger,
-                self._tasks,
-                f"start transcription session for {identity}",
-            )
-        )
+
+        def on_task_done(task: asyncio.Task):
+            try:
+                self._sessions[participant.identity] = task.result()
+            finally:
+                self._tasks.discard(task)
+
+        task.add_done_callback(on_task_done)

    def on_participant_disconnected(self, participant: rtc.RemoteParticipant):
        """Handle participant disconnection by closing transcription session."""
-        if (start_task := self._starting.pop(participant.identity, None)) is not None:
-            logger.info(f"cancelling pending session start for {participant.identity}")
-            start_task.cancel()
-            return
-
-        if (session := self._sessions.pop(participant.identity, None)) is None:
+        if (session := self._sessions.pop(participant.identity)) is None:
            return

        logger.info(f"closing session for {participant.identity}")
        task = asyncio.create_task(self._close_session(session))
        self._tasks.add(task)
-        task.add_done_callback(
-            done_callback(
-                logger,
-                self._tasks,
-                f"close transcription session for {participant.identity}",
-            )
-        )
+        task.add_done_callback(lambda _: self._tasks.discard(task))

    async def _start_session(self, participant: rtc.RemoteParticipant) -> AgentSession:
-        """Create and start transcription session for participant.
+        """Create and start transcription session for participant."""
+        if participant.identity in self._sessions:
+            return self._sessions[participant.identity]

-        Deduplication happens synchronously in on_participant_connected via
-        self._starting; by the time this coroutine runs, the identity is
-        already reserved.
-        """
        vad = self.ctx.proc.userdata.get("vad", None)
        session = AgentSession(vad=vad)
        room_io = RoomIO(
@@ -166,37 +133,22 @@ class MultiUserTranscriber:
                text_input=False, audio_output=False, text_output=True
            ),
        )
-        try:
-            await room_io.start()
-            await session.start(
-                agent=Transcriber(
-                    participant_identity=participant.identity,
-                    vad=vad,
-                )
+        await room_io.start()
+        await session.start(
+            agent=Transcriber(
+                participant_identity=participant.identity,
            )
-        except BaseException:
-            with contextlib.suppress(Exception):
-                await session.aclose()
-            raise
-        self._sessions[participant.identity] = session
+        )
        return session

    async def _close_session(self, sess: AgentSession) -> None:
        """Close and cleanup transcription session."""
-        try:
-            await asyncio.wait_for(sess.drain(), timeout=SESSION_DRAIN_TIMEOUT_S)
-        except (TimeoutError, asyncio.TimeoutError):
-            logger.warning(
-                "session drain timed out after %.0fs; forcing close",
-                SESSION_DRAIN_TIMEOUT_S,
-            )
+        await sess.drain()
        await sess.aclose()


 async def entrypoint(ctx: JobContext):
    """Initialize and run the multi-user transcriber."""
-    set_job_context(room=ctx.room.name, job_id=ctx.job.id)
-
    transcriber = MultiUserTranscriber(ctx)
    transcriber.start()

@@ -241,15 +193,11 @@ async def handle_transcriber_job_request(job_req: JobRequest) -> None:

 def prewarm(proc: JobProcess):
    """Preload voice activity detection model."""
-    configure_sentry(TRANSCRIBER_AGENT_NAME)
    if ENABLE_SILERO_VAD:
        proc.userdata["vad"] = silero.VAD.load()


 if __name__ == "__main__":
-    # Initialize Sentry for the worker process. Each job runs in its own
-    # (forked) process and re-initializes Sentry via prewarm().
-    configure_sentry(TRANSCRIBER_AGENT_NAME)
    cli.run_app(
        WorkerOptions(
            entrypoint_fnc=entrypoint,
@@ -1,83 +0,0 @@
-"""Sentry helpers for the LiveKit agents."""
-
-import logging
-import os
-import tomllib
-from os import path
-
-import sentry_sdk
-from sentry_sdk.integrations.logging import LoggingIntegration
-
-logger = logging.getLogger("observability")
-
-BASE_DIR = path.dirname(path.abspath(__file__))
-
-
-def get_release():
-    """Get the current release of the application.
-
-    By release, we mean the ``version`` declared in ``pyproject.toml``.
-    If the file cannot be read or declares no version, it defaults to "NA".
-    """
-    try:
-        with open(path.join(BASE_DIR, "pyproject.toml"), "rb") as pyproject:
-            return tomllib.load(pyproject)["project"]["version"]
-    except (FileNotFoundError, KeyError, tomllib.TOMLDecodeError):
-        return "NA"  # Default: not available
-
-
-def configure_sentry(agent_name: str) -> None:
-    """Initialize Sentry for the current agent process.
-
-    No-op if ``SENTRY_DSN`` is not configured. Otherwise (re)initializes Sentry
-    unconditionally so the calling process gets its own live transport.
-
-    Must be called once per process: in the worker entrypoint and again in the
-    per-job ``prewarm``/``setup_fnc`` hook, because LiveKit runs each job in a
-    forked process. A forked child inherits the parent's initialized Sentry
-    client but not its background transport thread (threads do not survive
-    ``fork()``), so it must re-init to get a working transport. For that reason,
-    do NOT guard this with ``sentry_sdk.is_initialized()``: the child inherits it
-    as ``True`` and would skip init, silently dropping every event.
-
-    Args:
-        agent_name: Identifier of the agent, attached as a tag to Sentry issues
-    """
-    # Read the DSN at call time so it picks up variables that load_dotenv()
-    # populated after this module was first imported.
-    sentry_dsn = os.getenv("SENTRY_DSN")
-    if not sentry_dsn:
-        logger.debug("SENTRY_DSN not defined for agent '%s'", agent_name)
-        return
-
-    sentry_sdk.init(
-        dsn=sentry_dsn,
-        environment=os.getenv("SENTRY_ENVIRONMENT"),
-        release=get_release(),
-        debug=False,
-        integrations=[
-            # Capture log records emitted at ERROR and above as Sentry events.
-            # This covers the agents' explicit logger.exception(...) calls as
-            # well as asyncio's "Exception in callback" / "Task exception was
-            # never retrieved" records, so unhandled task failures surface too.
-            LoggingIntegration(level=logging.INFO, event_level=logging.ERROR),
-        ],
-    )
-    sentry_sdk.set_tag("application", "agents")
-    sentry_sdk.set_tag("agent", agent_name)
-
-    logger.info("Sentry initialized for agent '%s' (pid %d)", agent_name, os.getpid())
-
-
-def set_job_context(*, room: str | None = None, job_id: str | None = None) -> None:
-    """Tag the current Sentry scope with the LiveKit job being handled.
-
-    Args:
-        room: Name of the room the job is serving.
-        job_id: LiveKit job identifier.
-    """
-    scope = sentry_sdk.get_current_scope()
-    if room is not None:
-        scope.set_tag("room", room)
-    if job_id is not None:
-        scope.set_tag("job_id", job_id)
@@ -1,24 +1,21 @@

 [project]
 name = "agents"
-version = "1.33.0"
+version = "1.16.0"
 requires-python = ">=3.12"
 dependencies = [
-    "livekit-agents==1.7.0",
-    "livekit-plugins-deepgram==1.7.0",
-    "livekit-plugins-silero==1.7.0",
+    "livekit-agents==1.4.5",
+    "livekit-plugins-deepgram==1.4.5",
+    "livekit-plugins-silero==1.4.5",
    "livekit-plugins-kyutai-lasuite==0.0.6",
-    "boto3==1.43.56",
-    "python-dotenv==1.2.3",
-    "protobuf==7.36.0",
-    "sentry-sdk==2.68.1",
-    "websockets==17.1",
-    "httpx==0.28.1",
+    "python-dotenv==1.2.2",
+    "protobuf==6.33.5",
+    "minio==7.2.15"
 ]

 [project.optional-dependencies]
 dev = [
-    "ruff==0.16.4",
+    "ruff==0.15.6",
 ]

 [tool.uv]
@@ -1,42 +0,0 @@
-"""Helpers for managing asyncio tasks."""
-
-import asyncio
-import logging
-from collections.abc import Callable
-from typing import Any
-
-
-def done_callback(
-    logger: logging.Logger,
-    tasks: set[asyncio.Task],
-    description: str,
-    *,
-    on_success: Callable[[Any], None] | None = None,
-) -> Callable[[asyncio.Task], None]:
-    """Build a done-callback for a background task.
-
-    Meant to be passed to `asyncio.Task.add_done_callback`.
-
-    Args:
-        logger: Logger used to report failures, so records keep the caller's
-            logger name.
-        tasks: Set the task was registered in; the task is discarded from it.
-        description: Human-readable intended action
-        on_success: Optional callback invoked with the task's result when it
-            completes without error.
-
-    Returns:
-        A callback suitable for ``task.add_done_callback(...)``.
-    """
-
-    def _finalize(task: asyncio.Task) -> None:
-        tasks.discard(task)
-        if task.cancelled():
-            return
-        if (exc := task.exception()) is not None:
-            logger.exception("failed to %s", description, exc_info=exc)
-            return
-        if on_success is not None:
-            on_success(task.result())
-
-    return _finalize
@@ -1,476 +0,0 @@
-"""LiveKit STT plugin for Voxtral Realtime served via vLLM (/v1/realtime).
-
-vLLM exposes Voxtral Realtime over a WebSocket that follows the OpenAI Realtime
-API protocol (not Mistral's proprietary realtime protocol).
-"""
-
-from __future__ import annotations
-
-import asyncio
-import base64
-import json
-import logging
-import os
-import weakref
-from collections import deque
-from dataclasses import dataclass, field
-
-import websockets
-from livekit.agents import (
-    DEFAULT_API_CONNECT_OPTIONS,
-    APIConnectionError,
-    APIConnectOptions,
-    APIStatusError,
-    stt,
-    utils,
-)
-from livekit.agents import (
-    vad as vad_module,
-)
-from livekit.agents.types import NOT_GIVEN, NotGivenOr
-from livekit.agents.utils import is_given
-
-logger = logging.getLogger("voxtral-vllm-stt")
-
-SAMPLE_RATE = 16000
-NUM_CHANNELS = 1
-CHUNK_SAMPLES = 1600  # 100 ms @ 16 kHz mono
-PREROLL_CHUNKS = 5  # keep 500 ms of audio before start of speech as detected by VAD
-
-# Reconnect policy: exponential backoff capped at MAX, give up after MAX_ATTEMPTS
-# consecutive failures (a successful handshake resets the counter).
-RECONNECT_BACKOFF_BASE_S = 0.5
-RECONNECT_BACKOFF_MAX_S = 8.0
-RECONNECT_MAX_ATTEMPTS = 5
-
-
-@dataclass
-class _STTOptions:
-    base_url: str
-    model: str
-    api_key: str | None
-    target_streaming_delay_ms: int | None
-
-
-@dataclass
-class _PendingUtterance:
-    """An utterance in flight on the shared websocket used for reconnect.
-
-    `sent_chunks` holds every chunk we have already enqueued for send on this
-    or a prior connection; on reconnect we replay them before resuming reads
-    from `queue`. vLLM concatenates `input_audio_buffer.append` events into a
-    single audio buffer per generation, so duplicates from a partial prior send
-    are harmless.
-    """
-
-    queue: asyncio.Queue[bytes | None]
-    sent_chunks: list[bytes] = field(default_factory=list)
-    ended: bool = False
-
-
-class STT(stt.STT):
-    """LiveKit STT speaking the OpenAI Realtime protocol served by vLLM."""
-
-    def __init__(
-        self,
-        *,
-        base_url: NotGivenOr[str] = NOT_GIVEN,
-        model: NotGivenOr[str] = NOT_GIVEN,
-        api_key: NotGivenOr[str] = NOT_GIVEN,
-        target_streaming_delay_ms: NotGivenOr[int] = NOT_GIVEN,
-        vad: vad_module.VAD | None = None,
-    ) -> None:
-        """Build the STT.
-
-        Args:
-            base_url: WebSocket URL of the vLLM realtime endpoint, e.g.
-                ws://example:8000/v1/realtime. Falls back to $VOXTRAL_VLLM_BASE_URL.
-            model: Model name exposed by vLLM, default
-                mistralai/Voxtral-Mini-4B-Realtime-2602.
-            api_key: Optional bearer token. Falls back to $VOXTRAL_VLLM_API_KEY.
-            target_streaming_delay_ms: Target streaming delay in ms forwarded to
-                vLLM via session.update. Falls back to
-                $VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS, else server default.
-            vad: Voice Activity Detector. If omitted, Silero VAD is loaded.
-        """
-        super().__init__(
-            capabilities=stt.STTCapabilities(streaming=True, interim_results=True)
-        )
-
-        resolved_url = (
-            base_url
-            if is_given(base_url)
-            else os.environ.get(
-                "VOXTRAL_VLLM_BASE_URL", "ws://127.0.0.1:8000/v1/realtime"
-            )
-        )
-        resolved_model = (
-            model
-            if is_given(model)
-            else os.environ.get(
-                "VOXTRAL_VLLM_MODEL", "mistralai/Voxtral-Mini-4B-Realtime-2602"
-            )
-        )
-        resolved_key = (
-            api_key if is_given(api_key) else os.environ.get("VOXTRAL_VLLM_API_KEY")
-        )
-        resolved_delay = (
-            target_streaming_delay_ms
-            if is_given(target_streaming_delay_ms)
-            else (
-                int(os.environ["VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS"])
-                if os.environ.get("VOXTRAL_VLLM_TARGET_STREAMING_DELAY_MS")
-                else None
-            )
-        )
-
-        if vad is None:
-            try:
-                from livekit.plugins.silero import VAD as SileroVAD  # noqa: PLC0415
-            except ImportError as exc:
-                raise ImportError(
-                    "livekit-plugins-silero is required for vLLM Voxtral realtime "
-                    "(no server-side endpointing)."
-                ) from exc
-            vad = SileroVAD.load()
-        self._vad = vad
-
-        self._opts = _STTOptions(
-            base_url=resolved_url,
-            model=resolved_model,
-            api_key=resolved_key,
-            target_streaming_delay_ms=resolved_delay,
-        )
-        self._streams: weakref.WeakSet[SpeechStream] = weakref.WeakSet()
-
-    @property
-    def model(self) -> str:
-        """Return the configured vLLM model name."""
-        return self._opts.model
-
-    @property
-    def provider(self) -> str:
-        """Return the provider identifier."""
-        return "vllm-voxtral-realtime"
-
-    async def _recognize_impl(self, *_args, **_kwargs) -> stt.SpeechEvent:
-        raise NotImplementedError(
-            "vLLM Voxtral Realtime STT only supports streaming recognition."
-        )
-
-    def stream(
-        self,
-        *,
-        conn_options: APIConnectOptions = DEFAULT_API_CONNECT_OPTIONS,
-    ) -> SpeechStream:
-        """Open a new streaming recognition stream."""
-        s = SpeechStream(
-            stt=self,
-            opts=self._opts,
-            vad_instance=self._vad,
-            conn_options=conn_options,
-        )
-        self._streams.add(s)
-        return s
-
-
-class SpeechStream(stt.RecognizeStream):
-    """Voxtral realtime handler."""
-
-    def __init__(
-        self,
-        *,
-        stt: STT,
-        opts: _STTOptions,
-        vad_instance: vad_module.VAD,
-        conn_options: APIConnectOptions,
-    ) -> None:
-        """Init the speech stream."""
-        super().__init__(stt=stt, conn_options=conn_options, sample_rate=SAMPLE_RATE)
-        self._opts = opts
-        self._vad = vad_instance
-        self._utterance_q: asyncio.Queue[bytes | None] | None = None
-        self._speaking = False
-        self._preroll: deque[bytes] = deque(maxlen=PREROLL_CHUNKS)
-        # Voxtral realtime is strictly sequential: only one generation runs at a
-        # time, and a new `commit` is ignored while the previous one is still
-        # producing. We queue per-utterance audio buffers here and let the
-        # pipeline process them one by one on the shared websocket.
-        self._utterance_chan: asyncio.Queue[asyncio.Queue[bytes | None] | None] = (
-            asyncio.Queue()
-        )
-
-    @utils.log_exceptions(logger=logger)
-    async def _run(self) -> None:
-        vad_stream = self._vad.stream()
-
-        bstream = utils.audio.AudioByteStream(
-            sample_rate=SAMPLE_RATE,
-            num_channels=NUM_CHANNELS,
-            samples_per_channel=CHUNK_SAMPLES,
-        )
-
-        async def input_task() -> None:
-            async for data in self._input_ch:
-                if isinstance(data, self._FlushSentinel):
-                    for frame in bstream.flush():
-                        self._handle_chunk(frame.data.tobytes())
-                    continue
-
-                vad_stream.push_frame(data)
-                for frame in bstream.write(data.data.tobytes()):
-                    self._handle_chunk(frame.data.tobytes())
-
-            vad_stream.end_input()
-
-        async def vad_task() -> None:
-            async for ev in vad_stream:
-                if ev.type == vad_module.VADEventType.START_OF_SPEECH:
-                    self._on_start_of_speech()
-                elif ev.type == vad_module.VADEventType.END_OF_SPEECH:
-                    self._on_end_of_speech()
-
-        pipeline_t = asyncio.create_task(self._utterance_pipeline())
-        try:
-            await asyncio.gather(input_task(), vad_task())
-            # signal end-of-stream; pipeline finishes pending utterances first
-            self._utterance_chan.put_nowait(None)
-            await pipeline_t
-        except (APIStatusError, APIConnectionError, asyncio.CancelledError):
-            raise
-        except Exception as exc:
-            logger.exception("vLLM realtime stream failed")
-            raise APIConnectionError() from exc
-        finally:
-            if not pipeline_t.done():
-                pipeline_t.cancel()
-            try:
-                await pipeline_t
-            except asyncio.CancelledError:
-                # CancelledError is the expected flow on cancel()
-                pass
-            except Exception:
-                logger.exception("utterance pipeline failed during finalize")
-            await vad_stream.aclose()
-
-    def _handle_chunk(self, chunk: bytes) -> None:
-        self._preroll.append(chunk)
-        if self._speaking and self._utterance_q is not None:
-            self._utterance_q.put_nowait(chunk)
-
-    def _on_start_of_speech(self) -> None:
-        if self._speaking:
-            return
-        self._speaking = True
-        q: asyncio.Queue[bytes | None] = asyncio.Queue()
-        for chunk in self._preroll:
-            q.put_nowait(chunk)
-        self._utterance_q = q
-        self._utterance_chan.put_nowait(q)
-        self._event_ch.send_nowait(
-            stt.SpeechEvent(type=stt.SpeechEventType.START_OF_SPEECH)
-        )
-
-    def _on_end_of_speech(self) -> None:
-        if not self._speaking:
-            return
-        self._speaking = False
-        if self._utterance_q is not None:
-            self._utterance_q.put_nowait(None)
-        self._utterance_q = None
-        self._event_ch.send_nowait(
-            stt.SpeechEvent(type=stt.SpeechEventType.END_OF_SPEECH)
-        )
-
-    async def _handshake(self, ws: websockets.ClientConnection) -> str:
-        created = json.loads(await ws.recv())
-        if created.get("type") != "session.created":
-            raise APIStatusError(
-                f"expected session.created, got {created}",
-                status_code=500,
-                body=created,
-            )
-        session_update: dict = {"type": "session.update", "model": self._opts.model}
-        if self._opts.target_streaming_delay_ms is not None:
-            session_update["target_streaming_delay_ms"] = (
-                self._opts.target_streaming_delay_ms
-            )
-        await ws.send(json.dumps(session_update))
-        return created.get("id", "")
-
-    def _auth_headers(self) -> dict[str, str]:
-        if self._opts.api_key:
-            return {"Authorization": f"Bearer {self._opts.api_key}"}
-        return {}
-
-    async def _utterance_pipeline(self) -> None:
-        # Owns the websocket lifecycle. On drop, reopens and resumes the
-        # in-flight utterance (if any) by replaying its already-sent chunks.
-        pending: _PendingUtterance | None = None
-        attempt = 0
-        while True:
-            try:
-                async with websockets.connect(
-                    self._opts.base_url,
-                    additional_headers=self._auth_headers(),
-                    open_timeout=self._conn_options.timeout,
-                ) as ws:
-                    request_id = await self._handshake(ws)
-                    attempt = 0
-                    while True:
-                        if pending is None:
-                            q = await self._utterance_chan.get()
-                            if q is None:
-                                return
-                            pending = _PendingUtterance(queue=q)
-                        await self._process_utterance(ws, pending, request_id)
-                        pending = None
-            except (websockets.WebSocketException, OSError, TimeoutError) as exc:
-                attempt += 1
-                if attempt > RECONNECT_MAX_ATTEMPTS:
-                    logger.exception(
-                        "vLLM realtime: giving up after %d reconnect attempts",
-                        RECONNECT_MAX_ATTEMPTS,
-                    )
-                    raise APIConnectionError() from exc
-                backoff = min(
-                    RECONNECT_BACKOFF_BASE_S * (2 ** (attempt - 1)),
-                    RECONNECT_BACKOFF_MAX_S,
-                )
-                if pending is None:
-                    logger.warning(
-                        "vLLM WS connection lost between utterances "
-                        "(attempt %d/%d): %s; retrying in %.1fs",
-                        attempt,
-                        RECONNECT_MAX_ATTEMPTS,
-                        exc,
-                        backoff,
-                    )
-                else:
-                    logger.warning(
-                        "vLLM WS dropped mid-utterance (%d chunks buffered, "
-                        "ended=%s, attempt %d/%d): %s; retrying in %.1fs",
-                        len(pending.sent_chunks),
-                        pending.ended,
-                        attempt,
-                        RECONNECT_MAX_ATTEMPTS,
-                        exc,
-                        backoff,
-                    )
-                await asyncio.sleep(backoff)
-
-    async def _process_utterance(
-        self,
-        ws: websockets.ClientConnection,
-        pending: _PendingUtterance,
-        request_id: str,
-    ) -> None:
-        # Start a fresh generation. Safe to send here: the previous utterance's
-        # transcription.done has already been received (we await it below), so
-        # the server-side generation_task is done and won't ignore this commit.
-        await ws.send(json.dumps({"type": "input_audio_buffer.commit"}))
-        send_t = asyncio.create_task(self._send_audio(ws, pending))
-        try:
-            await self._receive_one_transcription(ws, request_id)
-        finally:
-            if not send_t.done():
-                send_t.cancel()
-            try:
-                await send_t
-            except (asyncio.CancelledError, websockets.WebSocketException):
-                pass
-            except Exception:
-                logger.exception("send-audio task failed during finalize")
-
-    @staticmethod
-    async def _send_audio(
-        ws: websockets.ClientConnection, pending: _PendingUtterance
-    ) -> None:
-        # Replay anything already sent on a previous (now-dead) connection.
-        # sent_chunks is appended before send, so a chunk that failed to send
-        # last time is still present and gets retried here.
-        for chunk in pending.sent_chunks:
-            await ws.send(
-                json.dumps(
-                    {
-                        "type": "input_audio_buffer.append",
-                        "audio": base64.b64encode(chunk).decode("ascii"),
-                    }
-                )
-            )
-        if pending.ended:
-            await ws.send(
-                json.dumps({"type": "input_audio_buffer.commit", "final": True})
-            )
-            return
-        while True:
-            chunk = await pending.queue.get()
-            if chunk is None:
-                pending.ended = True
-                await ws.send(
-                    json.dumps({"type": "input_audio_buffer.commit", "final": True})
-                )
-                return
-            pending.sent_chunks.append(chunk)
-            await ws.send(
-                json.dumps(
-                    {
-                        "type": "input_audio_buffer.append",
-                        "audio": base64.b64encode(chunk).decode("ascii"),
-                    }
-                )
-            )
-
-    async def _receive_one_transcription(
-        self, ws: websockets.ClientConnection, request_id: str
-    ) -> None:
-        # Use recv() rather than `async for`: the latter swallows
-        # ConnectionClosed on close-mid-iteration, which would let a dropped
-        # WS look like a clean "no transcription" return.
-        current_text = ""
-        while True:
-            raw = await ws.recv()
-            data = json.loads(raw)
-            event_type = data.get("type")
-
-            if event_type == "transcription.delta":
-                delta = data.get("delta", "")
-                if not delta:
-                    continue
-                current_text += delta
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.INTERIM_TRANSCRIPT,
-                        request_id=request_id,
-                        alternatives=[stt.SpeechData(text=current_text, language="")],
-                    )
-                )
-            elif event_type == "transcription.done":
-                final_text = data.get("text") or current_text
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.FINAL_TRANSCRIPT,
-                        request_id=request_id,
-                        alternatives=[stt.SpeechData(text=final_text, language="")],
-                    )
-                )
-                usage = data.get("usage") or {}
-                self._event_ch.send_nowait(
-                    stt.SpeechEvent(
-                        type=stt.SpeechEventType.RECOGNITION_USAGE,
-                        request_id=request_id,
-                        recognition_usage=stt.RecognitionUsage(
-                            audio_duration=float(
-                                usage.get("audio_seconds")
-                                or usage.get("prompt_audio_seconds")
-                                or 0
-                            ),
-                            input_tokens=int(usage.get("prompt_tokens") or 0),
-                            output_tokens=int(usage.get("completion_tokens") or 0),
-                        ),
-                    )
-                )
-                return
-            elif event_type == "error":
-                err = data.get("error")
-                raise APIStatusError(str(err), status_code=500, body=data)
@@ -3,55 +3,17 @@
 from django import forms
 from django.contrib import admin, messages
 from django.contrib.auth import admin as auth_admin
-from django.db import transaction
-from django.utils.html import format_html
 from django.utils.translation import gettext_lazy as _

 from core.recording.event import notification

 from . import models
-from .tasks.file import process_file_deletion
-from .utils import generate_download_s3_url
-
-
-def hard_delete_file(file):
-    """Hard delete a file, soft deleting it first when needed."""
-    if file.deleted_at is None:
-        file.soft_delete()
-    file.hard_delete()
-    transaction.on_commit(lambda: process_file_deletion.delay(file.id))
-
-
-class FileInlineFormSet(forms.BaseInlineFormSet):
-    """Inline formset overriding delete behavior for files."""
-
-    def delete_existing(self, obj, commit=True):
-        """Hard delete files instead of calling model.delete()."""
-        hard_delete_file(obj)
-
-
-class FileInline(admin.TabularInline):
-    """Inline class for the File model."""
-
-    model = models.File
-    formset = FileInlineFormSet
-    fk_name = "creator"
-    extra = 0
-    fields = ("id", "title", "type", "upload_state", "created_at")
-    readonly_fields = ("id", "created_at", "upload_state", "type")
-    show_change_link = True
-
-    def get_queryset(self, request):
-        """Hide hard deleted files in the inline."""
-        return super().get_queryset(request).filter(hard_deleted_at__isnull=True)


@admin.register(models.User)
 class UserAdmin(auth_admin.UserAdmin):
    """Admin class for the User model"""

-    inlines = (FileInline,)
-
    fieldsets = (
        (
            None,
@@ -135,136 +97,6 @@ class UserAdmin(auth_admin.UserAdmin):
    search_fields = ("id", "sub", "admin_email", "email", "full_name")


-@admin.register(models.File)
-class FileAdmin(admin.ModelAdmin):
-    """Admin class for the File model."""
-
-    list_display = (
-        "id",
-        "title",
-        "type",
-        "creator",
-        "upload_state",
-        "deleted_at",
-        "hard_deleted_at",
-        "created_at",
-        "updated_at",
-    )
-    list_filter = (
-        "type",
-        "upload_state",
-        "created_at",
-        "updated_at",
-        "deleted_at",
-        "hard_deleted_at",
-    )
-    search_fields = (
-        "id",
-        "title",
-        "filename",
-        "mimetype",
-        "description",
-        "creator__email",
-        "creator__admin_email",
-        "creator__full_name",
-    )
-    ordering = ("-created_at",)
-    readonly_fields = (
-        "id",
-        "created_at",
-        "updated_at",
-        "deleted_at",
-        "hard_deleted_at",
-        "description",
-        "malware_detection_info",
-        "is_ready",
-        "preview_url",
-        "extension",
-        "key_base",
-        "file_key",
-        "upload_state",
-        "type",
-        "mimetype",
-        "size",
-    )
-    autocomplete_fields = ("creator",)
-    fieldsets = (
-        (
-            None,
-            {
-                "fields": (
-                    "id",
-                    "title",
-                    "type",
-                    "creator",
-                    "filename",
-                    "upload_state",
-                )
-            },
-        ),
-        (
-            _("Content"),
-            {
-                "fields": (
-                    "mimetype",
-                    "size",
-                    "description",
-                    "malware_detection_info",
-                )
-            },
-        ),
-        (
-            _("Deletion"),
-            {
-                "fields": (
-                    "deleted_at",
-                    "hard_deleted_at",
-                )
-            },
-        ),
-        (
-            _("Derived info"),
-            {
-                "fields": (
-                    "is_ready",
-                    "extension",
-                    "key_base",
-                    "file_key",
-                    "preview_url",
-                )
-            },
-        ),
-        (_("Timestamps"), {"fields": ("created_at", "updated_at")}),
-    )
-
-    @admin.display(description=_("File preview"))
-    def preview_url(self, obj):
-        """Return a clickable preview URL for the file."""
-        if not obj.is_ready:
-            return "-"
-        url = generate_download_s3_url(obj.key, expires_in=60 * 60)
-
-        return format_html(
-            '<a href="{}" target="_blank" rel="noopener noreferrer">Open File</a>', url
-        )
-
-    def get_queryset(self, request):
-        """Hide hard deleted files in admin listing and lookups."""
-        return super().get_queryset(request).filter(hard_deleted_at__isnull=True)
-
-    def delete_model(self, request, obj):
-        """Hard delete instead of calling model.delete()."""
-        hard_delete_file(obj)
-
-    def delete_queryset(self, request, queryset):
-        """Hard delete all selected files."""
-        for file in queryset:
-            hard_delete_file(file)
-
-    def has_add_permission(self, request):
-        return False
-
-
 class ResourceAccessInline(admin.TabularInline):
    """Admin class for the room user access model"""

@@ -279,16 +111,9 @@ class RoomAdmin(admin.ModelAdmin):

    inlines = (ResourceAccessInline,)
    search_fields = ["name", "slug", "=id"]
-    list_display = [
-        "name",
-        "slug",
-        "access_level",
-        "get_owner",
-        "created_at",
-        "last_started_at",
-    ]
-    list_filter = ["access_level", "created_at", "last_started_at"]
-    readonly_fields = ["id", "created_at", "updated_at", "last_started_at"]
+    list_display = ["name", "slug", "access_level", "get_owner", "created_at"]
+    list_filter = ["access_level", "created_at"]
+    readonly_fields = ["id", "created_at", "updated_at"]

    def get_queryset(self, request):
        """Optimize queries by prefetching related access and user data to avoid N+1 queries."""
@@ -409,14 +234,7 @@ class RecordingAdmin(admin.ModelAdmin):
    """Recording admin interface declaration."""

    inlines = (RecordingAccessInline,)
-    search_fields = [
-        "status",
-        "=id",
-        "worker_id",
-        "room__slug",
-        "=room__id",
-        "accesses__user__email",
-    ]
+    search_fields = ["status", "=id", "worker_id", "room__slug", "=room__id"]
    list_display = (
        "id",
        "status",
@@ -1,67 +0,0 @@
-"""
-Pluggable analytics.
-
-Usage anywhere in the codebase:
-
-    from core import analytics
-
-    analytics.capture(request.user, "room_created", {"room_id": str(room.pk)})
-
-The concrete backend is resolved lazily from Django settings, so swapping
-PostHog for anything else is a configuration change, not a code change.
-"""
-
-from functools import lru_cache
-from typing import Any
-
-from django.conf import settings
-from django.utils.module_loading import import_string
-
-from .base import AnalyticsBackend, NoOpAnalytics
-from .events import AnalyticsEvent
-from .user_feature_flags import UserFeatureFlag
-
-__all__ = [
-    "get_analytics",
-    "identify",
-    "capture",
-    "AnalyticsBackend",
-    "AnalyticsEvent",
-    "is_user_feature_flag_enabled",
-    "UserFeatureFlag",
-]
-
-
-@lru_cache(maxsize=1)
-def get_analytics() -> AnalyticsBackend:
-    """Instantiate the configured backend once per process."""
-    dotted_path = getattr(settings, "ANALYTICS_BACKEND", None)
-    options = getattr(settings, "ANALYTICS_BACKEND_SETTINGS", {}) or {}
-
-    if not dotted_path:
-        return NoOpAnalytics()
-
-    backend_class = import_string(dotted_path)
-    return backend_class(**options)
-
-
-# Convenience module-level shortcuts
-
-analytics_instance = get_analytics()
-
-
-def identify(user, properties: dict[str, Any] | None = None) -> None:
-    """Associate traits with an identified user."""
-    analytics_instance.identify(user, properties)
-
-
-def capture(
-    user, event: AnalyticsEvent, properties: dict[str, Any] | None = None
-) -> None:
-    """Record an event performed by an identified user."""
-    analytics_instance.capture(user, event, properties)
-
-
-def is_user_feature_flag_enabled(user, feature_name: UserFeatureFlag) -> bool:
-    """Check if a feature is enabled at the user level."""
-    return analytics_instance.is_user_feature_enabled(user, feature_name)
@@ -1,65 +0,0 @@
-"""Analytics backend protocol and default no-op implementation."""
-
-from abc import ABC, abstractmethod
-from typing import Any, Mapping
-
-from ..models import User
-from .events import AnalyticsEvent
-from .user_feature_flags import UserFeatureFlag
-
-
-class AnalyticsBackend(ABC):
-    """
-    Interface every analytics backend must implement.
-
-    Backends are instantiated once (singleton) with the kwargs declared in
-    settings.ANALYTICS_BACKEND_SETTINGS, e.g.:
-
-        ANALYTICS_BACKEND = "core.analytics.posthog.PostHogAnalytics"
-        ANALYTICS_BACKEND_SETTINGS = {"api_key": "...", "host": "..."}
-    """
-
-    @abstractmethod
-    def identify(self, user: User, properties: dict[str, Any] | None = None) -> None:
-        """Associate traits (email, name, ...) with an identified user."""
-
-    @abstractmethod
-    def capture(
-        self,
-        user: User,
-        event: AnalyticsEvent,
-        properties: dict[str, Any] | None = None,
-    ) -> None:
-        """Record an event performed by an identified user."""
-
-    @abstractmethod
-    def shutdown(self) -> None:
-        """Flush pending events. Called on process exit."""
-
-    def get_user_feature_flags(
-        self,
-        user: User,  # pylint: disable=unused-argument
-    ) -> Mapping[UserFeatureFlag, bool | str | None]:
-        """Return a dict of feature flags for the given user."""
-        # We return an empty dict here by default to avoid a breaking change
-        # By making this method abstract.
-        return {}
-
-    def is_user_feature_enabled(
-        self, user: User, feature_name: UserFeatureFlag
-    ) -> bool:
-        """Check if a feature is enabled at the user level."""
-        return self.get_user_feature_flags(user).get(feature_name, False) is True
-
-
-class NoOpAnalytics(AnalyticsBackend):
-    """Default backend: silently discards everything."""
-
-    def identify(self, user: User, properties=None) -> None:
-        """No-op: discards identify calls."""
-
-    def capture(self, user, event, properties=None) -> None:
-        """No-op: discards captured events."""
-
-    def shutdown(self) -> None:
-        """No-op: nothing to flush."""
@@ -1,14 +0,0 @@
-"""Catalog of all analytics events emitted by the backend."""
-
-from enum import StrEnum
-
-
-class AnalyticsEvent(StrEnum):
-    """All trackable events. Values are the wire names sent to the provider."""
-
-    # Rooms
-    ROOM_CREATED = "room_created"
-    ROOM_UPDATED = "room_updated"
-
-    # Roomkit (meeting-room SIP devices)
-    ROOMKIT_JOINED = "roomkit_joined"
@@ -1,116 +0,0 @@
-"""PostHog implementation of the analytics backend protocol."""
-
-import logging
-from typing import Any, Mapping
-
-from django.core.cache import cache
-
-from posthog import Posthog
-
-from ..models import User
-from .base import AnalyticsBackend
-from .events import AnalyticsEvent
-from .user_feature_flags import UserFeatureFlag
-
-logger = logging.getLogger(__name__)
-
-
-class PostHogAnalytics(AnalyticsBackend):
-    """Send events to PostHog, keyed on the user's primary key (UUID)."""
-
-    def __init__(
-        self,
-        *,
-        api_key: str,
-        host: str = "https://eu.i.posthog.com",
-        feature_flags_cache_ttl: int = 60,
-        feature_flags_cache_prefix: str = "user_feature_flags:",
-        **kwargs: Any,
-    ) -> None:
-
-        # The SDK batches and sends in a background thread by default,
-        # so calls below never block the request/response cycle.
-        self._client = Posthog(
-            project_api_key=api_key,
-            host=host,
-            **kwargs,
-        )
-        self._feature_flags_cache_ttl = feature_flags_cache_ttl
-        self._feature_flags_cache_prefix = feature_flags_cache_prefix
-
-    @staticmethod
-    def _distinct_id(user: User) -> str | None:
-        """Return the PostHog distinct_id for a user, or None if anonymous."""
-        if user is None or not getattr(user, "is_authenticated", False):
-            return None
-        return str(user.pk)
-
-    def identify(self, user: User, properties: dict[str, Any] | None = None) -> None:
-        """Associate traits (email, name, ...) with an identified user."""
-        distinct_id = self._distinct_id(user)
-        if distinct_id is None:
-            return
-        try:
-            self._client.set(
-                distinct_id=distinct_id,
-                properties=properties or {},
-            )
-        except Exception:  # pylint: disable=broad-exception-caught
-            logger.exception("PostHog identify failed")
-
-    def capture(
-        self,
-        user: User,
-        event: AnalyticsEvent,
-        properties: dict[str, Any] | None = None,
-    ) -> None:
-        """Record an event performed by an identified user."""
-        distinct_id = self._distinct_id(user)
-        if distinct_id is None:
-            return
-        try:
-            self._client.capture(
-                distinct_id=distinct_id,
-                event=str(event),
-                properties=properties or {},
-            )
-        except Exception:  # pylint: disable=broad-exception-caught
-            logger.exception("PostHog capture failed for event %s", event)
-
-    def shutdown(self) -> None:
-        """Flush pending events. Called on process exit."""
-        self._client.shutdown()
-
-    def _fetch_user_feature_flags(
-        self, user: User
-    ) -> Mapping[UserFeatureFlag, bool | str | None]:
-        """Compute feature flags for a user."""
-
-        distinct_id = self._distinct_id(user)
-        if distinct_id is None:
-            return {}
-
-        flags = self._client.evaluate_flags(distinct_id)
-        out: dict[UserFeatureFlag, bool | str | None] = {}
-        for flag_key in UserFeatureFlag:
-            out[flag_key] = flags.get_flag(flag_key.value)
-
-        return out
-
-    def get_user_feature_flags(
-        self, user: User
-    ) -> Mapping[UserFeatureFlag, bool | str | None]:
-        """Get feature flags for a user. Caches the result for a short time."""
-        distinct_id = self._distinct_id(user)
-        if distinct_id is None:
-            return {}
-
-        try:
-            return cache.get_or_set(
-                f"{self._feature_flags_cache_prefix}{distinct_id}",
-                default=lambda: self._fetch_user_feature_flags(user),
-                timeout=self._feature_flags_cache_ttl,
-            )
-        except Exception:  # pylint: disable=broad-exception-caught
-            logger.exception("Failed to get feature flags for user %s", user.pk)
-            return {}
@@ -1,9 +0,0 @@
-"""Catalog of all analytics feature flags used by the backend."""
-
-from enum import StrEnum
-
-
-class UserFeatureFlag(StrEnum):
-    """All feature flags configured in the app."""
-
-    TRANSCRIPT_SUMMARY_ENABLED = "summary-enabled"
@@ -8,8 +8,6 @@ from rest_framework import views as drf_views
 from rest_framework.decorators import api_view
 from rest_framework.response import Response

-from core.utils import build_telephony_config
-

 def exception_handler(exc, context):
    """Handle Django ValidationError as an accepted exception.
@@ -60,22 +58,20 @@ def get_frontend_configuration(request):
                "allowed_mimetypes"
            ],
        },
-        "telephony": build_telephony_config(),
-        "resource": {
-            "default_access_level": settings.RESOURCE_DEFAULT_ACCESS_LEVEL,
+        "telephony": {
+            "enabled": settings.ROOM_TELEPHONY_ENABLED,
+            "phone_number": settings.ROOM_TELEPHONY_PHONE_NUMBER
+            if settings.ROOM_TELEPHONY_ENABLED
+            else None,
+            "default_country": settings.ROOM_TELEPHONY_DEFAULT_COUNTRY,
        },
        "subtitle": {"enabled": settings.ROOM_SUBTITLE_ENABLED},
-        "diagnostics": {"connection_test_enabled": settings.CONNECTION_TEST_ENABLED},
        "livekit": {
            "url": settings.LIVEKIT_CONFIGURATION["url"],
            "force_wss_protocol": settings.LIVEKIT_FORCE_WSS_PROTOCOL,
            "enable_firefox_proxy_workaround": settings.LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND,
            "default_sources": settings.LIVEKIT_DEFAULT_SOURCES,
-            "default_video_codec": settings.LIVEKIT_DEFAULT_VIDEO_CODEC,
        },
-        "authenticated_users_can_edit_display_name": (
-            settings.AUTHENTICATED_PARTICIPANTS_CAN_EDIT_DISPLAY_NAME
-        ),
    }
    frontend_configuration.update(settings.FRONTEND_CONFIGURATION)
    return Response(frontend_configuration)
@@ -11,12 +11,11 @@ class FeatureFlag:

    FLAGS = {
        "recording": "RECORDING_ENABLE",
+        "storage_event": "RECORDING_STORAGE_EVENT_ENABLE",
        "subtitle": "ROOM_SUBTITLE_ENABLED",
        "file_upload": "FILE_UPLOAD_ENABLED",
        "addons": "ADDONS_ENABLED",
        "application": "APPLICATION_ENABLED",
-        "roomkit": "ROOMKIT_ENABLED",
-        "connection_test": "CONNECTION_TEST_ENABLED",
    }

    @classmethod
@@ -5,12 +5,11 @@ from django.http import Http404

 from rest_framework import permissions

-from ..models import RoleChoices, RoomAccessLevel
-from ..services.participants_management import (
-    ParticipantNotFoundException,
-    ParticipantsManagement,
-    ParticipantsManagementException,
-)
+from ..models import RoleChoices
+
+ACTION_FOR_METHOD_TO_PERMISSION = {
+    "versions_detail": {"DELETE": "versions_destroy", "GET": "versions_retrieve"}
+}


 class IsAuthenticated(permissions.BasePermission):
@@ -23,6 +22,15 @@ class IsAuthenticated(permissions.BasePermission):
        return bool(request.auth) or request.user.is_authenticated


+class IsAuthenticatedOrSafe(IsAuthenticated):
+    """Allows access to authenticated users (or anonymous users but only on safe methods)."""
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+        return super().has_permission(request, view)
+
+
 class IsSelf(IsAuthenticated):
    """
    Allows access only to authenticated users. Alternative method checking the presence
@@ -158,75 +166,3 @@ class CanMuteParticipant(permissions.BasePermission):

        # LiveKit token scoped to this room
        return request.auth.video.room == str(obj.id)
-
-
-class IsPresentInMeeting(permissions.BasePermission):
-    """Check that the requesting user is currently connected to the meeting.
-
-    The requester must be session-authenticated (their DB identity is needed
-    to check privileges); presence is verified against LiveKit using their
-    `sub` as participant identity. Fails closed on LiveKit errors.
-    """
-
-    message = "You must be connected to the meeting to perform this action."
-
-    def has_object_permission(self, request, view, obj):
-        """Verify the requester's identity is a participant of the room."""
-        user = request.user
-
-        if not user or not user.is_authenticated:
-            return False
-
-        try:
-            return ParticipantsManagement().check_if_in_meeting(
-                room_name=str(obj.pk), identity=str(user.sub)
-            )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
-            return False
-
-
-class CanManageLobby(permissions.BasePermission):
-    """Grant lobby management (list/accept/deny waiting participants).
-
-    - Room admins/owners can always manage the lobby.
-    - When the room access level is TRUSTED, any authenticated user who is
-      currently connected to the meeting can manage the lobby. Presence is
-      verified cache-first (Redis), falling back to the LiveKit API.
-
-    Access level is always read fresh from the DB; only presence is cached,
-    so changing the room to RESTRICTED takes effect immediately.
-    """
-
-    message = "You are not allowed to manage this room's lobby."
-
-    # pylint: disable=too-many-return-statements
-    def has_object_permission(self, request, view, obj):  # noqa: PLR0911
-        """Check privileges first, then the trusted-room presence path."""
-        user = request.user
-
-        if not user or not user.is_authenticated:
-            return False
-
-        # Product choice: lobby management is reserved for session-authenticated
-        # users with a real account, not holders of a LiveKit room token.
-        if request.auth and hasattr(request.auth, "video"):
-            return False
-
-        if obj.is_administrator_or_owner(user):
-            return True
-
-        if obj.access_level != RoomAccessLevel.TRUSTED:
-            return False
-
-        self.message = "You must be connected to the meeting to manage its lobby."
-
-        try:
-            return ParticipantsManagement().check_if_in_meeting_cached(
-                room_name=str(obj.pk), identity=str(user.sub)
-            )
-        except ParticipantNotFoundException:
-            return False
-        except ParticipantsManagementException:
-            return False
@@ -31,28 +31,9 @@ class UserSerializer(serializers.ModelSerializer):

    class Meta:
        model = models.User
-        fields = [
-            "id",
-            "email",
-            "full_name",
-            "short_name",
-            "timezone",
-            "language",
-            "default_room_access_level",
-            "default_room_configuration",
-        ]
+        fields = ["id", "email", "full_name", "short_name", "timezone", "language"]
        read_only_fields = ["id", "email", "full_name", "short_name"]

-    def validate_default_room_configuration(self, value):
-        """Validate the default room configuration against the RoomConfiguration schema."""
-        if value is None or value == {}:
-            return value
-        try:
-            RoomConfiguration.model_validate(value)
-        except PydanticValidationError as e:
-            raise serializers.ValidationError(e.errors()) from e
-        return value
-

 class UserLightSerializer(serializers.ModelSerializer):
    """Serialize users with limited fields."""
@@ -202,11 +183,13 @@ class RoomSerializer(serializers.ModelSerializer):
                user=request.user,
                username=username,
                configuration=output["configuration"],
-                role=role,
+                is_admin_or_owner=is_admin_or_owner,
            )
        else:
            del output["pin_code"]

+        output["is_administrable"] = is_admin_or_owner
+
        return output


@@ -316,8 +299,8 @@ class RoomInviteSerializer(serializers.Serializer):
 class BaseParticipantsManagementSerializer(BaseValidationOnlySerializer):
    """Base serializer for participant management operations."""

-    participant_identity = serializers.CharField(
-        help_text="LiveKit participant identity (matching the user's sub format)"
+    participant_identity = serializers.UUIDField(
+        help_text="LiveKit participant identity (UUID format)"
    )


@@ -329,15 +312,6 @@ class MuteParticipantSerializer(BaseParticipantsManagementSerializer):
    )


-class ParticipantRoleSerializer(BaseParticipantsManagementSerializer):
-    """Validate an in-meeting role change (promotion/demotion) request."""
-
-    role = serializers.ChoiceField(
-        choices=[models.RoleChoices.MEMBER, models.RoleChoices.ADMIN],
-        help_text="Target role. Ownership cannot be granted this way.",
-    )
-
-
 TrackSource = Literal["camera", "microphone", "screen_share", "screen_share_audio"]


@@ -482,7 +456,7 @@ class ListFileSerializer(serializers.ModelSerializer):

    def get_url(self, obj):
        """Return the URL of the file."""
-        if not obj.is_ready:
+        if obj.is_pending_upload:
            return None

        return f"{settings.MEDIA_BASE_URL}{settings.MEDIA_URL}{quote(obj.file_key)}"
@@ -589,13 +563,3 @@ class RenameParticipantSerializer(BaseValidationOnlySerializer):
    """Serializer for renaming a participant in a room."""

    name = serializers.CharField(min_length=1, max_length=255, allow_blank=False)
-
-
-class ExternalProcessEventSerializer(BaseValidationOnlySerializer):
-    """Validate external process event data."""
-
-    job_id = serializers.CharField(required=True)
-    # We are not strict on purpose on those fields to avoid
-    # useless bad requests
-    type = serializers.CharField(required=False, allow_null=True, allow_blank=True)
-    status = serializers.CharField(required=False, allow_null=True, allow_blank=True)
--- a/Show More
+++ b/Show More