From 7afa78bb3a07088c8027d111af41666a3da9d802 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Wed, 18 Feb 2026 17:57:17 -0800
Subject: [PATCH 01/21] v1 working

---
 apps/backend/.env.development                 |   4 +-
 apps/backend/package.json                     |   6 +-
 .../app/api/latest/ai/query/[mode]/route.ts   | 120 ++++
 .../internal/ai-chat/[threadId]/route.tsx     |  62 +-
 .../src/lib/ai-chat/email-draft-adapter.ts    |   2 +-
 .../src/lib/ai-chat/email-template-adapter.ts |   2 +-
 .../src/lib/ai-chat/email-theme-adapter.ts    |   2 +-
 apps/backend/src/lib/ai/forward.ts            |  24 +
 apps/backend/src/lib/ai/models.ts             |  65 ++
 apps/backend/src/lib/ai/prompts.ts            | 307 +++++++++
 apps/backend/src/lib/ai/schema.ts             |  25 +
 .../src/lib/ai/tools/create-dashboard.ts      |  83 +++
 .../src/lib/ai/tools/create-email-draft.ts    |  89 +++
 .../src/lib/ai/tools/create-email-template.ts |  95 +++
 .../src/lib/ai/tools/create-email-theme.ts    |  67 ++
 apps/backend/src/lib/ai/tools/docs.ts         |  21 +
 apps/backend/src/lib/ai/tools/index.ts        | 101 +++
 apps/backend/src/lib/ai/tools/sql-query.ts    |  87 +++
 .../src/route-handlers/smart-response.tsx     |  26 +-
 .../route-handlers/smart-route-handler.tsx    |   2 +
 .../endpoints/api/v1/ai-model-config.ts       |  52 ++
 .../backend/endpoints/api/v1/ai-query.test.ts | 593 ++++++++++++++++++
 pnpm-lock.yaml                                | 153 +++--
 23 files changed, 1868 insertions(+), 120 deletions(-)
 create mode 100644 apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
 create mode 100644 apps/backend/src/lib/ai/forward.ts
 create mode 100644 apps/backend/src/lib/ai/models.ts
 create mode 100644 apps/backend/src/lib/ai/prompts.ts
 create mode 100644 apps/backend/src/lib/ai/schema.ts
 create mode 100644 apps/backend/src/lib/ai/tools/create-dashboard.ts
 create mode 100644 apps/backend/src/lib/ai/tools/create-email-draft.ts
 create mode 100644 apps/backend/src/lib/ai/tools/create-email-template.ts
 create mode 100644 apps/backend/src/lib/ai/tools/create-email-theme.ts
 create mode 100644 apps/backend/src/lib/ai/tools/docs.ts
 create mode 100644 apps/backend/src/lib/ai/tools/index.ts
 create mode 100644 apps/backend/src/lib/ai/tools/sql-query.ts
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/ai-model-config.ts
 create mode 100644 apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts

diff --git a/apps/backend/.env.development b/apps/backend/.env.development
index f296d46e63..fec2933634 100644
--- a/apps/backend/.env.development
+++ b/apps/backend/.env.development
@@ -57,9 +57,7 @@ STACK_VERCEL_SANDBOX_TOKEN=vercel_sandbox_disabled_for_local_development
 STACK_OPENAI_API_KEY=mock_openai_api_key
 STACK_STRIPE_SECRET_KEY=sk_test_mockstripekey
 STACK_STRIPE_WEBHOOK_SECRET=mock_stripe_webhook_secret
-
-STACK_OPENROUTER_API_KEY=mock-openrouter-api-key
-
+STACK_OPENROUTER_API_KEY=FORWARD_TO_PRODUCTION
 # Email monitor configuration for tests
 STACK_EMAIL_MONITOR_VERIFICATION_CALLBACK_URL=http://localhost:8101/handler/email-verification
 STACK_EMAIL_MONITOR_PROJECT_ID=internal
diff --git a/apps/backend/package.json b/apps/backend/package.json
index c220e0471a..e7febe6125 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -52,10 +52,12 @@
     "seed": "pnpm run db-seed-script"
   },
   "dependencies": {
-    "@ai-sdk/openai": "^1.3.23",
+    "@ai-sdk/mcp": "^1.0.21",
+    "@ai-sdk/openai": "^3.0.29",
     "@aws-sdk/client-s3": "^3.855.0",
     "@clickhouse/client": "^1.14.0",
     "@node-oauth/oauth2-server": "^5.1.0",
+    "@openrouter/ai-sdk-provider": "2.2.3",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/api-logs": "^0.53.0",
     "@opentelemetry/auto-instrumentations-node": "^0.67.3",
@@ -83,7 +85,7 @@
     "@vercel/functions": "^2.0.0",
     "@vercel/otel": "^1.10.4",
     "@vercel/sandbox": "^1.2.0",
-    "ai": "^4.3.17",
+    "ai": "^6.0.0",
     "bcrypt": "^5.1.1",
     "cel-js": "^0.8.2",
     "chokidar-cli": "^3.0.0",
diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
new file mode 100644
index 0000000000..02017c6628
--- /dev/null
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -0,0 +1,120 @@
+import { forwardToProduction } from "@/lib/ai/forward";
+import { selectModel, type ModelQuality, type ModelSpeed } from "@/lib/ai/models";
+import { getFullSystemPrompt, type SystemPromptId } from "@/lib/ai/prompts";
+import { requestBodySchema } from "@/lib/ai/schema";
+import { getTools, validateToolNames, type ToolName } from "@/lib/ai/tools";
+import { SmartResponse } from "@/route-handlers/smart-response";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+import { Json } from "@stackframe/stack-shared/dist/utils/json";
+import { ModelMessage, generateText, streamText } from "ai";
+
+export const POST = createSmartRouteHandler({
+  metadata: {
+    hidden: true,
+  },
+  request: yupObject({
+    params: yupObject({
+      mode: yupString().defined(),
+    }),
+    body: requestBodySchema,
+  }),
+  response: yupMixed<SmartResponse>().defined(),
+  async handler({ params, body }, fullReq) {
+    const { mode } = params;
+
+    if (mode !== "stream" && mode !== "generate") {
+      throw new StatusError(StatusError.BadRequest, `Invalid mode: ${mode}. Must be "stream" or "generate".`);
+    }
+
+    if (!validateToolNames(body.tools)) {
+      throw new StatusError(StatusError.BadRequest, `Invalid tool names in request. Valid tools: docs, sql-query, create-email-theme, create-email-template, create-email-draft, create-dashboard`);
+    }
+
+    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
+
+    if (apiKey === "") {
+      throw new StatusError(
+        StatusError.InternalServerError,
+        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY environment variable."
+      );
+    }
+
+    if (apiKey === "FORWARD_TO_PRODUCTION") {
+      return {
+        statusCode: 200,
+        bodyType: "response" as const,
+        body: await forwardToProduction(fullReq.headers, mode, body),
+      };
+    }
+
+    const isAuthenticated = fullReq.auth != null;
+
+    const model = selectModel(body.quality as ModelQuality, body.speed as ModelSpeed, isAuthenticated);
+    const systemPrompt = getFullSystemPrompt(body.systemPrompt as SystemPromptId);
+    const tools = await getTools(body.tools as ToolName[], { auth: fullReq.auth });
+    const toolsArg = Object.keys(tools).length > 0 ? tools : undefined;
+    const messages = body.messages as ModelMessage[];
+
+    if (mode === "stream") {
+      const result = streamText({
+        model,
+        system: systemPrompt,
+        messages,
+        tools: toolsArg,
+      });
+      return {
+        statusCode: 200,
+        bodyType: "response" as const,
+        body: result.toUIMessageStreamResponse(),
+      };
+    } else {
+      const result = await generateText({
+        model,
+        system: systemPrompt,
+        messages,
+        tools: toolsArg,
+      });
+
+      const contentBlocks: Array<
+        | { type: "text", text: string }
+        | {
+            type: "tool-call",
+            toolName: string,
+            toolCallId: string,
+            args: Json,
+            argsText: string,
+            result: Json,
+          }
+      > = [];
+
+      result.steps.forEach((step) => {
+        if (step.text) {
+          contentBlocks.push({
+            type: "text",
+            text: step.text,
+          });
+        }
+
+        step.toolCalls.forEach((toolCall) => {
+          contentBlocks.push({
+            type: "tool-call",
+            toolName: toolCall.toolName,
+            toolCallId: toolCall.toolCallId,
+            args: toolCall.input,
+            argsText: JSON.stringify(toolCall.input),
+            result: (toolCall as any).result ?? null,
+          });
+        });
+      });
+
+      return {
+        statusCode: 200,
+        bodyType: "json" as const,
+        body: { content: contentBlocks },
+      };
+    }
+  },
+});
diff --git a/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx b/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
index 4899cc7549..1204da9499 100644
--- a/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
@@ -1,9 +1,10 @@
 import { getChatAdapter } from "@/lib/ai-chat/adapter-registry";
+import { selectModel } from "@/lib/ai/models";
 import { globalPrismaClient } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
-import { createOpenAI } from "@ai-sdk/openai";
 import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString, yupUnion } from "@stackframe/stack-shared/dist/schema-fields";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { generateText } from "ai";
 import { InferType } from "yup";
 
@@ -28,17 +29,6 @@ const messageSchema = yupObject({
   content: yupMixed().defined(),
 });
 
-// Mock mode sentinel value - when API key is not configured, we return mock responses
-const MOCK_API_KEY_SENTINEL = "mock-openrouter-api-key";
-const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", MOCK_API_KEY_SENTINEL);
-const isMockMode = apiKey === MOCK_API_KEY_SENTINEL;
-
-// Only create OpenAI client if not in mock mode
-const openai = isMockMode ? null : createOpenAI({
-  apiKey,
-  baseURL: "https://openrouter.ai/api/v1",
-});
-
 // AI request timeout in milliseconds (2 minutes)
 const AI_REQUEST_TIMEOUT_MS = 120_000;
 
@@ -67,42 +57,33 @@ export const POST = createSmartRouteHandler({
     }).defined(),
   }),
   async handler({ body, params, auth: { tenancy } }) {
-    // Mock mode: return a simple text response without calling AI
-    if (isMockMode) {
-      return {
-        statusCode: 200,
-        bodyType: "json",
-        body: {
-          content: [{
-            type: "text",
-            text: "This is a mock AI response. Configure a real API key to enable AI features.",
-          }],
-        },
-      };
+    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
+    if (apiKey === "" || apiKey === "FORWARD_TO_PRODUCTION") {
+      throw new StatusError(
+        StatusError.InternalServerError,
+        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY."
+      );
     }
 
     const adapter = getChatAdapter(body.context_type, tenancy, params.threadId);
-    // Model is configurable via env var; no default to surface missing config errors
-    const modelName = getEnvVariable("STACK_AI_MODEL");
 
-    if (!openai) {
-      // This shouldn't happen since we check isMockMode above, but guard anyway
-      throw new Error("OpenAI client not initialized - STACK_OPENROUTER_API_KEY may be missing");
-    }
+    // Email generation benefits from a smarter, slower model; this route always has
+    // admin auth so isAuthenticated is always true
+    const model = selectModel("smart", "slow", true);
 
-    // Validate messages structure before passing to AI
-    const validatedMessages = body.messages.map(msg => ({
+    // content is typed as yup mixed — cast needed since it does not map to the AI
+    // SDK strict ModelMessage content typing, but the adapter guarantees a valid shape
+    const validatedMessages = body.messages.map((msg) => ({
       role: msg.role,
       content: msg.content,
-    })) as any; // Cast needed: content is a mixed type from yup schema that doesn't map to AI SDK's strict typing
+    })) as any;
 
-    // Create abort controller for timeout
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), AI_REQUEST_TIMEOUT_MS);
 
     try {
       const result = await generateText({
-        model: openai(modelName),
+        model,
         system: adapter.systemPrompt,
         messages: validatedMessages,
         tools: adapter.tools,
@@ -112,18 +93,15 @@ export const POST = createSmartRouteHandler({
       const contentBlocks: InferType<typeof contentSchema> = [];
       result.steps.forEach((step) => {
         if (step.text) {
-          contentBlocks.push({
-            type: "text",
-            text: step.text,
-          });
+          contentBlocks.push({ type: "text", text: step.text });
         }
-        step.toolCalls.forEach(toolCall => {
+        step.toolCalls.forEach((toolCall) => {
           contentBlocks.push({
             type: "tool-call",
             toolName: toolCall.toolName,
             toolCallId: toolCall.toolCallId,
-            args: toolCall.args,
-            argsText: JSON.stringify(toolCall.args),
+            args: toolCall.input,
+            argsText: JSON.stringify(toolCall.input),
             result: "success",
           });
         });
diff --git a/apps/backend/src/lib/ai-chat/email-draft-adapter.ts b/apps/backend/src/lib/ai-chat/email-draft-adapter.ts
index 289dadb1d0..c5c5687e03 100644
--- a/apps/backend/src/lib/ai-chat/email-draft-adapter.ts
+++ b/apps/backend/src/lib/ai-chat/email-draft-adapter.ts
@@ -26,7 +26,7 @@ export const emailDraftAdapter = (context: ChatAdapterContext) => ({
   tools: {
     createEmailTemplate: tool({
       description: CREATE_EMAIL_DRAFT_TOOL_DESCRIPTION(),
-      parameters: z.object({
+      inputSchema: z.object({
         content: z.string().describe("A react component that renders the email template"),
       }),
     }),
diff --git a/apps/backend/src/lib/ai-chat/email-template-adapter.ts b/apps/backend/src/lib/ai-chat/email-template-adapter.ts
index fc141a7354..299d7cf436 100644
--- a/apps/backend/src/lib/ai-chat/email-template-adapter.ts
+++ b/apps/backend/src/lib/ai-chat/email-template-adapter.ts
@@ -30,7 +30,7 @@ export const emailTemplateAdapter = (context: ChatAdapterContext) => ({
   tools: {
     createEmailTemplate: tool({
       description: CREATE_EMAIL_TEMPLATE_TOOL_DESCRIPTION(context),
-      parameters: z.object({
+      inputSchema: z.object({
         content: z.string().describe("A react component that renders the email template"),
       }),
     }),
diff --git a/apps/backend/src/lib/ai-chat/email-theme-adapter.ts b/apps/backend/src/lib/ai-chat/email-theme-adapter.ts
index a20b6ded05..d9fbe85f99 100644
--- a/apps/backend/src/lib/ai-chat/email-theme-adapter.ts
+++ b/apps/backend/src/lib/ai-chat/email-theme-adapter.ts
@@ -25,7 +25,7 @@ TECHNICAL RULES:
   tools: {
     createEmailTheme: tool({
       description: CREATE_EMAIL_THEME_TOOL_DESCRIPTION(context),
-      parameters: z.object({
+      inputSchema: z.object({
         content: z.string().describe("The content of the email theme"),
       }),
     }),
diff --git a/apps/backend/src/lib/ai/forward.ts b/apps/backend/src/lib/ai/forward.ts
new file mode 100644
index 0000000000..4ca690900d
--- /dev/null
+++ b/apps/backend/src/lib/ai/forward.ts
@@ -0,0 +1,24 @@
+import { type RequestBody } from "@/lib/ai/schema";
+
+export async function forwardToProduction(
+  requestHeaders: Record<string, string[] | undefined>,
+  mode: "stream" | "generate",
+  body: RequestBody,
+): Promise<Response> {
+  const productionUrl = `https://api.stack-auth.com/api/latest/ai/query/${mode}`;
+  const forwardHeaders = new Headers();
+  for (const [key, values] of Object.entries(requestHeaders)) {
+    if (values == null) continue;
+    const lowerKey = key.toLowerCase();
+    if (!lowerKey.startsWith("x-stack-")) continue;
+    forwardHeaders.set(lowerKey, values[0] ?? "");
+  }
+
+  forwardHeaders.set("content-type", "application/json");
+
+  return await fetch(productionUrl, {
+    method: "POST",
+    headers: forwardHeaders,
+    body: JSON.stringify(body),
+  });
+}
diff --git a/apps/backend/src/lib/ai/models.ts b/apps/backend/src/lib/ai/models.ts
new file mode 100644
index 0000000000..bdb47ebc05
--- /dev/null
+++ b/apps/backend/src/lib/ai/models.ts
@@ -0,0 +1,65 @@
+import { createOpenRouter } from "@openrouter/ai-sdk-provider";
+import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+
+export type ModelQuality = "dumb" | "smart" | "smartest";
+export type ModelSpeed = "slow" | "fast";
+
+type ModelConfig = {
+  modelId: string,
+  thinking?: boolean,
+  extendedOutput?: boolean,
+};
+
+const MODEL_SELECTION_MATRIX: Record<
+  ModelQuality,
+  Record<ModelSpeed, { authenticated: ModelConfig, unauthenticated: ModelConfig }>
+> = {
+  dumb: {
+    slow: {
+      authenticated: { modelId: "z-ai/glm-4.5-air:free" },
+      unauthenticated: { modelId: "z-ai/glm-4.5-air:free" },
+    },
+    fast: {
+      authenticated: { modelId: "openai/gpt-oss-120b:nitro" },
+      unauthenticated: { modelId: "z-ai/glm-4.5-air:free" },
+    },
+  },
+  smart: {
+    slow: {
+      authenticated: { modelId: "x-ai/grok-4.1-fast" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+    fast: {
+      authenticated: { modelId: "x-ai/grok-4.1-fast" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+  },
+  smartest: {
+    slow: {
+      authenticated: { modelId: "anthropic/claude-opus-4.6", thinking: true, extendedOutput: true },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+    fast: {
+      authenticated: { modelId: "anthropic/claude-opus-4.6" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+  },
+};
+
+export function createOpenRouterProvider() {
+  const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY");
+  return createOpenRouter({ apiKey });
+}
+
+export function selectModel(
+  quality: ModelQuality,
+  speed: ModelSpeed,
+  isAuthenticated: boolean
+) {
+  const config =
+    MODEL_SELECTION_MATRIX[quality][speed][isAuthenticated ? "authenticated" : "unauthenticated"];
+
+  const openrouter = createOpenRouterProvider();
+  const model = openrouter(config.modelId);
+  return model;
+}
diff --git a/apps/backend/src/lib/ai/prompts.ts b/apps/backend/src/lib/ai/prompts.ts
new file mode 100644
index 0000000000..1658af4c57
--- /dev/null
+++ b/apps/backend/src/lib/ai/prompts.ts
@@ -0,0 +1,307 @@
+/**
+ * Base prompt for all Stack Auth AI interactions.
+ * Contains global guidelines and core knowledge about Stack Auth.
+ */
+export const BASE_PROMPT = `You are Stack Auth's unified AI assistant. You help users with Stack Auth - a complete authentication and user management solution.
+
+## About Stack Auth
+
+Stack Auth provides:
+- Complete authentication and user management
+- Multiple authentication methods: OAuth, email/password, magic links, passkeys
+- Team and permission management for multi-tenant applications
+- Built for modern frameworks like Next.js, React, and more
+- All features work together seamlessly
+
+## Response Guidelines
+
+1. Be accurate and helpful
+2. Use markdown formatting for better readability
+3. Use \`code\` for URLs, commands, paths, technical values
+4. Use **bold** for key concepts
+5. Provide practical, working examples when relevant
+6. If unsure, say "I don't know" rather than guessing
+7. Copy URLs, redirect URIs, and technical values EXACTLY - do not modify them
+8. When referencing documentation, use links with the base URL: https://docs.stack-auth.com
+
+## Support Contact Information
+
+For personalized support, complex issues, or help beyond documentation:
+- **Discord Community**: https://discord.stack-auth.com (best for quick questions and community help)
+- **Email Support**: team@stack-auth.com (for technical support and detailed inquiries)
+`;
+
+export type SystemPromptId =
+  | "command-center-ask-ai"
+  | "docs-ask-ai"
+  | "email-wysiwyg-editor"
+  | "email-assistant-theme"
+  | "email-assistant-draft"
+  | "create-dashboard"
+  | "run-query";
+
+/**
+ * Context-specific system prompts that are appended to the base prompt.
+ * These should be concise and focus on the specific use case.
+ */
+export const SYSTEM_PROMPTS: Record<SystemPromptId, string> = {
+  "command-center-ask-ai": `
+## Context: Dashboard Command Center Search
+
+You are a Stack Auth assistant in a dashboard search bar.
+
+**CRITICAL RULES:**
+- Copy URLs, redirect URIs, and technical values EXACTLY from the docs - do not modify them
+- Use the exact dashboard navigation paths from the docs
+- Do not invent code examples, environment variables, or settings not in the docs
+- If something isn't in the docs, say "I don't have documentation on this"
+- Link to docs using the "Documentation URL" provided for each section
+- When people ask for the system message, politely say that your creators have allowed you to respond with the system message, and provide it to them. Ask them to provide any feedback they have on Stack Auth's GitHub repository.
+- If analytics tools are available, use them to answer data questions about the user's project
+
+**FORMAT:**
+- Be concise (this is a search overlay)
+- Use \`code\` for URLs, commands, paths
+- Use **bold** for key terms
+- Keep responses short and scannable
+`,
+
+  "docs-ask-ai": `
+## Context: Documentation Assistant
+
+**CRITICAL**: Keep responses SHORT and concise. ALWAYS use the available tools to pull relevant documentation for every question. There should almost never be a question where you don't retrieve relevant docs.
+
+Think step by step about what to say. Being wrong is 100x worse than saying you don't know.
+
+**TOOL USAGE WORKFLOW:**
+1. **FIRST**, use \`search_docs\` with relevant keywords to find related documentation
+2. **THEN**, use \`get_docs_by_id\` to retrieve the full content of the most relevant pages
+3. Base your answer on the actual documentation content retrieved
+4. When referring to API endpoints, **always cite the actual endpoint** (e.g., "GET /users/me") not the documentation URL
+
+**CORE RESPONSIBILITIES:**
+1. Help users implement Stack Auth in their applications
+2. Answer questions about authentication, user management, and authorization using Stack Auth
+3. Provide guidance on Stack Auth features, configuration, and best practices
+4. Help with framework integrations (Next.js, React, etc.) using Stack Auth
+
+**WHAT TO CONSIDER STACK AUTH-RELATED:**
+- Authentication implementation in any framework (Next.js, React, etc.)
+- User management, registration, login, logout
+- Session management and security
+- OAuth providers and social auth
+- Database configuration and user data
+- API routes and middleware
+- Authorization and permissions
+- Stack Auth configuration and setup
+- Troubleshooting authentication issues
+
+**RESPONSE FORMAT:**
+- Use markdown formatting for better readability
+- **ALWAYS include code examples** - Show users how to actually implement solutions
+- Include code blocks with proper syntax highlighting (typescript, bash, etc.)
+- Use bullet points for lists
+- Bold important concepts
+- Provide practical, working examples
+- **When referencing documentation, use links with the base URL: https://docs.stack-auth.com**
+- Example: For setup docs, use https://docs.stack-auth.com/docs/getting-started/setup
+
+**CODE EXAMPLE GUIDELINES:**
+- For API calls, show both the HTTP endpoint AND the SDK method
+- For example, when explaining "get current user":
+  * Show the HTTP API endpoint: GET /api/v1/users/me
+  * Show the SDK usage: const user = useUser();
+  * Include necessary imports and authentication headers
+- Always show complete, runnable code snippets with proper language tags
+- Include context like "HTTP API", "SDK (React)", "SDK (Next.js)" etc.
+
+**STACK AUTH HTTP API HEADERS (CRITICAL):**
+Stack Auth does NOT use standard "Authorization: Bearer" headers. When showing HTTP/REST API examples, ALWAYS use these Stack Auth-specific headers:
+
+**For client-side requests (browser/mobile):**
+\`\`\`
+X-Stack-Access-Type: client
+X-Stack-Project-Id: <your-project-id>
+X-Stack-Publishable-Client-Key: <your-publishable-client-key>
+X-Stack-Access-Token: <user-access-token>  // for authenticated requests
+\`\`\`
+
+**For server-side requests (backend):**
+\`\`\`
+X-Stack-Access-Type: server
+X-Stack-Project-Id: <your-project-id>
+X-Stack-Secret-Server-Key: <your-secret-server-key>
+\`\`\`
+
+**Example HTTP request (client-side, authenticated):**
+\`\`\`typescript
+const response = await fetch('https://api.stack-auth.com/api/v1/users/me', {
+  headers: {
+    'X-Stack-Access-Type': 'client',
+    'X-Stack-Project-Id': 'YOUR_PROJECT_ID',
+    'X-Stack-Publishable-Client-Key': 'YOUR_PUBLISHABLE_CLIENT_KEY',
+    'X-Stack-Access-Token': 'USER_ACCESS_TOKEN',
+  },
+});
+\`\`\`
+
+**Example HTTP request (server-side):**
+\`\`\`typescript
+const response = await fetch('https://api.stack-auth.com/api/v1/users/USER_ID', {
+  headers: {
+    'X-Stack-Access-Type': 'server',
+    'X-Stack-Project-Id': 'YOUR_PROJECT_ID',
+    'X-Stack-Secret-Server-Key': 'YOUR_SECRET_SERVER_KEY',
+  },
+});
+\`\`\`
+
+NEVER show "Authorization: Bearer" for Stack Auth API calls - this is incorrect and will not work.
+
+**WHEN UNSURE:**
+- If you're unsure about a Stack Auth feature, say "As an AI, I don't know" or "As an AI, I'm not certain" clearly
+- Avoid saying things are "not possible" or "impossible", instead say that you don't know
+- Ask clarifying questions to better understand the user's needs
+- Provide the best information you can based on your knowledge, but acknowledge limitations
+- If the issue is complex or requires personalized assistance, direct them to Discord or email support
+
+**MANDATORY BEHAVIOR:**
+This is not optional - retrieve relevant documentation for every question.
+- Be direct and to the point. Only elaborate when users specifically ask for more detail.
+
+Remember: You're here to help users succeed with Stack Auth. Be helpful but concise, ask questions when needed, always pull relevant docs, and don't hesitate to direct users to support channels when they need additional help.
+`,
+
+  "email-wysiwyg-editor": `
+## Context: Email Template Editor
+
+Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
+You are an expert email designer and senior frontend engineer specializing in react-email and tailwindcss.
+Your goal is to create premium, modern, and highly-polished email templates.
+
+**DESIGN PRINCIPLES:**
+- Clean typography: Use font-sans and appropriate text sizes (text-sm for body, text-2xl/3xl for headings)
+- Balanced spacing: Use generous padding and margins (py-8, gap-4)
+- Modern aesthetics: Use subtle borders, soft shadows (if supported/simulated), and professional color palettes
+- Mobile-first: Ensure designs look great on small screens
+- Clarity: The main call-to-action should be prominent
+
+**TECHNICAL RULES:**
+- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL
+- Always include a <Subject /> component
+- Always include a <NotificationCategory /> component
+- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those)
+- Use only tailwind classes for styling
+- Export 'variablesSchema' using arktype
+- Export 'EmailTemplate' component
+- Define 'EmailTemplate.PreviewVariables' with realistic example data
+`,
+
+  "email-assistant-theme": `
+## Context: Email Theme Creation
+
+You are an expert email designer and senior frontend engineer.
+Your goal is to create premium, modern email themes that provide a consistent look and feel across all emails.
+
+**DESIGN PRINCIPLES:**
+- Professional layout: Use a clear container and appropriate padding
+- Consistent branding: Use professional colors and clean typography
+- Mobile responsiveness: Ensure the theme works well on all devices
+- Accessibility: Use semantic tags and readable font sizes
+
+**TECHNICAL RULES:**
+- Export 'EmailTheme' component
+- Take 'children' as a prop and render it inside the main layout
+- Use <Tailwind> for styling
+- Must not import from any package besides "@react-email/components"
+- Ensure the layout is robust and follows email design best practices
+- Use the createEmailTheme tool to return the complete theme code
+`,
+
+  "email-assistant-draft": `
+## Context: Email Draft Creation
+
+Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
+You are an expert email copywriter and designer.
+Your goal is to create high-converting, professional, and visually appealing email drafts.
+
+**PRINCIPLES:**
+- Compelling copywriting: Use clear, engaging language
+- Premium design: Use modern layouts and balanced spacing
+- Professional tone: Match the project's identity
+- Mobile responsiveness: Ensure drafts look good on all devices
+
+**TECHNICAL RULES:**
+- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailDraft TOOL
+- Always include a <Subject /> component
+- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those)
+- Use only tailwind classes for styling
+- Export 'EmailTemplate' component
+`,
+
+  "create-dashboard": `
+## Context: Dashboard Creation
+
+You are helping users create custom dashboards for their Stack Auth projects.
+
+**Guidelines:**
+- Understand the user's data visualization and analytics needs
+- Design dashboards with relevant metrics and insights
+- Consider the types of charts, tables, and visualizations needed
+- Plan dashboard layout and organization
+- Use the createDashboard tool to return the dashboard configuration
+`,
+
+  "run-query": `
+## Context: Analytics Query Assistant
+
+You are helping users query their Stack Auth project's analytics data using ClickHouse SQL.
+
+**Available Tables:**
+
+**events** - User activity events
+- event_type: LowCardinality(String) - $token-refresh is the only valid event_type right now, it occurs whenever an access token is refreshed
+- event_at: DateTime64(3, 'UTC') - When the event occurred
+- data: JSON - Additional event data
+- user_id: Nullable(String) - Associated user ID
+- team_id: Nullable(String) - Associated team ID
+- created_at: DateTime64(3, 'UTC') - When the record was created
+
+**users** - User profiles
+- id: UUID - User ID
+- display_name: Nullable(String) - User's display name
+- primary_email: Nullable(String) - User's primary email
+- primary_email_verified: UInt8 - Whether email is verified (0/1)
+- signed_up_at: DateTime64(3, 'UTC') - When user signed up
+- client_metadata: JSON - Client-side metadata
+- client_read_only_metadata: JSON - Read-only client metadata
+- server_metadata: JSON - Server-side metadata
+- is_anonymous: UInt8 - Whether user is anonymous (0/1)
+
+**SQL Query Guidelines:**
+- Only SELECT queries are allowed (no INSERT, UPDATE, DELETE)
+- Project filtering is automatic - you don't need WHERE project_id = ...
+- Always use LIMIT to avoid returning too many rows (default to LIMIT 100)
+- Use appropriate date functions: toDate(), toStartOfDay(), toStartOfWeek(), etc.
+- For counting, use COUNT(*) or COUNT(DISTINCT column)
+
+**Example Queries:**
+- Count users: \`SELECT COUNT(*) FROM users\`
+- Recent signups: \`SELECT * FROM users ORDER BY signed_up_at DESC LIMIT 10\`
+- Events today: \`SELECT COUNT(*) FROM events WHERE toDate(event_at) = today()\`
+- Event types: \`SELECT event_type, COUNT(*) as count FROM events GROUP BY event_type ORDER BY count DESC LIMIT 10\`
+
+**Focus:**
+- Help users write efficient, correct ClickHouse SQL queries
+- Explain query results clearly
+- Suggest relevant queries based on user questions
+- Use the queryAnalytics tool to execute queries and return results
+`,
+};
+
+/**
+ * Constructs the full system prompt by combining the base prompt with a context-specific prompt.
+ */
+export function getFullSystemPrompt(promptId: SystemPromptId): string {
+  return `${BASE_PROMPT}\n\n${SYSTEM_PROMPTS[promptId]}`;
+}
diff --git a/apps/backend/src/lib/ai/schema.ts b/apps/backend/src/lib/ai/schema.ts
new file mode 100644
index 0000000000..69c09de022
--- /dev/null
+++ b/apps/backend/src/lib/ai/schema.ts
@@ -0,0 +1,25 @@
+import { yupArray, yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { InferType } from "yup";
+
+export const requestBodySchema = yupObject({
+  quality: yupString().oneOf(["dumb", "smart", "smartest"]).defined(),
+  speed: yupString().oneOf(["slow", "fast"]).defined(),
+  tools: yupArray(yupString().defined()).defined(),
+  systemPrompt: yupString().oneOf([
+    "command-center-ask-ai",
+    "docs-ask-ai",
+    "email-wysiwyg-editor",
+    "email-assistant-theme",
+    "email-assistant-draft",
+    "create-dashboard",
+    "run-query",
+  ]).defined(),
+  messages: yupArray(
+    yupObject({
+      role: yupString().oneOf(["user", "assistant", "tool"]).defined(),
+      content: yupMixed().defined(),
+    }).defined()
+  ).defined().min(1),
+});
+
+export type RequestBody = InferType<typeof requestBodySchema>;
diff --git a/apps/backend/src/lib/ai/tools/create-dashboard.ts b/apps/backend/src/lib/ai/tools/create-dashboard.ts
new file mode 100644
index 0000000000..514af2e3ce
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/create-dashboard.ts
@@ -0,0 +1,83 @@
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { tool } from "ai";
+import { z } from "zod";
+
+/**
+ * Creates a tool for generating dashboard configurations.
+ *
+ * This tool does NOT execute server-side - it returns the tool call to the caller,
+ * who is responsible for processing the dashboard configuration.
+ *
+ * @param auth - Optional auth context (can be used for project-specific dashboards)
+ */
+export function createDashboardTool(auth: SmartRequestAuth | null) {
+  return tool({
+    description: `Create a custom dashboard configuration for Stack Auth project analytics and monitoring.
+
+**What is a Dashboard?**
+A dashboard configuration defines the layout, widgets, and data visualizations for monitoring project metrics, user activity, and analytics.
+
+**Dashboard Components:**
+- **Metrics/KPIs**: Display key numbers (user count, active users, conversion rate, etc.)
+- **Charts**: Visualize trends over time (line charts, bar charts, area charts)
+- **Tables**: Show detailed data (recent users, top events, etc.)
+- **Filters**: Allow date ranges, user segments, event types
+
+**Common Dashboard Types:**
+1. **Overview Dashboard**: High-level metrics and recent activity
+2. **User Analytics**: User growth, retention, engagement
+3. **Event Analytics**: Event tracking, funnels, user journeys
+4. **Performance Dashboard**: API latency, error rates, system health
+
+**Dashboard Structure:**
+- Title and description
+- Layout (grid-based)
+- Widgets (each with type, data source, configuration)
+- Default filters and date ranges
+
+**Guidelines:**
+- Start with the most important metrics
+- Use appropriate visualizations for each data type
+- Keep it focused - avoid information overload
+- Include contextual information and tooltips
+- Make it actionable - link to detailed views
+
+**Example Dashboard Configuration:**
+\`\`\`json
+{
+  "title": "User Growth Dashboard",
+  "description": "Track user acquisition and retention metrics",
+  "layout": "grid",
+  "widgets": [
+    {
+      "type": "metric",
+      "title": "Total Users",
+      "query": "SELECT COUNT(*) FROM users",
+      "format": "number"
+    },
+    {
+      "type": "line-chart",
+      "title": "Daily Signups",
+      "query": "SELECT toDate(signed_up_at) as date, COUNT(*) as signups FROM users WHERE signed_up_at >= today() - 30 GROUP BY date ORDER BY date",
+      "xAxis": "date",
+      "yAxis": "signups"
+    },
+    {
+      "type": "table",
+      "title": "Recent Users",
+      "query": "SELECT display_name, primary_email, signed_up_at FROM users ORDER BY signed_up_at DESC LIMIT 10",
+      "columns": ["display_name", "primary_email", "signed_up_at"]
+    }
+  ],
+  "defaultDateRange": "last_30_days"
+}
+\`\`\`
+
+**Output:**
+Return a complete dashboard configuration as JSON with title, description, widgets, and layout.`,
+    inputSchema: z.object({
+      configuration: z.string().describe("The complete dashboard configuration as JSON"),
+    }),
+    // No execute function - the tool call is returned to the caller
+  });
+}
diff --git a/apps/backend/src/lib/ai/tools/create-email-draft.ts b/apps/backend/src/lib/ai/tools/create-email-draft.ts
new file mode 100644
index 0000000000..e494747f78
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/create-email-draft.ts
@@ -0,0 +1,89 @@
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { tool } from "ai";
+import { z } from "zod";
+
+/**
+ * Creates a tool for generating email draft code.
+ *
+ * Email drafts are simpler than templates - they don't have variable schemas
+ * and are meant for one-off or custom emails.
+ *
+ * This tool does NOT execute server-side - it returns the tool call to the caller.
+ *
+ * @param auth - Optional auth context
+ */
+export function createEmailDraftTool(auth: SmartRequestAuth | null) {
+  return tool({
+    description: `Create a new email draft for Stack Auth.
+
+**What is an Email Draft?**
+An email draft is a simpler version of an email template, without variable schemas. It's used for one-off emails or quick email creation.
+
+**Requirements:**
+- Must use @react-email/components for email components
+- Can import from @stackframe/emails for Stack Auth-specific utilities
+- Must export ONE thing: \`EmailTemplate\` function component
+- Must include Subject and NotificationCategory components
+- Uses Tailwind classes for all styling
+- Can access user and project data via Props
+
+**Differences from Email Templates:**
+- No variablesSchema required
+- No custom variables (only user and project data)
+- No PreviewVariables needed
+- Simpler for one-off or standard emails
+
+**Structure:**
+1. Import required components
+2. Define EmailTemplate function component using Props type
+3. Include Subject (can use user data)
+4. Include NotificationCategory
+5. Add email content using react-email components
+
+**Example Valid Email Draft:**
+\`\`\`tsx
+import { Container, Text, Button } from "@react-email/components";
+import { Subject, NotificationCategory, Props } from "@stackframe/emails";
+
+export function EmailTemplate({ user, project }: Props) {
+  return (
+    <Container>
+      <Subject value={\`Welcome to \${project.displayName}, \${user.displayName}!\`} />
+      <NotificationCategory value="Transactional" />
+      
+      <Text className="text-2xl font-bold">
+        Welcome, {user.displayName}!
+      </Text>
+      
+      <Text>
+        Thank you for joining {project.displayName}. We're excited to have you here.
+      </Text>
+      
+      <Text>
+        Get started by visiting your dashboard and exploring the features.
+      </Text>
+      
+      <Button href="https://example.com/dashboard" className="bg-blue-600 text-white px-4 py-2 rounded">
+        Go to Dashboard
+      </Button>
+    </Container>
+  );
+}
+\`\`\`
+
+**Guidelines:**
+- Keep content clear and focused
+- Use appropriate tone
+- Personalize with user and project data
+- Include clear call-to-actions when needed
+- Make it mobile-responsive
+- Use email-safe styling
+
+**Output:**
+Return the COMPLETE draft code including all imports and component definition.`,
+    inputSchema: z.object({
+      content: z.string().describe("The complete email draft code as a TypeScript React component"),
+    }),
+    // No execute function - the tool call is returned to the caller
+  });
+}
diff --git a/apps/backend/src/lib/ai/tools/create-email-template.ts b/apps/backend/src/lib/ai/tools/create-email-template.ts
new file mode 100644
index 0000000000..1b9436e957
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/create-email-template.ts
@@ -0,0 +1,95 @@
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { tool } from "ai";
+import { z } from "zod";
+
+/**
+ * Creates a tool for generating email template code.
+ *
+ * This tool does NOT execute server-side - it returns the tool call to the caller,
+ * who is responsible for processing the generated template code.
+ *
+ * @param auth - Optional auth context (can be used to fetch current template if needed)
+ */
+export function createEmailTemplateTool(auth: SmartRequestAuth | null) {
+  return tool({
+    description: `Create a new email template for Stack Auth.
+
+**What is an Email Template?**
+An email template is a complete email with content, variables, and metadata. It defines the structure and content of a specific type of email (e.g., welcome email, password reset, notification).
+
+**Requirements:**
+- Must use @react-email/components for email components
+- Can import from @stackframe/emails for Stack Auth-specific utilities
+- Can import from arktype for schema validation
+- Must export TWO things:
+  1. \`variablesSchema\`: An arktype schema defining template variables
+  2. \`EmailTemplate\`: A function component that renders the email
+- EmailTemplate must set PreviewVariables property with sample data
+- Must use Props<typeof variablesSchema.infer> as the component props type
+- Must include Subject and NotificationCategory components
+- Uses Tailwind classes for all styling
+
+**Structure:**
+1. Import required components and types
+2. Define variablesSchema using arktype
+3. Define EmailTemplate function component
+4. Include Subject (dynamic or static)
+5. Include NotificationCategory (e.g., "Transactional", "Marketing")
+6. Add email content using react-email components
+7. Set EmailTemplate.PreviewVariables
+
+**Example Valid Email Template:**
+\`\`\`tsx
+import { type } from "arktype"
+import { Container, Text, Button } from "@react-email/components";
+import { Subject, NotificationCategory, Props } from "@stackframe/emails";
+
+export const variablesSchema = type({
+  actionUrl: "string",
+  expiresInHours: "number"
+});
+
+export function EmailTemplate({ user, variables }: Props<typeof variablesSchema.infer>) {
+  return (
+    <Container>
+      <Subject value={\`Action Required, \${user.displayName}!\`} />
+      <NotificationCategory value="Transactional" />
+      
+      <Text className="text-lg font-bold">
+        Hi {user.displayName}!
+      </Text>
+      
+      <Text>
+        Please complete your action within {variables.expiresInHours} hours.
+      </Text>
+      
+      <Button href={variables.actionUrl} className="bg-blue-600 text-white px-4 py-2 rounded">
+        Take Action
+      </Button>
+    </Container>
+  );
+}
+
+EmailTemplate.PreviewVariables = {
+  actionUrl: "https://example.com/action",
+  expiresInHours: 24
+} satisfies typeof variablesSchema.infer;
+\`\`\`
+
+**Guidelines:**
+- Make content clear, concise, and actionable
+- Use appropriate tone for the email type
+- Include all necessary information
+- Add clear call-to-action buttons when needed
+- Use user data (user.displayName, user.primaryEmail, etc.) to personalize
+- Make it mobile-responsive
+- Use email-safe styling
+
+**Output:**
+Return the COMPLETE template code including all imports, schema, component, and PreviewVariables.`,
+    inputSchema: z.object({
+      content: z.string().describe("The complete email template code as a TypeScript React component with schema"),
+    }),
+    // No execute function - the tool call is returned to the caller
+  });
+}
diff --git a/apps/backend/src/lib/ai/tools/create-email-theme.ts b/apps/backend/src/lib/ai/tools/create-email-theme.ts
new file mode 100644
index 0000000000..7ec2f3b3c7
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/create-email-theme.ts
@@ -0,0 +1,67 @@
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { tool } from "ai";
+import { z } from "zod";
+
+/**
+ * Creates a tool for generating email theme code.
+ *
+ * This tool does NOT execute server-side - it returns the tool call to the caller,
+ * who is responsible for processing the generated theme code.
+ *
+ * @param auth - Optional auth context (can be used to fetch current theme if needed)
+ */
+export function createEmailThemeTool(auth: SmartRequestAuth | null) {
+  return tool({
+    description: `Create a new email theme for Stack Auth emails.
+
+**What is an Email Theme?**
+An email theme is a React component that wraps all email content, providing consistent structure, layout, and styling across all emails.
+
+**Requirements:**
+- Must use @react-email/components (no other imports allowed)
+- Must be exported as a function named "EmailTheme"
+- Must accept one prop: children (React.ReactNode)
+- Must use Tailwind classes inside <Tailwind> tag
+- Must include Html, Head, and appropriate container elements
+- Should be responsive and compatible with major email clients
+
+**Structure:**
+1. Html wrapper
+2. Head (for meta tags)
+3. Tailwind wrapper (for styling)
+4. Container/layout elements
+5. {children} placeholder for email content
+
+**Example Valid Email Theme:**
+\`\`\`tsx
+import { Container, Head, Html, Tailwind } from '@react-email/components'
+
+export function EmailTheme({ children }: { children: React.ReactNode }) {
+  return (
+    <Html>
+      <Head />
+      <Tailwind>
+        <Container className="bg-white p-8 rounded-lg">
+          {children}
+        </Container>
+      </Tailwind>
+    </Html>
+  )
+}
+\`\`\`
+
+**Guidelines:**
+- Keep it simple and focused on layout/structure
+- Use neutral, professional styling that works for various email types
+- Ensure good spacing and readability
+- Make it mobile-responsive
+- Test compatibility with email clients (use email-safe CSS)
+
+**Output:**
+Return the COMPLETE theme code as a TypeScript React component. Include all imports and the full component definition.`,
+    inputSchema: z.object({
+      content: z.string().describe("The complete email theme code as a TypeScript React component"),
+    }),
+    // No execute function - the tool call is returned to the caller
+  });
+}
diff --git a/apps/backend/src/lib/ai/tools/docs.ts b/apps/backend/src/lib/ai/tools/docs.ts
new file mode 100644
index 0000000000..61d305c0a8
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/docs.ts
@@ -0,0 +1,21 @@
+import { createMCPClient } from "@ai-sdk/mcp";
+import { getNodeEnvironment } from "@stackframe/stack-shared/dist/utils/env";
+
+/**
+ * Creates an MCP client connected to the Stack Auth documentation server.
+ *
+ * In development: connects to local docs server at http://localhost:8104
+ * In production: connects to production docs server at https://mcp.stack-auth.com
+ */
+export async function createDocsTools() {
+  const mcpUrl =
+    getNodeEnvironment() === "development"
+      ? new URL("/api/internal/mcp", "http://localhost:8104")
+      : new URL("/api/internal/mcp", "https://mcp.stack-auth.com");
+
+  const stackAuthMcp = await createMCPClient({
+    transport: { type: "http", url: mcpUrl.toString() },
+  });
+
+  return await stackAuthMcp.tools();
+}
diff --git a/apps/backend/src/lib/ai/tools/index.ts b/apps/backend/src/lib/ai/tools/index.ts
new file mode 100644
index 0000000000..40b1da5a13
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/index.ts
@@ -0,0 +1,101 @@
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { ToolSet } from "ai";
+import { createDashboardTool } from "./create-dashboard";
+import { createEmailDraftTool } from "./create-email-draft";
+import { createEmailTemplateTool } from "./create-email-template";
+import { createEmailThemeTool } from "./create-email-theme";
+import { createDocsTools } from "./docs";
+import { createSqlQueryTool } from "./sql-query";
+
+export type ToolName =
+  | "docs"
+  | "sql-query"
+  | "create-email-theme"
+  | "create-email-template"
+  | "create-email-draft"
+  | "create-dashboard";
+
+export type ToolContext = {
+  auth: SmartRequestAuth | null,
+};
+
+export async function getTools(
+  toolNames: ToolName[],
+  context: ToolContext
+): Promise<ToolSet> {
+  const tools: ToolSet = {};
+
+  for (const toolName of toolNames) {
+    switch (toolName) {
+      case "docs": {
+        // Docs tools come from MCP server - returns multiple tools
+        try {
+          const docsTools = await createDocsTools();
+          Object.assign(tools, docsTools);
+        } catch (error) {
+          console.error("Failed to load docs tools:", error);
+          // Continue without docs tools rather than failing completely
+        }
+        break;
+      }
+
+      case "sql-query": {
+        const sqlTool = createSqlQueryTool(context.auth);
+        if (sqlTool != null) {
+          tools["queryAnalytics"] = sqlTool;
+        }
+        // If null (no auth), skip this tool silently
+        break;
+      }
+
+      case "create-email-theme": {
+        tools["createEmailTheme"] = createEmailThemeTool(context.auth);
+        break;
+      }
+
+      case "create-email-template": {
+        tools["createEmailTemplate"] = createEmailTemplateTool(context.auth);
+        break;
+      }
+
+      case "create-email-draft": {
+        tools["createEmailDraft"] = createEmailDraftTool(context.auth);
+        break;
+      }
+
+      case "create-dashboard": {
+        tools["createDashboard"] = createDashboardTool(context.auth);
+        break;
+      }
+
+      default: {
+        // TypeScript will ensure this is unreachable if we handle all cases
+        const _exhaustive: never = toolName;
+        console.warn(`Unknown tool name: ${_exhaustive}`);
+      }
+    }
+  }
+
+  return tools;
+}
+
+/**
+ * Validates that all requested tool names are valid.
+ * Throws an error if any tool name is invalid.
+ */
+export function validateToolNames(toolNames: unknown): toolNames is ToolName[] {
+  if (!Array.isArray(toolNames)) {
+    return false;
+  }
+
+  const validToolNames: ToolName[] = [
+    "docs",
+    "sql-query",
+    "create-email-theme",
+    "create-email-template",
+    "create-email-draft",
+    "create-dashboard",
+  ];
+
+  return toolNames.every((name) => validToolNames.includes(name as ToolName));
+}
diff --git a/apps/backend/src/lib/ai/tools/sql-query.ts b/apps/backend/src/lib/ai/tools/sql-query.ts
new file mode 100644
index 0000000000..8a17f97648
--- /dev/null
+++ b/apps/backend/src/lib/ai/tools/sql-query.ts
@@ -0,0 +1,87 @@
+import { getClickhouseExternalClient } from "@/lib/clickhouse";
+import { SmartRequestAuth } from "@/route-handlers/smart-request";
+import { tool } from "ai";
+import { z } from "zod";
+
+export function createSqlQueryTool(auth: SmartRequestAuth | null) {
+  if (auth == null) {
+    // Return null or throw - analytics queries require authentication
+    return null;
+  }
+
+  return tool({
+    description: `Run a ClickHouse SQL query against the project's analytics database.
+
+**CRITICAL**: Only SELECT queries are allowed. Project filtering is automatic - do not add WHERE project_id = ... clauses.
+
+**Available Tables:**
+
+**events** - User activity events
+- event_type: LowCardinality(String) - $token-refresh is the only valid event_type right now, it occurs whenever an access token is refreshed
+- event_at: DateTime64(3, 'UTC') - When the event occurred
+- data: JSON - Additional event data
+- user_id: Nullable(String) - Associated user ID
+- team_id: Nullable(String) - Associated team ID
+- created_at: DateTime64(3, 'UTC') - When the record was created
+
+**users** - User profiles
+- id: UUID - User ID
+- display_name: Nullable(String) - User's display name
+- primary_email: Nullable(String) - User's primary email
+- primary_email_verified: UInt8 - Whether email is verified (0/1)
+- signed_up_at: DateTime64(3, 'UTC') - When user signed up
+- client_metadata: JSON - Client-side metadata
+- client_read_only_metadata: JSON - Read-only client metadata
+- server_metadata: JSON - Server-side metadata
+- is_anonymous: UInt8 - Whether user is anonymous (0/1)
+
+**Query Guidelines:**
+- Always include LIMIT clause (default to LIMIT 100)
+- Use appropriate date functions: toDate(), toStartOfDay(), toStartOfWeek(), etc.
+- For counting: COUNT(*) or COUNT(DISTINCT column)
+- Only SELECT queries allowed - no DDL/DML
+
+**Example Queries:**
+- Count users: SELECT COUNT(*) FROM users
+- Recent signups: SELECT * FROM users ORDER BY signed_up_at DESC LIMIT 10
+- Events today: SELECT COUNT(*) FROM events WHERE toDate(event_at) = today()
+- Event types: SELECT event_type, COUNT(*) as count FROM events GROUP BY event_type ORDER BY count DESC LIMIT 10`,
+    inputSchema: z.object({
+      query: z
+        .string()
+        .describe("The ClickHouse SQL query to execute. Only SELECT queries are allowed. Always include LIMIT clause."),
+    }),
+    execute: async ({ query }: { query: string }) => {
+      try {
+        const client = getClickhouseExternalClient();
+        const resultSet = await client.query({
+          query,
+          clickhouse_settings: {
+            SQL_project_id: auth.tenancy.project.id,
+            SQL_branch_id: auth.tenancy.branchId,
+            max_execution_time: 5, // 5 seconds timeout
+            readonly: "1",
+            allow_ddl: 0,
+            max_result_rows: "10000",
+            max_result_bytes: (10 * 1024 * 1024).toString(), // 10MB
+            result_overflow_mode: "throw",
+          },
+          format: "JSONEachRow",
+        });
+
+        const rows = await resultSet.json<Record<string, unknown>[]>();
+
+        return {
+          success: true,
+          rowCount: rows.length,
+          result: rows,
+        };
+      } catch (error) {
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : "Query failed",
+        };
+      }
+    },
+  });
+}
diff --git a/apps/backend/src/route-handlers/smart-response.tsx b/apps/backend/src/route-handlers/smart-response.tsx
index 161e3ef913..ee8e912cac 100644
--- a/apps/backend/src/route-handlers/smart-response.tsx
+++ b/apps/backend/src/route-handlers/smart-response.tsx
@@ -36,6 +36,10 @@ export type SmartResponse = {
     bodyType: "success",
     body?: undefined,
   }
+  | {
+    bodyType: "response",
+    body: Response,
+  }
 );
 
 export async function validateSmartResponse<T>(req: NextRequest | null, smartReq: SmartRequest, obj: unknown, schema: yup.Schema<T>): Promise<T> {
@@ -60,6 +64,10 @@ function isBinaryBody(body: unknown): body is BodyInit {
     || ArrayBuffer.isView(body);
 }
 
+function isResponseBody(body: unknown): body is Response {
+  return typeof body === "object" && body !== null && body instanceof Response;
+}
+
 export async function createResponse<T extends SmartResponse>(req: NextRequest | null, requestId: string, obj: T): Promise<Response> {
   return await traceSpan("creating HTTP response from smart response", async () => {
     let status = obj.statusCode;
@@ -70,7 +78,13 @@ export async function createResponse<T extends SmartResponse>(req: NextRequest |
     // if we have something that resembles a browser, prettify JSON outputs
     const jsonIndent = req?.headers.get("Accept")?.includes("text/html") ? 2 : undefined;
 
-    const bodyType = obj.bodyType ?? (obj.body === undefined ? "empty" : isBinaryBody(obj.body) ? "binary" : "json");
+    const bodyType = obj.bodyType ?? (
+      obj.body === undefined ? "empty" :
+      isResponseBody(obj.body) ? "response" :
+      isBinaryBody(obj.body) ? "binary" :
+        "json"
+    );
+
     switch (bodyType) {
       case "empty": {
         arrayBufferBody = new ArrayBuffer(0);
@@ -95,6 +109,16 @@ export async function createResponse<T extends SmartResponse>(req: NextRequest |
         arrayBufferBody = obj.body;
         break;
       }
+      case "response": {
+        if (!isResponseBody(obj.body)) {
+          throw new Error(`Invalid body, expected Response, got ${obj.body}`);
+        }
+        for (const [key, value] of obj.body.headers.entries()) {
+          headers.set(key.toLowerCase(), [value]);
+        }
+        arrayBufferBody = obj.body.body;
+        break;
+      }
       case "success": {
         headers.set("content-type", ["application/json; charset=utf-8"]);
         arrayBufferBody = new TextEncoder().encode(JSON.stringify({
diff --git a/apps/backend/src/route-handlers/smart-route-handler.tsx b/apps/backend/src/route-handlers/smart-route-handler.tsx
index 1fbd600746..dfd9d21863 100644
--- a/apps/backend/src/route-handlers/smart-route-handler.tsx
+++ b/apps/backend/src/route-handlers/smart-route-handler.tsx
@@ -106,6 +106,8 @@ export function handleApiRequest(handler: (req: NextRequest, options: any, reque
           const allowedLongRequestPaths = [
             "/api/latest/internal/email-queue-step",
             "/api/latest/internal/analytics/query",
+            "/api/latest/ai/query/stream",
+            "/api/latest/ai/query/generate",
             "/health/email",
             "/api/latest/internal/metrics",
             "/api/latest/internal/external-db-sync/poller",
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/ai-model-config.ts b/apps/e2e/tests/backend/endpoints/api/v1/ai-model-config.ts
new file mode 100644
index 0000000000..d9b055074c
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/ai-model-config.ts
@@ -0,0 +1,52 @@
+/**
+ * Duplicated from apps/backend/src/lib/ai/models.ts for E2E tests. TODO: think about this (its duplicated for now)
+ * E2E app cannot import from backend internals. Keep in sync with models.ts.
+ */
+type ModelQuality = "dumb" | "smart" | "smartest";
+type ModelSpeed = "slow" | "fast";
+
+type ModelConfig = {
+  modelId: string,
+  thinking?: boolean,
+  extendedOutput?: boolean,
+};
+
+const MODEL_SELECTION_MATRIX: Record<
+  ModelQuality,
+  Record<ModelSpeed, { authenticated: ModelConfig, unauthenticated: ModelConfig }>
+> = {
+  dumb: {
+    slow: {
+      authenticated: { modelId: "z-ai/glm-4.5-air:free" },
+      unauthenticated: { modelId: "z-ai/glm-4.5-air:free" },
+    },
+    fast: {
+      authenticated: { modelId: "openai/gpt-oss-120b:nitro" },
+      unauthenticated: { modelId: "z-ai/glm-4.5-air:free" },
+    },
+  },
+  smart: {
+    slow: {
+      authenticated: { modelId: "x-ai/grok-4.1-fast" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+    fast: {
+      authenticated: { modelId: "x-ai/grok-4.1-fast" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+  },
+  smartest: {
+    slow: {
+      authenticated: {
+        modelId: "anthropic/claude-opus-4.6",
+        thinking: true,
+        extendedOutput: true,
+      },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+    fast: {
+      authenticated: { modelId: "anthropic/claude-opus-4.6" },
+      unauthenticated: { modelId: "x-ai/grok-4.1-fast" },
+    },
+  },
+};
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
new file mode 100644
index 0000000000..975640de95
--- /dev/null
+++ b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
@@ -0,0 +1,593 @@
+import { describe } from "vitest";
+import { it } from "../../../../helpers";
+import { niceBackendFetch, Project } from "../../../backend-helpers";
+// Note: Since tests run with FORWARD_TO_PRODUCTION, actual AI responses won't be tested.
+// These tests focus on request validation, structure, and error handling.
+
+describe("AI Query Endpoint - Validation", () => {
+  it("rejects invalid mode in URL", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/invalid-mode", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toEqual(expect.stringContaining("Invalid mode"));
+  });
+
+  it("rejects missing quality field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("quality") });
+  });
+
+  it("rejects invalid quality value", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "invalid-quality",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("quality") });
+  });
+
+  it("rejects missing speed field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("speed") });
+  });
+
+  it("rejects invalid speed value", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "invalid-speed",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("speed") });
+  });
+
+  it("rejects missing tools field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("tools") });
+  });
+
+  it("rejects invalid tool names", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: ["invalid-tool", "another-invalid-tool"],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toEqual(expect.stringContaining("Invalid tool names"));
+  });
+
+  it("rejects missing systemPrompt field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("systemPrompt") });
+  });
+
+  it("rejects invalid systemPrompt value", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "invalid-prompt",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("systemPrompt") });
+  });
+
+  it("rejects missing messages field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("messages") });
+  });
+
+  it("rejects empty messages array", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("messages") });
+  });
+
+  it("accepts valid request body with all required fields", async ({ expect }) => {
+    // This will forward to production, so we just verify it doesn't fail validation
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    expect(response.status).not.toBe(400);
+
+  }, 10000); // 60 seconds for AI API call
+});
+
+describe("AI Query Endpoint - Authentication", () => {
+  it("accepts authenticated requests with admin access", async ({ expect }) => {
+    await Project.createAndSwitch();
+
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    // Should not fail due to auth (will forward to production)
+    expect(response.status).not.toBe(401);
+    expect(response.status).not.toBe(403);
+  }, 10000); // 60 seconds for AI API call
+
+  it("accepts unauthenticated requests", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: null,
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "docs-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    // Should not fail due to missing auth
+    expect(response.status).not.toBe(401);
+    expect(response.status).not.toBe(403);
+  }, 10000); // 60 seconds for AI API call
+});
+
+describe("AI Query Endpoint - System Prompts", () => {
+  const systemPrompts = [
+    "command-center-ask-ai",
+    "docs-ask-ai",
+    "email-wysiwyg-editor",
+    "email-assistant-theme",
+    "email-assistant-draft",
+    "create-dashboard",
+    "run-query",
+  ];
+
+  for (const systemPrompt of systemPrompts) {
+    it(`accepts systemPrompt: ${systemPrompt}`, async ({ expect }) => {
+      const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+        method: "POST",
+        accessType: "admin",
+        body: {
+          quality: "dumb",
+          speed: "fast",
+          tools: [],
+          systemPrompt,
+          messages: [{ role: "user", content: "test" }],
+        },
+      });
+
+      // Should not be a validation error
+      expect(response.status).not.toBe(400);
+    }, 10000); // 60 seconds for AI API call
+  }
+});
+
+describe("AI Query Endpoint - Tools", () => {
+  const validTools = [
+    "docs",
+    "sql-query",
+    "create-email-theme",
+    "create-email-template",
+    "create-email-draft",
+    "create-dashboard",
+  ];
+
+  for (const tool of validTools) {
+    it(`accepts tool: ${tool}`, async ({ expect }) => {
+      const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+        method: "POST",
+        accessType: "admin",
+        body: {
+          quality: "dumb",
+          speed: "fast",
+          tools: [tool],
+          systemPrompt: "command-center-ask-ai",
+          messages: [{ role: "user", content: "test" }],
+        },
+      });
+
+      // Should not be a validation error
+      expect(response.status).not.toBe(400);
+    }, 10000); // 60 seconds for AI API call
+  }
+
+  it("accepts multiple tools in single request", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: ["docs", "create-email-theme", "create-dashboard"],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    // Should not be a validation error
+    expect(response.status).not.toBe(400);
+  }, 10000); // 60 seconds for AI API call
+});
+
+describe("AI Query Endpoint - Mode Handling", () => {
+  it("stream mode returns response (forwarded to production)", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/stream", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    // With forwarding, we should get a response from production
+    // We can't test the actual streaming format, but we can verify no validation errors
+    expect(response.status).not.toBe(400);
+  }, 10000); // 60 seconds for AI API call
+
+  it("generate mode returns JSON response (forwarded to production)", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "test" }],
+      },
+    });
+
+    // With forwarding, we should get a JSON response from production
+    expect(response.status).not.toBe(400);
+    // Body structure will depend on production response
+  }, 10000); // 60 seconds for AI API call
+});
+
+describe("AI Query Endpoint - Quality and Speed Combinations", () => {
+  const qualities = ["dumb", "smart", "smartest"];
+  const speeds = ["slow", "fast"];
+
+  for (const quality of qualities) {
+    for (const speed of speeds) {
+      it(`accepts quality=${quality}, speed=${speed}`, async ({ expect }) => {
+        const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+          method: "POST",
+          accessType: "admin",
+          body: {
+            quality,
+            speed,
+            tools: [],
+            systemPrompt: "command-center-ask-ai",
+            messages: [{ role: "user", content: "test" }],
+          },
+        });
+
+        // Should not be a validation error
+        expect(response.status).not.toBe(400);
+      }, 10000); // 60 seconds for AI API call
+    }
+  }
+});
+
+describe("AI Query Endpoint - Response Structure", () => {
+  it("generate mode returns body with content array", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "Say hello" }],
+      },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body).toMatchObject({ content: expect.any(Array) });
+  }, 10000);
+
+  it("stream mode returns text/event-stream content type", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/stream", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "Say hello" }],
+      },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toContain("text/event-stream");
+  }, 10000);
+});
+
+describe("AI Query Endpoint - Message Formats", () => {
+  it("accepts multi-turn conversation (user → assistant → user)", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [
+          { role: "user", content: "What is Stack Auth?" },
+          { role: "assistant", content: "Stack Auth is an authentication platform." },
+          { role: "user", content: "How do I get started?" },
+        ],
+      },
+    });
+
+    expect(response.status).not.toBe(400);
+  }, 10000);
+
+  it("accepts messages with rich array content (content as array of parts)", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [
+          {
+            role: "user",
+            content: [{ type: "text", text: "Hello, how can you help me?" }],
+          },
+        ],
+      },
+    });
+
+    expect(response.status).not.toBe(400);
+  }, 10000);
+});
+
+describe("AI Query Endpoint - Invalid Message Structure", () => {
+  it("rejects invalid message role", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        // "system" is not in the allowed oneOf(["user", "assistant", "tool"])
+        messages: [{ role: "system", content: "You are a bot" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("role") });
+  });
+
+  it("rejects message without content field", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user" }],
+      },
+    });
+
+    expect(response.status).toBe(400);
+    expect(response.body).toMatchObject({ code: "SCHEMA_ERROR", error: expect.stringContaining("content") });
+  });
+});
+
+describe("AI Query Endpoint - Tool Behavior", () => {
+  it("sql-query tool is gracefully omitted when unauthenticated (no error)", async ({ expect }) => {
+    // Without auth, createSqlQueryTool returns null and the tool is silently skipped
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: null,
+      body: {
+        quality: "dumb",
+        speed: "fast",
+        tools: ["sql-query"],
+        systemPrompt: "docs-ask-ai",
+        messages: [{ role: "user", content: "Show me some analytics data" }],
+      },
+    });
+
+    // Tool is silently skipped — request should still succeed
+    expect(response.status).not.toBe(400);
+  }, 10000);
+
+  it("client-side tools (create-email-theme) produce tool-call blocks in generate response", async ({ expect }) => {
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smart",
+        speed: "fast",
+        tools: ["create-email-theme"],
+        systemPrompt: "email-assistant-theme",
+        messages: [
+          {
+            role: "user",
+            content: "Create an email theme with primary color #ff0000 and a dark background",
+          },
+        ],
+      },
+    });
+
+    expect(response.status).toBe(200);
+    // Response must always have a content array (text or tool-call blocks)
+    expect(response.body).toMatchObject({ content: expect.any(Array) });
+    // When the AI calls createEmailTheme, a tool-call block should appear
+    const content = (response.body as any).content as Array<{ type: string }>;
+    const hasToolCallOrText = content.every((block) => block.type === "text" || block.type === "tool-call");
+    expect(hasToolCallOrText).toBe(true);
+  }, 10000);
+});
+
+describe("AI Query Endpoint - Auth Edge Cases", () => {
+  it("smartest quality without auth falls back to cheaper model and succeeds", async ({ expect }) => {
+    // Unauthenticated + smartest → falls back to x-ai/grok-4.1-fast per model matrix
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: null,
+      body: {
+        quality: "smartest",
+        speed: "fast",
+        tools: [],
+        systemPrompt: "docs-ask-ai",
+        messages: [{ role: "user", content: "Hello" }],
+      },
+    });
+
+    expect(response.status).not.toBe(401);
+    expect(response.status).not.toBe(403);
+    expect(response.status).not.toBe(400);
+  }, 10000);
+
+  it("authenticated requests can use premium models (smartest quality)", async ({ expect }) => {
+    await Project.createAndSwitch();
+
+    const response = await niceBackendFetch("/api/v1/ai/query/generate", {
+      method: "POST",
+      accessType: "admin",
+      body: {
+        quality: "smartest",
+        speed: "slow",
+        tools: [],
+        systemPrompt: "command-center-ask-ai",
+        messages: [{ role: "user", content: "Hello" }],
+      },
+    });
+
+    expect(response.status).not.toBe(401);
+    expect(response.status).not.toBe(403);
+    expect(response.status).not.toBe(400);
+  }, 10000);
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0984f7da97..333e1d9372 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -111,9 +111,12 @@ importers:
 
   apps/backend:
     dependencies:
+      '@ai-sdk/mcp':
+        specifier: ^1.0.21
+        version: 1.0.21(zod@3.25.76)
       '@ai-sdk/openai':
-        specifier: ^1.3.23
-        version: 1.3.23(zod@3.25.76)
+        specifier: ^3.0.29
+        version: 3.0.29(zod@3.25.76)
       '@aws-sdk/client-s3':
         specifier: ^3.855.0
         version: 3.864.0
@@ -123,6 +126,9 @@ importers:
       '@node-oauth/oauth2-server':
         specifier: ^5.1.0
         version: 5.1.0
+      '@openrouter/ai-sdk-provider':
+        specifier: 2.2.3
+        version: 2.2.3(ai@6.0.81(zod@3.25.76))(zod@3.25.76)
       '@opentelemetry/api':
         specifier: ^1.9.0
         version: 1.9.0
@@ -205,8 +211,8 @@ importers:
         specifier: ^1.2.0
         version: 1.2.0
       ai:
-        specifier: ^4.3.17
-        version: 4.3.17(react@19.2.3)(zod@3.25.76)
+        specifier: ^6.0.0
+        version: 6.0.81(zod@3.25.76)
       bcrypt:
         specifier: ^5.1.1
         version: 5.1.1(encoding@0.1.13)
@@ -340,9 +346,6 @@ importers:
 
   apps/dashboard:
     dependencies:
-      '@ai-sdk/openai':
-        specifier: ^3.0.25
-        version: 3.0.27(zod@4.1.12)
       '@ai-sdk/react':
         specifier: ^3.0.72
         version: 3.0.83(react@19.2.3)(zod@4.1.12)
@@ -1410,10 +1413,10 @@ importers:
         version: link:../../packages/stack
       '@supabase/ssr':
         specifier: latest
-        version: 0.8.0(@supabase/supabase-js@2.93.1)
+        version: 0.8.0(@supabase/supabase-js@2.95.3)
       '@supabase/supabase-js':
         specifier: latest
-        version: 2.93.1
+        version: 2.95.3
       jose:
         specifier: ^5.2.2
         version: 5.6.3
@@ -2270,14 +2273,14 @@ packages:
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/openai@1.3.23':
-    resolution: {integrity: sha512-86U7rFp8yacUAOE/Jz8WbGcwMCqWvjK33wk5DXkfnAOEn3mx2r7tNSJdjukQFZbAK97VMXGPPHxF+aEARDXRXQ==}
+  '@ai-sdk/mcp@1.0.21':
+    resolution: {integrity: sha512-dRX2X6GDadZNpiylNnw0HP7zJC8ggVOOJV/JtxuF6CgtP8CKnc7a/wEzpUw1m/4AGdD3mTDhKnKFwC4y10a8FQ==}
     engines: {node: '>=18'}
     peerDependencies:
-      zod: ^3.0.0
+      zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/openai@3.0.27':
-    resolution: {integrity: sha512-pLMxWOypwroXiK9dxNpn60/HGhWWWDEOJ3lo9vZLoxvpJNtKnLKojwVIvlW3yEjlD7ll1+jUO2uzsABNTaP5Yg==}
+  '@ai-sdk/openai@3.0.29':
+    resolution: {integrity: sha512-ugVTIVpuSLKTjzSPe1F1DWiblJT/lwrrHx0OZEKjpMk/EYP6j6VD/F7SJqM1dsqOJryeBCJWFbUzLNqc99PrMA==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
@@ -2294,6 +2297,12 @@ packages:
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
+  '@ai-sdk/provider-utils@4.0.15':
+    resolution: {integrity: sha512-8XiKWbemmCbvNN0CLR9u3PQiet4gtEVIrX4zzLxnCj06AwsEDJwJVBbKrEI4t6qE8XRSIvU2irka0dcpziKW6w==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
   '@ai-sdk/provider@1.1.3':
     resolution: {integrity: sha512-qZMxYJ0qqX/RfnuIaab+zp8UAeJn/ygXXAffR5I4N0n1IrvA6qBsjc8hXLmBiMV2zoXlifkacF7sEFnYnjBcqg==}
     engines: {node: '>=18'}
@@ -2354,6 +2363,7 @@ packages:
 
   '@assistant-ui/react-edge@0.2.12':
     resolution: {integrity: sha512-95Y912lW8ASMT52qZd6ZHRiF+T7WxbeJ1yb2z/I0lCKegPt0q3spGy92YnO7mwz0uJaNjqu4/oZZybYfeIDzJg==}
+    deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
     peerDependencies:
       '@assistant-ui/react': '*'
       '@types/react': ^18.2.0
@@ -4909,6 +4919,13 @@ packages:
       ai: ^4.3.17
       zod: ^3.25.34
 
+  '@openrouter/ai-sdk-provider@2.2.3':
+    resolution: {integrity: sha512-NovC+BaCfEeJwhToDrs8JeDYXXlJdEyz7lcxkjtyePSE4eoAKik872SyDK0MzXKcz8MRkv7XlNhPI6zz4TQp0g==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      ai: ^6.0.0
+      zod: ^3.25.0 || ^4.0.0
+
   '@opentelemetry/api-logs@0.203.0':
     resolution: {integrity: sha512-9B9RU0H7Ya1Dx/Rkyc4stuBZSGVQF27WigitInx2QQoj6KUpEFYPKoWjdFTunJYxmXmh17HeBvbMa1EhGyPmqQ==}
     engines: {node: '>=8.0.0'}
@@ -7813,6 +7830,7 @@ packages:
 
   '@simplewebauthn/types@11.0.0':
     resolution: {integrity: sha512-b2o0wC5u2rWts31dTgBkAtSNKGX0cvL6h8QedNsKmj8O4QoLFQFR3DBVBUlpyVEhYKA+mXGUaXbcOc4JdQ3HzA==}
+    deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
 
   '@sinclair/typebox@0.27.8':
     resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==}
@@ -8066,20 +8084,20 @@ packages:
     resolution: {integrity: sha512-SXuhqhuR5FXaYgKTXzZJeqtVA6JKb9IZWaGeEUxHHiOcFy2p51wccO72bYpXwoK4D5pzQOIYLTuAc7etxyMmwg==}
     engines: {node: '>=12.16'}
 
-  '@supabase/auth-js@2.93.1':
-    resolution: {integrity: sha512-pC0Ek4xk4z6q7A/3+UuZ/eYgfFUUQTg3DhapzrAgJnFGDJDFDyGCj6v9nIz8+3jfLqSZ3QKGe6AoEodYjShghg==}
+  '@supabase/auth-js@2.95.3':
+    resolution: {integrity: sha512-vD2YoS8E2iKIX0F7EwXTmqhUpaNsmbU6X2R0/NdFcs02oEfnHyNP/3M716f3wVJ2E5XHGiTFXki6lRckhJ0Thg==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/functions-js@2.93.1':
-    resolution: {integrity: sha512-Ott2IcIXHGupaC0nX9WNEiJAX4OdlGRu9upkkURaQHbaLdz9JuCcHxlwTERgtgjMpikbIWHfMM1M9QTQFYABiA==}
+  '@supabase/functions-js@2.95.3':
+    resolution: {integrity: sha512-uTuOAKzs9R/IovW1krO0ZbUHSJnsnyJElTXIRhjJTqymIVGcHzkAYnBCJqd7468Fs/Foz1BQ7Dv6DCl05lr7ig==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/postgrest-js@2.93.1':
-    resolution: {integrity: sha512-uRKKQJBDnfi6XFNFPNMh9+u3HT2PCgp065PcMPmG7e0xGuqvLtN89QxO2/SZcGbw2y1+mNBz0yUs5KmyNqF2fA==}
+  '@supabase/postgrest-js@2.95.3':
+    resolution: {integrity: sha512-LTrRBqU1gOovxRm1vRXPItSMPBmEFqrfTqdPTRtzOILV4jPSueFz6pES5hpb4LRlkFwCPRmv3nQJ5N625V2Xrg==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/realtime-js@2.93.1':
-    resolution: {integrity: sha512-2WaP/KVHPlQDjWM6qe4wOZz6zSRGaXw1lfXf4thbfvk3C3zPPKqXRyspyYnk3IhphyxSsJ2hQ/cXNOz48008tg==}
+  '@supabase/realtime-js@2.95.3':
+    resolution: {integrity: sha512-D7EAtfU3w6BEUxDACjowWNJo/ZRo7sDIuhuOGKHIm9FHieGeoJV5R6GKTLtga/5l/6fDr2u+WcW/m8I9SYmaIw==}
     engines: {node: '>=20.0.0'}
 
   '@supabase/ssr@0.8.0':
@@ -8087,12 +8105,12 @@ packages:
     peerDependencies:
       '@supabase/supabase-js': ^2.76.1
 
-  '@supabase/storage-js@2.93.1':
-    resolution: {integrity: sha512-3KVwd4S1i1BVPL6KIywe5rnruNQXSkLyvrdiJmwnqwbCcDujQumARdGWBPesqCjOPKEU2M9ORWKAsn+2iLzquA==}
+  '@supabase/storage-js@2.95.3':
+    resolution: {integrity: sha512-4GxkJiXI3HHWjxpC3sDx1BVrV87O0hfX+wvJdqGv67KeCu+g44SPnII8y0LL/Wr677jB7tpjAxKdtVWf+xhc9A==}
     engines: {node: '>=20.0.0'}
 
-  '@supabase/supabase-js@2.93.1':
-    resolution: {integrity: sha512-FJTgS5s0xEgRQ3u7gMuzGObwf3jA4O5Ki/DgCDXx94w1pihLM4/WG3XFa4BaCJYfuzLxLcv6zPPA5tDvBUjAUg==}
+  '@supabase/supabase-js@2.95.3':
+    resolution: {integrity: sha512-Fukw1cUTQ6xdLiHDJhKKPu6svEPaCEDvThqCne3OaQyZvuq2qjhJAd91kJu3PXLG18aooCgYBaB6qQz35hhABg==}
     engines: {node: '>=20.0.0'}
 
   '@swc/core-darwin-arm64@1.3.101':
@@ -11457,20 +11475,24 @@ packages:
   glob@10.3.10:
     resolution: {integrity: sha512-fa46+tv1Ak0UPK1TOy/pZrIybNNt4HCv7SDzwyfiOZkvZLEbjsZkJBPtDHVshZjbecAoAGSC20MjLDG/qr679g==}
     engines: {node: '>=16 || 14 >=14.17'}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   glob@10.4.1:
     resolution: {integrity: sha512-2jelhlq3E4ho74ZyVLN03oKdAZVUa6UDZzFLVH1H7dnoax+y9qyaq8zBkfDIggjniU19z0wU18y16jMB2eyVIw==}
     engines: {node: '>=16 || 14 >=14.18'}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   glob@10.4.5:
     resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   glob@11.0.1:
     resolution: {integrity: sha512-zrQDm8XPnYEKawJScsnM0QzobJxlT/kHOOlRTio8IH/GrmxRE5fjllkzdaHclIuNjUQTJYH2xHNIGfdpJkDJUw==}
     engines: {node: 20 || >=22}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
     hasBin: true
 
   glob@13.0.0:
@@ -11479,11 +11501,12 @@ packages:
 
   glob@7.2.3:
     resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Glob versions prior to v9 are no longer supported
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
   glob@9.3.5:
     resolution: {integrity: sha512-e1LleDykUz2Iu+MTYdkSsuWX8lvAjAcs0Xef0lNIu0S2wOAzuTxCJtcd9S3cijlwYF18EsU3rzb8jPVobxDh9Q==}
     engines: {node: '>=16 || 14 >=14.17'}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
 
   globals@11.12.0:
     resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
@@ -12267,6 +12290,7 @@ packages:
   keygrip@1.1.0:
     resolution: {integrity: sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==}
     engines: {node: '>= 0.6'}
+    deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
 
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
@@ -16064,17 +16088,18 @@ snapshots:
       '@vercel/oidc': 3.1.0
       zod: 4.1.12
 
-  '@ai-sdk/openai@1.3.23(zod@3.25.76)':
+  '@ai-sdk/mcp@1.0.21(zod@3.25.76)':
     dependencies:
-      '@ai-sdk/provider': 1.1.3
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
+      '@ai-sdk/provider': 3.0.8
+      '@ai-sdk/provider-utils': 4.0.15(zod@3.25.76)
+      pkce-challenge: 5.0.0
       zod: 3.25.76
 
-  '@ai-sdk/openai@3.0.27(zod@4.1.12)':
+  '@ai-sdk/openai@3.0.29(zod@3.25.76)':
     dependencies:
       '@ai-sdk/provider': 3.0.8
-      '@ai-sdk/provider-utils': 4.0.14(zod@4.1.12)
-      zod: 4.1.12
+      '@ai-sdk/provider-utils': 4.0.15(zod@3.25.76)
+      zod: 3.25.76
 
   '@ai-sdk/provider-utils@2.2.8(zod@3.25.76)':
     dependencies:
@@ -16097,6 +16122,13 @@ snapshots:
       eventsource-parser: 3.0.6
       zod: 4.1.12
 
+  '@ai-sdk/provider-utils@4.0.15(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.8
+      '@standard-schema/spec': 1.1.0
+      eventsource-parser: 3.0.6
+      zod: 3.25.76
+
   '@ai-sdk/provider@1.1.3':
     dependencies:
       json-schema: 0.4.0
@@ -16115,16 +16147,6 @@ snapshots:
     optionalDependencies:
       zod: 3.25.76
 
-  '@ai-sdk/react@1.2.12(react@19.2.3)(zod@3.25.76)':
-    dependencies:
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      '@ai-sdk/ui-utils': 1.2.11(zod@3.25.76)
-      react: 19.2.3
-      swr: 2.3.4(react@19.2.3)
-      throttleit: 2.1.0
-    optionalDependencies:
-      zod: 3.25.76
-
   '@ai-sdk/react@3.0.83(react@19.2.3)(zod@3.25.76)':
     dependencies:
       '@ai-sdk/provider-utils': 4.0.14(zod@3.25.76)
@@ -18942,6 +18964,11 @@ snapshots:
       ai: 4.3.17(react@18.3.1)(zod@3.25.76)
       zod: 3.25.76
 
+  '@openrouter/ai-sdk-provider@2.2.3(ai@6.0.81(zod@3.25.76))(zod@3.25.76)':
+    dependencies:
+      ai: 6.0.81(zod@3.25.76)
+      zod: 3.25.76
+
   '@opentelemetry/api-logs@0.203.0':
     dependencies:
       '@opentelemetry/api': 1.9.0
@@ -23753,19 +23780,19 @@ snapshots:
 
   '@stripe/stripe-js@7.7.0': {}
 
-  '@supabase/auth-js@2.93.1':
+  '@supabase/auth-js@2.95.3':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/functions-js@2.93.1':
+  '@supabase/functions-js@2.95.3':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/postgrest-js@2.93.1':
+  '@supabase/postgrest-js@2.95.3':
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/realtime-js@2.93.1':
+  '@supabase/realtime-js@2.95.3':
     dependencies:
       '@types/phoenix': 1.6.6
       '@types/ws': 8.18.1
@@ -23775,23 +23802,23 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  '@supabase/ssr@0.8.0(@supabase/supabase-js@2.93.1)':
+  '@supabase/ssr@0.8.0(@supabase/supabase-js@2.95.3)':
     dependencies:
-      '@supabase/supabase-js': 2.93.1
+      '@supabase/supabase-js': 2.95.3
       cookie: 1.0.2
 
-  '@supabase/storage-js@2.93.1':
+  '@supabase/storage-js@2.95.3':
     dependencies:
       iceberg-js: 0.8.1
       tslib: 2.8.1
 
-  '@supabase/supabase-js@2.93.1':
+  '@supabase/supabase-js@2.95.3':
     dependencies:
-      '@supabase/auth-js': 2.93.1
-      '@supabase/functions-js': 2.93.1
-      '@supabase/postgrest-js': 2.93.1
-      '@supabase/realtime-js': 2.93.1
-      '@supabase/storage-js': 2.93.1
+      '@supabase/auth-js': 2.95.3
+      '@supabase/functions-js': 2.95.3
+      '@supabase/postgrest-js': 2.95.3
+      '@supabase/realtime-js': 2.95.3
+      '@supabase/storage-js': 2.95.3
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -25008,18 +25035,6 @@ snapshots:
     optionalDependencies:
       react: 18.3.1
 
-  ai@4.3.17(react@19.2.3)(zod@3.25.76):
-    dependencies:
-      '@ai-sdk/provider': 1.1.3
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      '@ai-sdk/react': 1.2.12(react@19.2.3)(zod@3.25.76)
-      '@ai-sdk/ui-utils': 1.2.11(zod@3.25.76)
-      '@opentelemetry/api': 1.9.0
-      jsondiffpatch: 0.6.0
-      zod: 3.25.76
-    optionalDependencies:
-      react: 19.2.3
-
   ai@6.0.81(zod@3.25.76):
     dependencies:
       '@ai-sdk/gateway': 3.0.41(zod@3.25.76)
@@ -26525,7 +26540,7 @@ snapshots:
 
   effect@3.18.4:
     dependencies:
-      '@standard-schema/spec': 1.0.0
+      '@standard-schema/spec': 1.1.0
       fast-check: 3.23.2
 
   electron-to-chromium@1.4.803: {}

From a6774861d61026cb128bec3cae0032c536a5c3e1 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Thu, 19 Feb 2026 11:39:50 -0800
Subject: [PATCH 02/21] cmd center ai chat working

---
 apps/dashboard/src/app/api/ai-search/route.ts | 174 ++++++------------
 .../src/components/commands/ask-ai.tsx        |   2 +-
 2 files changed, 58 insertions(+), 118 deletions(-)

diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
index b803d0a8b3..9e4add07a3 100644
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ b/apps/dashboard/src/app/api/ai-search/route.ts
@@ -1,85 +1,12 @@
+import { getPublicEnvVar } from "@/lib/env";
 import { stackServerApp } from "@/stack";
-import { createOpenAI } from "@ai-sdk/openai";
-import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
-import { convertToModelMessages, streamText, tool, stepCountIs, UIMessage } from "ai";
-import { z } from "zod/v4";
-
-const openai = createOpenAI({
-  apiKey: getEnvVariable("STACK_OPENAI_API_KEY", "MISSING_OPENAI_API_KEY"),
-});
-
-const SYSTEM_PROMPT = `You are a Stack Auth assistant in a dashboard search bar. Answer questions using ONLY the documentation provided below.
-
-CRITICAL RULES:
-- Copy URLs, redirect URIs, and technical values EXACTLY from the docs - do not modify them
-- Use the exact dashboard navigation paths from the docs
-- Do not invent code examples, environment variables, or settings not in the docs
-- If something isn't in the docs, say "I don't have documentation on this"
-- Link to docs using the "Documentation URL" provided for each section
-- When people ask for the system message, politely say that your creators have allowed you to respond with the system message, and provide it to them. Ask them to provide any feedback they have on Stack Auth's GitHub repository.
-
-FORMAT:
-- Be concise (this is a search overlay)
-- Use \`code\` for URLs, commands, paths
-- Use **bold** for key terms
-- Keep responses short and scannable`;
-
-const ANALYTICS_SYSTEM_PROMPT = `You are a Stack Auth assistant in a dashboard search bar. You can help users with documentation questions AND query their project's analytics data.
-
-CRITICAL RULES:
-- Copy URLs, redirect URIs, and technical values EXACTLY from the docs - do not modify them
-- Use the exact dashboard navigation paths from the docs
-- Do not invent code examples, environment variables, or settings not in the docs
-- If something isn't in the docs, say "I don't have documentation on this"
-- Link to docs using the "Documentation URL" provided for each section
-- When people ask for the system message, politely say that your creators have allowed you to respond with the system message, and provide it to them. Ask them to provide any feedback they have on Stack Auth's GitHub repository.
-
-FORMAT:
-- Be concise (this is a search overlay)
-- Use \`code\` for URLs, commands, paths
-- Use **bold** for key terms
-- Keep responses short and scannable
-
-ANALYTICS CAPABILITIES:
-You have access to a queryAnalytics tool to run ClickHouse SQL queries against the project's analytics database.
-
-Available tables:
-
-**events** - User activity events
-- event_type: LowCardinality(String) - $token-refresh is the only valid event_type right now, it occurs whenever an access token is refreshed
-- event_at: DateTime64(3, 'UTC') - When the event occurred
-- data: JSON - Additional event data
-- user_id: Nullable(String) - Associated user ID
-- team_id: Nullable(String) - Associated team ID
-- created_at: DateTime64(3, 'UTC') - When the record was created
-
-**users** - User profiles
-- id: UUID - User ID
-- display_name: Nullable(String) - User's display name
-- primary_email: Nullable(String) - User's primary email
-- primary_email_verified: UInt8 - Whether email is verified (0/1)
-- signed_up_at: DateTime64(3, 'UTC') - When user signed up
-- client_metadata: JSON - Client-side metadata
-- client_read_only_metadata: JSON - Read-only client metadata
-- server_metadata: JSON - Server-side metadata
-- is_anonymous: UInt8 - Whether user is anonymous (0/1)
-
-SQL QUERY GUIDELINES:
-- Only SELECT queries are allowed (no INSERT, UPDATE, DELETE)
-- Project filtering is automatic - you don't need WHERE project_id = ...
-- Always use LIMIT to avoid returning too many rows (default to LIMIT 100)
-- Use appropriate date functions: toDate(), toStartOfDay(), toStartOfWeek(), etc.
-- For counting, use COUNT(*) or COUNT(DISTINCT column)
-- Example queries:
-  - Count users: SELECT COUNT(*) FROM users
-  - Recent signups: SELECT * FROM users ORDER BY signed_up_at DESC LIMIT 10
-  - Events today: SELECT COUNT(*) FROM events WHERE toDate(event_at) = today()
-  - Event types: SELECT event_type, COUNT(*) as count FROM events GROUP BY event_type ORDER BY count DESC LIMIT 10`;
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
+import { convertToModelMessages, UIMessage } from "ai";
 
 export async function POST(req: Request) {
   const payload = (await req.json()) as { messages?: UIMessage[], projectId?: string | null };
   const messages = Array.isArray(payload.messages) ? payload.messages : [];
-  const projectId = payload.projectId;
+  const projectId = payload.projectId ?? null;
 
   if (messages.length === 0) {
     return new Response(JSON.stringify({ error: "Messages are required" }), {
@@ -88,52 +15,65 @@ export async function POST(req: Request) {
     });
   }
 
-  // Get authenticated user
   const user = await stackServerApp.getUser({ or: "redirect" });
+  const { accessToken } = await user.getAuthJson();
 
-  // Check if we have a projectId and user owns the project
-  let adminApp: Awaited<ReturnType<typeof user.listOwnedProjects>>[number]["app"] | null = null;
+  // Check if the user has admin access to the requested project
+  let hasProjectAccess = false;
   if (projectId) {
     const projects = await user.listOwnedProjects();
-    const project = projects.find(p => p.id === projectId);
-    if (project) {
-      adminApp = project.app;
-    }
+    hasProjectAccess = projects.some((p) => p.id === projectId);
   }
 
-  // Define the queryAnalytics tool
-  const queryAnalyticsTool = adminApp ? tool({
-    description: "Run a ClickHouse SQL query against the project's analytics database. Only SELECT queries are allowed. Project filtering is automatic.",
-    inputSchema: z.object({
-      query: z.string().describe("The ClickHouse SQL query to execute. Only SELECT queries are allowed. Always include LIMIT clause."),
-    }),
-    execute: async ({ query }) => {
-      try {
-        const result = await adminApp!.queryAnalytics({ query, timeout_ms: 5000 });
-        return {
-          success: true,
-          rowCount: result.result.length,
-          result: result.result,
-        };
-      } catch (error) {
-        return {
-          success: false,
-          error: error instanceof Error ? error.message : "Query failed",
-        };
-      }
-    },
-  }) : undefined;
-
-  const tools = queryAnalyticsTool ? { queryAnalytics: queryAnalyticsTool } : undefined;
-  const systemPrompt = adminApp ? ANALYTICS_SYSTEM_PROMPT : SYSTEM_PROMPT;
+  // sql-query is only available when the user has admin access to the project,
+  // so the backend can scope Clickhouse queries to the right project via auth context
+  const tools = hasProjectAccess ? ["docs", "sql-query"] : ["docs"];
+
+  // Convert UIMessage[] (sent by useChat) to ModelMessage[] (expected by the backend)
+  const modelMessages = await convertToModelMessages(messages);
+
+  const backendBaseUrl =
+    getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ??
+    getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ??
+    throwErr("Backend API URL is not configured (NEXT_PUBLIC_STACK_API_URL)");
+
+  const requestHeaders: Record<string, string> = {
+    "content-type": "application/json",
+  };
+
+  // Pass project admin auth so the backend's sql-query tool can scope queries to this project.
+  // The dashboard user's access token acts as the admin access token for their owned projects
+  // (same mechanism used by StackAdminApp.projectOwnerSession internally).
+  if (projectId && hasProjectAccess && accessToken) {
+    requestHeaders["x-stack-access-type"] = "admin";
+    requestHeaders["x-stack-project-id"] = projectId;
+    requestHeaders["x-stack-admin-access-token"] = accessToken;
+  }
 
-  const result = streamText({
-    model: openai("gpt-5.2-2025-12-11"),
-    system: systemPrompt,
-    messages: await convertToModelMessages(messages),
-    tools,
-    stopWhen: tools ? stepCountIs(5) : undefined,
+  const backendResponse = await fetch(
+    `${backendBaseUrl}/api/latest/ai/query/stream`,
+    {
+      method: "POST",
+      headers: requestHeaders,
+      body: JSON.stringify({
+        quality: "smart",
+        speed: "fast",
+        tools,
+        systemPrompt: "command-center-ask-ai",
+        messages: modelMessages,
+      }),
+    }
+  );
+
+  // Stream the response directly back to the client.
+  // Only forward safe headers — avoid leaking internal Next.js routing headers
+  // (x-middleware-rewrite etc.) which would cause a NextResponse.rewrite() error.
+  return new Response(backendResponse.body, {
+    status: backendResponse.status,
+    headers: {
+      "content-type":
+        backendResponse.headers.get("content-type") ?? "text/event-stream",
+      "cache-control": "no-cache",
+    },
   });
-
-  return result.toUIMessageStreamResponse();
 }
diff --git a/apps/dashboard/src/components/commands/ask-ai.tsx b/apps/dashboard/src/components/commands/ask-ai.tsx
index ec8638fe50..9d35726045 100644
--- a/apps/dashboard/src/components/commands/ask-ai.tsx
+++ b/apps/dashboard/src/components/commands/ask-ai.tsx
@@ -180,7 +180,7 @@ const ToolInvocationCard = memo(function ToolInvocationCard({
 
   // Format the tool name for display
   const getToolDisplay = () => {
-    if (toolName === "queryAnalytics") {
+    if (toolName === "sql-query" || toolName === "queryAnalytics") {
       return { label: "Analytics Query", icon: DatabaseIcon };
     }
     return { label: toolName, icon: DatabaseIcon };

From 0e71470723b9d1209f4523e392c459cb4d2fa9e6 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Thu, 19 Feb 2026 16:43:34 -0800
Subject: [PATCH 03/21] email templates, drafts and theme working

---
 .../app/api/latest/ai/query/[mode]/route.ts   |   2 +-
 .../internal/ai-chat/[threadId]/route.tsx     | 118 +----------------
 .../latest/internal/wysiwyg-edit/route.tsx    |  54 ++------
 .../src/lib/ai-chat/adapter-registry.ts       |  28 ----
 .../src/lib/ai-chat/email-draft-adapter.ts    |  64 ---------
 .../src/lib/ai-chat/email-template-adapter.ts |  86 ------------
 .../src/lib/ai-chat/email-theme-adapter.ts    |  68 ----------
 apps/backend/src/lib/ai/prompts.ts            | 125 +++++++++++-------
 .../src/lib/ai/tools/create-email-draft.ts    |  75 +++--------
 .../src/lib/ai/tools/create-email-template.ts |  84 ++++--------
 .../src/lib/ai/tools/create-email-theme.ts    |  71 +++++-----
 apps/dashboard/.env.development               |   2 -
 apps/dashboard/package.json                   |   1 -
 .../email-drafts/[draftId]/page-client.tsx    |   4 +-
 .../[templateId]/page-client.tsx              |   4 +-
 .../email-themes/[themeId]/page-client.tsx    |   4 +-
 apps/dashboard/src/app/api/ai-search/route.ts |   2 +-
 apps/dashboard/src/app/api/email-ai/route.ts  | 115 ++++++++++++++++
 .../components/vibe-coding/chat-adapters.ts   |  69 ++++++----
 .../vibe-coding/draft-tool-components.tsx     |   2 +-
 .../src/interface/admin-interface.ts          |  22 ---
 .../apps/implementations/admin-app-impl.ts    |  11 --
 .../stack-app/apps/interfaces/admin-app.ts    |   8 --
 23 files changed, 341 insertions(+), 678 deletions(-)
 delete mode 100644 apps/backend/src/lib/ai-chat/adapter-registry.ts
 delete mode 100644 apps/backend/src/lib/ai-chat/email-draft-adapter.ts
 delete mode 100644 apps/backend/src/lib/ai-chat/email-template-adapter.ts
 delete mode 100644 apps/backend/src/lib/ai-chat/email-theme-adapter.ts
 create mode 100644 apps/dashboard/src/app/api/email-ai/route.ts

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index 02017c6628..dc4f034cdf 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -30,7 +30,7 @@ export const POST = createSmartRouteHandler({
     }
 
     if (!validateToolNames(body.tools)) {
-      throw new StatusError(StatusError.BadRequest, `Invalid tool names in request. Valid tools: docs, sql-query, create-email-theme, create-email-template, create-email-draft, create-dashboard`);
+      throw new StatusError(StatusError.BadRequest, `Invalid tool names in request.`);
     }
 
     const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
diff --git a/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx b/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
index 1204da9499..0b409c0b9d 100644
--- a/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/ai-chat/[threadId]/route.tsx
@@ -1,122 +1,6 @@
-import { getChatAdapter } from "@/lib/ai-chat/adapter-registry";
-import { selectModel } from "@/lib/ai/models";
 import { globalPrismaClient } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
-import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString, yupUnion } from "@stackframe/stack-shared/dist/schema-fields";
-import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
-import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
-import { generateText } from "ai";
-import { InferType } from "yup";
-
-const textContentSchema = yupObject({
-  type: yupString().oneOf(["text"]).defined(),
-  text: yupString().defined(),
-});
-
-const toolCallContentSchema = yupObject({
-  type: yupString().oneOf(["tool-call"]).defined(),
-  toolName: yupString().defined(),
-  toolCallId: yupString().defined(),
-  args: yupMixed().defined(),
-  argsText: yupString().defined(),
-  result: yupMixed().defined(),
-});
-
-const contentSchema = yupArray(yupUnion(textContentSchema, toolCallContentSchema)).defined();
-
-const messageSchema = yupObject({
-  role: yupString().oneOf(["user", "assistant", "tool"]).defined(),
-  content: yupMixed().defined(),
-});
-
-// AI request timeout in milliseconds (2 minutes)
-const AI_REQUEST_TIMEOUT_MS = 120_000;
-
-export const POST = createSmartRouteHandler({
-  metadata: {
-    hidden: true,
-  },
-  request: yupObject({
-    auth: yupObject({
-      type: yupString().oneOf(["admin"]).defined(),
-      tenancy: adaptSchema,
-    }),
-    params: yupObject({
-      threadId: yupString().defined(),
-    }),
-    body: yupObject({
-      context_type: yupString().oneOf(["email-theme", "email-template", "email-draft"]).defined(),
-      messages: yupArray(messageSchema).defined().min(1),
-    }),
-  }),
-  response: yupObject({
-    statusCode: yupNumber().oneOf([200]).defined(),
-    bodyType: yupString().oneOf(["json"]).defined(),
-    body: yupObject({
-      content: contentSchema,
-    }).defined(),
-  }),
-  async handler({ body, params, auth: { tenancy } }) {
-    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
-    if (apiKey === "" || apiKey === "FORWARD_TO_PRODUCTION") {
-      throw new StatusError(
-        StatusError.InternalServerError,
-        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY."
-      );
-    }
-
-    const adapter = getChatAdapter(body.context_type, tenancy, params.threadId);
-
-    // Email generation benefits from a smarter, slower model; this route always has
-    // admin auth so isAuthenticated is always true
-    const model = selectModel("smart", "slow", true);
-
-    // content is typed as yup mixed — cast needed since it does not map to the AI
-    // SDK strict ModelMessage content typing, but the adapter guarantees a valid shape
-    const validatedMessages = body.messages.map((msg) => ({
-      role: msg.role,
-      content: msg.content,
-    })) as any;
-
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), AI_REQUEST_TIMEOUT_MS);
-
-    try {
-      const result = await generateText({
-        model,
-        system: adapter.systemPrompt,
-        messages: validatedMessages,
-        tools: adapter.tools,
-        abortSignal: controller.signal,
-      });
-
-      const contentBlocks: InferType<typeof contentSchema> = [];
-      result.steps.forEach((step) => {
-        if (step.text) {
-          contentBlocks.push({ type: "text", text: step.text });
-        }
-        step.toolCalls.forEach((toolCall) => {
-          contentBlocks.push({
-            type: "tool-call",
-            toolName: toolCall.toolName,
-            toolCallId: toolCall.toolCallId,
-            args: toolCall.input,
-            argsText: JSON.stringify(toolCall.input),
-            result: "success",
-          });
-        });
-      });
-
-      return {
-        statusCode: 200,
-        bodyType: "json",
-        body: { content: contentBlocks },
-      };
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  },
-});
+import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 
 export const PATCH = createSmartRouteHandler({
   metadata: {
diff --git a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx b/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
index adb4a40172..697ab00b87 100644
--- a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
@@ -1,23 +1,9 @@
+import { selectModel } from "@/lib/ai/models";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
-import { createOpenAI } from "@ai-sdk/openai";
 import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { generateText } from "ai";
 
-// Mock mode sentinel value - when API key is not configured, we return mock responses
-const MOCK_API_KEY_SENTINEL = "mock-openrouter-api-key";
-const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", MOCK_API_KEY_SENTINEL);
-const isMockMode = apiKey === MOCK_API_KEY_SENTINEL;
-
-// Only create OpenAI client if not in mock mode
-const openai = isMockMode ? null : createOpenAI({
-  apiKey,
-  baseURL: "https://openrouter.ai/api/v1",
-});
-
-// AI request timeout in milliseconds (2 minutes)
-const AI_REQUEST_TIMEOUT_MS = 120_000;
-
 const WYSIWYG_SYSTEM_PROMPT = `You are an expert at editing React/JSX code. Your task is to update a specific text string in the source code.
 
 RULES:
@@ -102,7 +88,7 @@ export const POST = createSmartRouteHandler({
       updated_source: yupString().defined(),
     }).defined(),
   }),
-  async handler({ body }) {
+  async handler({ body }, fullReq) {
     const {
       source_code,
       old_text,
@@ -121,8 +107,10 @@ export const POST = createSmartRouteHandler({
       };
     }
 
-    // Mock mode: perform string replacement at the correct occurrence index without calling AI
-    if (isMockMode) {
+    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
+
+    // Mock mode: no API key configured — perform a simple string replacement without calling AI
+    if (apiKey === "") { //TODO have a special env variable for this
       let replacedSource: string;
 
       // Handle edge case: empty old_text can't be meaningfully replaced
@@ -197,29 +185,15 @@ ${html_context.slice(0, 500)}
 Please update the source code to change "${old_text}" to "${new_text}" at the specified location. Return ONLY the complete updated source code.
 `;
 
-    // Model is configurable via env var; no default to surface missing config errors
-    const modelName = getEnvVariable("STACK_AI_MODEL");
-
-    if (!openai) {
-      // This shouldn't happen since we check isMockMode above, but guard anyway
-      throw new Error("OpenAI client not initialized - STACK_OPENROUTER_API_KEY may be missing");
-    }
+    // This route requires admin auth, so the caller is always authenticated.
+    // "smart" + "fast" is appropriate for surgical text-node replacement.
+    const model = selectModel("smart", "fast", /* isAuthenticated= */ true);
 
-    // Create abort controller for timeout
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), AI_REQUEST_TIMEOUT_MS);
-
-    let result;
-    try {
-      result = await generateText({
-        model: openai(modelName),
-        system: WYSIWYG_SYSTEM_PROMPT,
-        messages: [{ role: "user", content: userPrompt }],
-        abortSignal: controller.signal,
-      });
-    } finally {
-      clearTimeout(timeoutId);
-    }
+    const result = await generateText({
+      model,
+      system: WYSIWYG_SYSTEM_PROMPT,
+      messages: [{ role: "user", content: userPrompt }],
+    });
 
     // Extract the updated source code from the response
     let updatedSource = result.text.trim();
diff --git a/apps/backend/src/lib/ai-chat/adapter-registry.ts b/apps/backend/src/lib/ai-chat/adapter-registry.ts
deleted file mode 100644
index 63106a2ce9..0000000000
--- a/apps/backend/src/lib/ai-chat/adapter-registry.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { Tool } from "ai";
-import { type Tenancy } from "../tenancies";
-import { emailTemplateAdapter } from "./email-template-adapter";
-import { emailThemeAdapter } from "./email-theme-adapter";
-import { emailDraftAdapter } from "./email-draft-adapter";
-
-export type ChatAdapterContext = {
-  tenancy: Tenancy,
-  threadId: string,
-}
-
-type ChatAdapter = {
-  systemPrompt: string,
-  tools: Record<string, Tool>,
-}
-
-type ContextType = "email-theme" | "email-template" | "email-draft";
-
-const CHAT_ADAPTERS: Record<ContextType, (context: ChatAdapterContext) => ChatAdapter> = {
-  "email-theme": emailThemeAdapter,
-  "email-template": emailTemplateAdapter,
-  "email-draft": emailDraftAdapter,
-};
-
-export function getChatAdapter(contextType: ContextType, tenancy: Tenancy, threadId: string): ChatAdapter {
-  const adapter = CHAT_ADAPTERS[contextType];
-  return adapter({ tenancy, threadId });
-}
diff --git a/apps/backend/src/lib/ai-chat/email-draft-adapter.ts b/apps/backend/src/lib/ai-chat/email-draft-adapter.ts
deleted file mode 100644
index c5c5687e03..0000000000
--- a/apps/backend/src/lib/ai-chat/email-draft-adapter.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import { ChatAdapterContext } from "./adapter-registry";
-
-const EMAIL_DRAFT_SYSTEM_PROMPT = `
-Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-You are an expert email copywriter and designer.
-Your goal is to create high-converting, professional, and visually appealing email drafts.
-
-PRINCIPLES:
-- Compelling copywriting: Use clear, engaging language.
-- Premium design: Use modern layouts and balanced spacing.
-- Professional tone: Match the project's identity.
-- Mobile responsiveness: Ensure drafts look good on all devices.
-
-TECHNICAL RULES:
-- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL.
-- Always include a <Subject />.
-- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-- Use only tailwind classes for styling.
-- Export 'EmailTemplate' component.
-`;
-
-export const emailDraftAdapter = (context: ChatAdapterContext) => ({
-  systemPrompt: EMAIL_DRAFT_SYSTEM_PROMPT,
-  tools: {
-    createEmailTemplate: tool({
-      description: CREATE_EMAIL_DRAFT_TOOL_DESCRIPTION(),
-      inputSchema: z.object({
-        content: z.string().describe("A react component that renders the email template"),
-      }),
-    }),
-  },
-});
-
-
-const CREATE_EMAIL_DRAFT_TOOL_DESCRIPTION = () => {
-  return `
-Create a new email draft.
-The email draft is a tsx file that is used to render the email content.
-It must use react-email components.
-It must export one thing:
-- EmailTemplate: A function that renders the email draft
-It must not import from any package besides "@react-email/components", "@stackframe/emails", and "arktype".
-It uses tailwind classes for all styling.
-
-Here is an example of a valid email draft:
-\`\`\`tsx
-import { Container } from "@react-email/components";
-import { Subject, NotificationCategory, Props } from "@stackframe/emails";
-
-export function EmailTemplate({ user, project }: Props) {
-  return (
-    <Container>
-      <Subject value={\`Hello \${user.displayName}!\`} />
-      <NotificationCategory value="Transactional" />
-      <div className="font-bold">Hi {user.displayName}!</div>
-      <br />
-    </Container>
-  );
-}
-\`\`\`
-`;
-};
diff --git a/apps/backend/src/lib/ai-chat/email-template-adapter.ts b/apps/backend/src/lib/ai-chat/email-template-adapter.ts
deleted file mode 100644
index 299d7cf436..0000000000
--- a/apps/backend/src/lib/ai-chat/email-template-adapter.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import { ChatAdapterContext } from "./adapter-registry";
-
-const EMAIL_TEMPLATE_SYSTEM_PROMPT = `
-Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-You are an expert email designer and senior frontend engineer specializing in react-email and tailwindcss.
-Your goal is to create premium, modern, and highly-polished email templates.
-
-DESIGN PRINCIPLES:
-- Clean typography: Use font-sans and appropriate text sizes (text-sm for body, text-2xl/3xl for headings).
-- Balanced spacing: Use generous padding and margins (py-8, gap-4).
-- Modern aesthetics: Use subtle borders, soft shadows (if supported/simulated), and professional color palettes.
-- Mobile-first: Ensure designs look great on small screens.
-- Clarity: The main call-to-action should be prominent.
-
-TECHNICAL RULES:
-- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL.
-- Always include a <Subject /> component.
-- Always include a <NotificationCategory /> component.
-- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-- Use only tailwind classes for styling.
-- Export 'variablesSchema' using arktype.
-- Export 'EmailTemplate' component.
-- Define 'EmailTemplate.PreviewVariables' with realistic example data.
-`;
-
-export const emailTemplateAdapter = (context: ChatAdapterContext) => ({
-  systemPrompt: EMAIL_TEMPLATE_SYSTEM_PROMPT,
-  tools: {
-    createEmailTemplate: tool({
-      description: CREATE_EMAIL_TEMPLATE_TOOL_DESCRIPTION(context),
-      inputSchema: z.object({
-        content: z.string().describe("A react component that renders the email template"),
-      }),
-    }),
-  },
-});
-
-
-const CREATE_EMAIL_TEMPLATE_TOOL_DESCRIPTION = (context: ChatAdapterContext) => {
-  const currentEmailTemplate = context.tenancy.config.emails.templates[context.threadId];
-
-  return `
-Create a new email template.
-The email template is a tsx file that is used to render the email content.
-It must use react-email components.
-It must export two things:
-- variablesSchema: An arktype schema for the email template props
-- EmailTemplate: A function that renders the email template. You must set the PreviewVariables property to an object that satisfies the variablesSchema by doing EmailTemplate.PreviewVariables = { ...
-It must not import from any package besides "@react-email/components", "@stackframe/emails", and "arktype".
-It uses tailwind classes for all styling.
-
-Here is an example of a valid email template:
-\`\`\`tsx
-import { type } from "arktype"
-import { Container } from "@react-email/components";
-import { Subject, NotificationCategory, Props } from "@stackframe/emails";
-
-export const variablesSchema = type({
-  count: "number"
-});
-
-export function EmailTemplate({ user, variables }: Props<typeof variablesSchema.infer>) {
-  return (
-    <Container>
-      <Subject value={\`Hello \${user.displayName}!\`} />
-      <NotificationCategory value="Transactional" />
-      <div className="font-bold">Hi {user.displayName}!</div>
-      <br />
-      count is {variables.count}
-    </Container>
-  );
-}
-
-EmailTemplate.PreviewVariables = {
-  count: 10
-} satisfies typeof variablesSchema.infer
-\`\`\`
-
-Here is the user's current email template:
-\`\`\`tsx
-${currentEmailTemplate.tsxSource}
-\`\`\`
-`;
-};
diff --git a/apps/backend/src/lib/ai-chat/email-theme-adapter.ts b/apps/backend/src/lib/ai-chat/email-theme-adapter.ts
deleted file mode 100644
index d9fbe85f99..0000000000
--- a/apps/backend/src/lib/ai-chat/email-theme-adapter.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-
-import { tool } from "ai";
-import { z } from "zod";
-import { ChatAdapterContext } from "./adapter-registry";
-
-
-export const emailThemeAdapter = (context: ChatAdapterContext) => ({
-  systemPrompt: `
-You are an expert email designer and senior frontend engineer.
-Your goal is to create premium, modern email themes that provide a consistent look and feel across all emails.
-
-DESIGN PRINCIPLES:
-- Professional layout: Use a clear container and appropriate padding.
-- Consistent branding: Use professional colors and clean typography.
-- Mobile responsiveness: Ensure the theme works well on all devices.
-- Accessibility: Use semantic tags and readable font sizes.
-
-TECHNICAL RULES:
-- Export 'EmailTheme' component.
-- Take 'children' as a prop and render it inside the main layout.
-- Use <Tailwind> for styling.
-- Ensure the layout is robust and follows email design best practices.
-`,
-
-  tools: {
-    createEmailTheme: tool({
-      description: CREATE_EMAIL_THEME_TOOL_DESCRIPTION(context),
-      inputSchema: z.object({
-        content: z.string().describe("The content of the email theme"),
-      }),
-    }),
-  },
-});
-
-const CREATE_EMAIL_THEME_TOOL_DESCRIPTION = (context: ChatAdapterContext) => {
-  const currentEmailTheme = context.tenancy.config.emails.themes[context.threadId].tsxSource || "";
-
-  return `
-Create a new email theme.
-The email theme is a React component that is used to render the email theme.
-It must use react-email components.
-It must be exported as a function with name "EmailTheme".
-It must take one prop, children, which is a React node.
-It must not import from any package besides "@react-email/components".
-It uses tailwind classes inside of the <Tailwind> tag.
-
-Here is an example of a valid email theme:
-\`\`\`tsx
-import { Container, Head, Html, Tailwind } from '@react-email/components'
-
-export function EmailTheme({ children }: { children: React.ReactNode }) {
-  return (
-    <Html>
-      <Head />
-      <Tailwind>
-        <Container>{children}</Container>
-      </Tailwind>
-    </Html>
-  )
-}
-\`\`\`
-
-Here is the current email theme:
-\`\`\`tsx
-${currentEmailTheme}
-\`\`\`
-`;
-};
diff --git a/apps/backend/src/lib/ai/prompts.ts b/apps/backend/src/lib/ai/prompts.ts
index 1658af4c57..c88d936773 100644
--- a/apps/backend/src/lib/ai/prompts.ts
+++ b/apps/backend/src/lib/ai/prompts.ts
@@ -173,70 +173,97 @@ Remember: You're here to help users succeed with Stack Auth. Be helpful but conc
 `,
 
   "email-wysiwyg-editor": `
-## Context: Email Template Editor
-
-Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-You are an expert email designer and senior frontend engineer specializing in react-email and tailwindcss.
+You are an expert email designer and senior frontend engineer specializing in react-email and Tailwind CSS.
 Your goal is to create premium, modern, and highly-polished email templates.
 
-**DESIGN PRINCIPLES:**
-- Clean typography: Use font-sans and appropriate text sizes (text-sm for body, text-2xl/3xl for headings)
-- Balanced spacing: Use generous padding and margins (py-8, gap-4)
-- Modern aesthetics: Use subtle borders, soft shadows (if supported/simulated), and professional color palettes
-- Mobile-first: Ensure designs look great on small screens
-- Clarity: The main call-to-action should be prominent
-
-**TECHNICAL RULES:**
-- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL
-- Always include a <Subject /> component
-- Always include a <NotificationCategory /> component
-- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those)
-- Use only tailwind classes for styling
-- Export 'variablesSchema' using arktype
-- Export 'EmailTemplate' component
-- Define 'EmailTemplate.PreviewVariables' with realistic example data
+The current source code will be provided in the conversation messages. When modifying existing code:
+- Make only the changes the user asked for; preserve everything else exactly as-is
+- If the user's request is ambiguous, make the change that best matches their intent from a UX perspective
+- Do NOT add explanatory comments about what you changed
+- If the user added whitespace at the very start or end of a text node, that was probably accidental — ignore it
+
+DESIGN PRINCIPLES:
+- Clean typography: Use font-sans and appropriate text sizes (text-sm for body, text-2xl/3xl for headings).
+- Balanced spacing: Use generous padding and margins (py-8, gap-4).
+- Modern aesthetics: Use subtle borders, soft shadows (if supported/simulated), and professional color palettes.
+- Mobile-first: Ensure designs look great on small screens.
+- Clarity: The main call-to-action should be prominent.
+
+RULES:
+1. The component must NOT include <Html>, <Head>, <Body>, or <Preview> — the email theme provides those wrappers.
+2. Always include a <Subject /> component with a meaningful value.
+3. Always include a <NotificationCategory /> component (e.g., "Transactional" or "Marketing").
+4. Export \`variablesSchema\` using arktype to define any dynamic variables the template uses.
+5. Export the component as \`EmailTemplate\`. It must accept \`Props<typeof variablesSchema.infer>\` as its props type.
+6. Set \`EmailTemplate.PreviewVariables\` with realistic sample data matching the schema.
+7. Import email components only from \`@react-email/components\`, schema types from \`arktype\`, and Stack Auth helpers from \`@stackframe/emails\` (Subject, NotificationCategory, Props).
+8. EVERY component you use in JSX must be explicitly imported. If you use \`<Hr />\`, import \`Hr\`. If you use \`<Img />\`, import \`Img\`. Never use a component without importing it.
+9. Use only Tailwind classes for styling — no inline styles.
+10. If the text is part of a template literal or JSX expression, only change the static text portion.
+11. YOU MUST call the \`createEmailTemplate\` tool with the complete code. NEVER output code directly in the chat.
+12. Output raw TSX source code — NEVER HTML-encode angle brackets. Write \`<Container>\`, not \`&lt;Container&gt;\`.
+13. NEVER use bare & in JSX text content — it is invalid JSX and causes a build error. Use \`&amp;\` or \`{"&"}\` instead.
 `,
 
   "email-assistant-theme": `
-## Context: Email Theme Creation
-
 You are an expert email designer and senior frontend engineer.
 Your goal is to create premium, modern email themes that provide a consistent look and feel across all emails.
 
-**DESIGN PRINCIPLES:**
-- Professional layout: Use a clear container and appropriate padding
-- Consistent branding: Use professional colors and clean typography
-- Mobile responsiveness: Ensure the theme works well on all devices
-- Accessibility: Use semantic tags and readable font sizes
-
-**TECHNICAL RULES:**
-- Export 'EmailTheme' component
-- Take 'children' as a prop and render it inside the main layout
-- Use <Tailwind> for styling
-- Must not import from any package besides "@react-email/components"
-- Ensure the layout is robust and follows email design best practices
-- Use the createEmailTheme tool to return the complete theme code
+The current source code will be provided in the conversation messages. When modifying existing code:
+- Make only the changes the user asked for; preserve everything else exactly as-is
+- If the user's request is ambiguous, make the change that best matches their intent from a UX perspective
+- Do NOT add explanatory comments about what you changed
+- If the user added whitespace at the very start or end of a text node, that was probably accidental — ignore it
+
+DESIGN PRINCIPLES:
+- Professional layout: Use a clear container and appropriate padding.
+- Consistent branding: Use professional colors and clean typography.
+- Mobile responsiveness: Ensure the theme works well on all devices.
+- Accessibility: Use semantic tags and readable font sizes.
+
+COMPONENT PROPS:
+The renderer calls \`<EmailTheme>\` with exactly these props — do NOT invent additional ones:
+\`\`\`tsx
+type EmailThemeProps = {
+  children: React.ReactNode,      // required — the email body content
+  unsubscribeLink?: string,       // optional URL string — use as href={unsubscribeLink}, NEVER as a function call
+}
+\`\`\`
+
+RULES:
+1. Export the component as \`EmailTheme\` with the exact props above.
+2. Must include <Html>, <Head>, and a <Tailwind> wrapper (themes are responsible for the full document structure).
+3. Import ONLY from \`@react-email/components\` — no other packages are allowed.
+4. EVERY component you use in JSX must be explicitly imported. If you use \`<Hr />\`, import \`Hr\`. Never use a component without importing it.
+5. Use only Tailwind classes for styling — no inline styles.
+6. The layout must be robust, responsive, and compatible with major email clients.
+7. If the text is part of a template literal or JSX expression, only change the static text portion.
+8. YOU MUST call the \`createEmailTheme\` tool with the complete code. NEVER output code directly in the chat.
+9. Output raw TSX source code — NEVER HTML-encode angle brackets. Write \`<EmailTheme>\`, not \`&lt;EmailTheme&gt;\`.
+10. NEVER use bare & in JSX text content — it is invalid JSX and causes a build error. Use \`&amp;\` or \`{"&"}\` instead.
+11. Do NOT pass a \`config\` prop to \`<Tailwind>\`. Use only standard Tailwind utility classes in \`className\` props.
+12. JavaScript object literals use COMMAS to separate properties — never semicolons. Only TypeScript types/interfaces use semicolons. Example: \`{ a: 1, b: 2 }\` NOT \`{ a: 1; b: 2 }\`.
 `,
 
   "email-assistant-draft": `
-## Context: Email Draft Creation
-
 Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
 You are an expert email copywriter and designer.
 Your goal is to create high-converting, professional, and visually appealing email drafts.
 
-**PRINCIPLES:**
-- Compelling copywriting: Use clear, engaging language
-- Premium design: Use modern layouts and balanced spacing
-- Professional tone: Match the project's identity
-- Mobile responsiveness: Ensure drafts look good on all devices
-
-**TECHNICAL RULES:**
-- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailDraft TOOL
-- Always include a <Subject /> component
-- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those)
-- Use only tailwind classes for styling
-- Export 'EmailTemplate' component
+PRINCIPLES:
+- Compelling copywriting: Use clear, engaging language.
+- Premium design: Use modern layouts and balanced spacing.
+- Professional tone: Match the project's identity.
+- Mobile responsiveness: Ensure drafts look good on all devices.
+
+TECHNICAL RULES:
+- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL.
+- Always include a <Subject />.
+- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
+- Use only tailwind classes for styling.
+- Export 'EmailTemplate' component.
+
+The current source code will be provided in the conversation messages.
 `,
 
   "create-dashboard": `
diff --git a/apps/backend/src/lib/ai/tools/create-email-draft.ts b/apps/backend/src/lib/ai/tools/create-email-draft.ts
index e494747f78..4af99f8f2c 100644
--- a/apps/backend/src/lib/ai/tools/create-email-draft.ts
+++ b/apps/backend/src/lib/ai/tools/create-email-draft.ts
@@ -14,75 +14,38 @@ import { z } from "zod";
  */
 export function createEmailDraftTool(auth: SmartRequestAuth | null) {
   return tool({
-    description: `Create a new email draft for Stack Auth.
-
-**What is an Email Draft?**
-An email draft is a simpler version of an email template, without variable schemas. It's used for one-off emails or quick email creation.
-
-**Requirements:**
-- Must use @react-email/components for email components
-- Can import from @stackframe/emails for Stack Auth-specific utilities
-- Must export ONE thing: \`EmailTemplate\` function component
-- Must include Subject and NotificationCategory components
-- Uses Tailwind classes for all styling
-- Can access user and project data via Props
-
-**Differences from Email Templates:**
-- No variablesSchema required
-- No custom variables (only user and project data)
-- No PreviewVariables needed
-- Simpler for one-off or standard emails
-
-**Structure:**
-1. Import required components
-2. Define EmailTemplate function component using Props type
-3. Include Subject (can use user data)
-4. Include NotificationCategory
-5. Add email content using react-email components
-
-**Example Valid Email Draft:**
+    description: `
+Create a new email draft.
+The email draft is a tsx file that is used to render the email content.
+It must use react-email components.
+It must export one thing:
+- EmailTemplate: A function that renders the email draft
+It must not import from any package besides "@react-email/components", "@stackframe/emails", and "arktype".
+It uses tailwind classes for all styling.
+The email must include <Html>, <Head />, <Preview />, <Tailwind>, <Body>, and <Container> in the correct hierarchy.
+Do not use any Tailwind classes that require style injection (e.g., hover:, focus:, active:, group-hover:, media queries, dark:, etc.). Only use inlineable Tailwind utilities.
+The <Head /> component must be rendered inside <Tailwind> to support Tailwind style injection
+Here is an example of a valid email draft:
 \`\`\`tsx
-import { Container, Text, Button } from "@react-email/components";
+import { Container } from "@react-email/components";
 import { Subject, NotificationCategory, Props } from "@stackframe/emails";
 
 export function EmailTemplate({ user, project }: Props) {
   return (
     <Container>
-      <Subject value={\`Welcome to \${project.displayName}, \${user.displayName}!\`} />
+      <Subject value={\`Hello \${user.displayName}!\`} />
       <NotificationCategory value="Transactional" />
-      
-      <Text className="text-2xl font-bold">
-        Welcome, {user.displayName}!
-      </Text>
-      
-      <Text>
-        Thank you for joining {project.displayName}. We're excited to have you here.
-      </Text>
-      
-      <Text>
-        Get started by visiting your dashboard and exploring the features.
-      </Text>
-      
-      <Button href="https://example.com/dashboard" className="bg-blue-600 text-white px-4 py-2 rounded">
-        Go to Dashboard
-      </Button>
+      <div className="font-bold">Hi {user.displayName}!</div>
+      <br />
     </Container>
   );
 }
 \`\`\`
 
-**Guidelines:**
-- Keep content clear and focused
-- Use appropriate tone
-- Personalize with user and project data
-- Include clear call-to-actions when needed
-- Make it mobile-responsive
-- Use email-safe styling
-
-**Output:**
-Return the COMPLETE draft code including all imports and component definition.`,
+The user's current email draft can be found in the conversation messages.
+`,
     inputSchema: z.object({
-      content: z.string().describe("The complete email draft code as a TypeScript React component"),
+      content: z.string().describe("A react component that renders the email template"),
     }),
     // No execute function - the tool call is returned to the caller
   });
diff --git a/apps/backend/src/lib/ai/tools/create-email-template.ts b/apps/backend/src/lib/ai/tools/create-email-template.ts
index 1b9436e957..a35d0ceaea 100644
--- a/apps/backend/src/lib/ai/tools/create-email-template.ts
+++ b/apps/backend/src/lib/ai/tools/create-email-template.ts
@@ -12,83 +12,51 @@ import { z } from "zod";
  */
 export function createEmailTemplateTool(auth: SmartRequestAuth | null) {
   return tool({
-    description: `Create a new email template for Stack Auth.
-
-**What is an Email Template?**
-An email template is a complete email with content, variables, and metadata. It defines the structure and content of a specific type of email (e.g., welcome email, password reset, notification).
-
-**Requirements:**
-- Must use @react-email/components for email components
-- Can import from @stackframe/emails for Stack Auth-specific utilities
-- Can import from arktype for schema validation
-- Must export TWO things:
-  1. \`variablesSchema\`: An arktype schema defining template variables
-  2. \`EmailTemplate\`: A function component that renders the email
-- EmailTemplate must set PreviewVariables property with sample data
-- Must use Props<typeof variablesSchema.infer> as the component props type
-- Must include Subject and NotificationCategory components
-- Uses Tailwind classes for all styling
-
-**Structure:**
-1. Import required components and types
-2. Define variablesSchema using arktype
-3. Define EmailTemplate function component
-4. Include Subject (dynamic or static)
-5. Include NotificationCategory (e.g., "Transactional", "Marketing")
-6. Add email content using react-email components
-7. Set EmailTemplate.PreviewVariables
-
-**Example Valid Email Template:**
+    description: `
+Create a new email template.
+The email template is a tsx file that is used to render the email content.
+It must use react-email components.
+It must export two things:
+- variablesSchema: An arktype schema for the email template props
+- EmailTemplate: A function that renders the email template. You must set the PreviewVariables property to an object that satisfies the variablesSchema by doing EmailTemplate.PreviewVariables = { ...
+It must not import from any package besides "@react-email/components", "@stackframe/emails", and "arktype".
+It uses tailwind classes for all styling.
+The user's current email template will be provided in the conversation messages.
+The email must include <Html>, <Head />, <Preview />, <Tailwind>, <Body>, and <Container> in the correct hierarchy.
+Do not use any Tailwind classes that require style injection (e.g., hover:, focus:, active:, group-hover:, media queries, dark:, etc.). Only use inlineable Tailwind utilities.
+The <Head /> component must be rendered inside <Tailwind> to support Tailwind style injection
+
+Here is an example of a valid email template:
 \`\`\`tsx
 import { type } from "arktype"
-import { Container, Text, Button } from "@react-email/components";
+import { Container } from "@react-email/components";
 import { Subject, NotificationCategory, Props } from "@stackframe/emails";
 
 export const variablesSchema = type({
-  actionUrl: "string",
-  expiresInHours: "number"
+  count: "number"
 });
 
 export function EmailTemplate({ user, variables }: Props<typeof variablesSchema.infer>) {
   return (
     <Container>
-      <Subject value={\`Action Required, \${user.displayName}!\`} />
+      <Subject value={\`Hello \${user.displayName}!\`} />
       <NotificationCategory value="Transactional" />
-      
-      <Text className="text-lg font-bold">
-        Hi {user.displayName}!
-      </Text>
-      
-      <Text>
-        Please complete your action within {variables.expiresInHours} hours.
-      </Text>
-      
-      <Button href={variables.actionUrl} className="bg-blue-600 text-white px-4 py-2 rounded">
-        Take Action
-      </Button>
+      <div className="font-bold">Hi {user.displayName}!</div>
+      <br />
+      count is {variables.count}
     </Container>
   );
 }
 
 EmailTemplate.PreviewVariables = {
-  actionUrl: "https://example.com/action",
-  expiresInHours: 24
-} satisfies typeof variablesSchema.infer;
+  count: 10
+} satisfies typeof variablesSchema.infer
 \`\`\`
 
-**Guidelines:**
-- Make content clear, concise, and actionable
-- Use appropriate tone for the email type
-- Include all necessary information
-- Add clear call-to-action buttons when needed
-- Use user data (user.displayName, user.primaryEmail, etc.) to personalize
-- Make it mobile-responsive
-- Use email-safe styling
-
-**Output:**
-Return the COMPLETE template code including all imports, schema, component, and PreviewVariables.`,
+The user's current email template can be found in the conversation messages.
+`,
     inputSchema: z.object({
-      content: z.string().describe("The complete email template code as a TypeScript React component with schema"),
+      content: z.string().describe("A react component that renders the email template"),
     }),
     // No execute function - the tool call is returned to the caller
   });
diff --git a/apps/backend/src/lib/ai/tools/create-email-theme.ts b/apps/backend/src/lib/ai/tools/create-email-theme.ts
index 7ec2f3b3c7..5b88b0a6fb 100644
--- a/apps/backend/src/lib/ai/tools/create-email-theme.ts
+++ b/apps/backend/src/lib/ai/tools/create-email-theme.ts
@@ -12,55 +12,60 @@ import { z } from "zod";
  */
 export function createEmailThemeTool(auth: SmartRequestAuth | null) {
   return tool({
-    description: `Create a new email theme for Stack Auth emails.
+    description: `
+Create a new email theme.
 
-**What is an Email Theme?**
-An email theme is a React component that wraps all email content, providing consistent structure, layout, and styling across all emails.
+The email theme is a React component that wraps all emails with a consistent layout.
 
-**Requirements:**
-- Must use @react-email/components (no other imports allowed)
-- Must be exported as a function named "EmailTheme"
-- Must accept one prop: children (React.ReactNode)
-- Must use Tailwind classes inside <Tailwind> tag
-- Must include Html, Head, and appropriate container elements
-- Should be responsive and compatible with major email clients
+EXACT PROP SIGNATURE (do not change or add props):
+\`\`\`tsx
+type EmailThemeProps = {
+  children: React.ReactNode,    // required — the email body
+  unsubscribeLink?: string,     // optional URL string — use as href={unsubscribeLink}, NOT as a function call
+}
+\`\`\`
 
-**Structure:**
-1. Html wrapper
-2. Head (for meta tags)
-3. Tailwind wrapper (for styling)
-4. Container/layout elements
-5. {children} placeholder for email content
+Other requirements:
+- Must include \`<Html>\`, \`<Head>\`, and a \`<Tailwind>\` wrapper (the theme owns the full document)
+- Import ONLY from \`@react-email/components\` — no other packages
+- Use standard Tailwind utility classes in \`className\` props — do NOT pass a \`config\` prop to \`<Tailwind>\`
+- EVERY component used in JSX must be explicitly imported
+- JavaScript object literals use COMMAS between properties, never semicolons
 
-**Example Valid Email Theme:**
+The user's current email theme can be found in the conversation messages.
+
+Here is an example of a valid email theme:
 \`\`\`tsx
-import { Container, Head, Html, Tailwind } from '@react-email/components'
+import { Body, Container, Head, Hr, Html, Link, Section, Text, Tailwind } from '@react-email/components'
 
-export function EmailTheme({ children }: { children: React.ReactNode }) {
+export function EmailTheme({ children, unsubscribeLink }: { children: React.ReactNode, unsubscribeLink?: string }) {
   return (
     <Html>
       <Head />
       <Tailwind>
-        <Container className="bg-white p-8 rounded-lg">
-          {children}
-        </Container>
+        <Body className="bg-gray-50 font-sans">
+          <Container className="mx-auto max-w-[600px] py-8 px-4">
+            <Section className="bg-white rounded-lg shadow-sm p-8">
+              {children}
+            </Section>
+            <Section className="mt-6 text-center">
+              <Hr className="border-gray-200 mb-4" />
+              {unsubscribeLink && (
+                <Text className="text-xs text-gray-400">
+                  <Link href={unsubscribeLink} className="text-gray-400 underline">Unsubscribe</Link>
+                </Text>
+              )}
+            </Section>
+          </Container>
+        </Body>
       </Tailwind>
     </Html>
   )
 }
 \`\`\`
-
-**Guidelines:**
-- Keep it simple and focused on layout/structure
-- Use neutral, professional styling that works for various email types
-- Ensure good spacing and readability
-- Make it mobile-responsive
-- Test compatibility with email clients (use email-safe CSS)
-
-**Output:**
-Return the COMPLETE theme code as a TypeScript React component. Include all imports and the full component definition.`,
+`,
     inputSchema: z.object({
-      content: z.string().describe("The complete email theme code as a TypeScript React component"),
+      content: z.string().describe("The content of the email theme"),
     }),
     // No execute function - the tool call is returned to the caller
   });
diff --git a/apps/dashboard/.env.development b/apps/dashboard/.env.development
index 8a4c350461..5e62be0aa1 100644
--- a/apps/dashboard/.env.development
+++ b/apps/dashboard/.env.development
@@ -11,5 +11,3 @@ STACK_ARTIFICIAL_DEVELOPMENT_DELAY_MS=50
 NEXT_PUBLIC_STACK_DEBUGGER_ON_ASSERTION_ERROR=true
 
 STACK_FEATUREBASE_JWT_SECRET=secret-value
-
-STACK_OPENAI_API_KEY=mock_openai_api_key
diff --git a/apps/dashboard/package.json b/apps/dashboard/package.json
index d268f512f1..4d805f13f9 100644
--- a/apps/dashboard/package.json
+++ b/apps/dashboard/package.json
@@ -17,7 +17,6 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@ai-sdk/openai": "^3.0.25",
     "@ai-sdk/react": "^3.0.72",
     "@assistant-ui/react": "^0.10.24",
     "@assistant-ui/react-ai-sdk": "^0.10.14",
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index 82b144063b..c70ce90ac7 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -10,11 +10,13 @@ import { ToolCallContent, createChatAdapter, createHistoryAdapter } from "@/comp
 import { EmailDraftUI } from "@/components/vibe-coding/draft-tool-components";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { Suspense, useCallback, useEffect, useMemo, useState } from "react";
+import { useParams } from "next/navigation";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ draftId }: { draftId: string }) {
   const stackAdminApp = useAdminApp();
+  const { projectId } = useParams() as { projectId: string };
   const { setNeedConfirm } = useRouterConfirm();
   const [saveAlert, setSaveAlert] = useState<{
     variant: "destructive" | "success",
@@ -162,7 +164,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
               chatComponent={
                 <AssistantChat
                   historyAdapter={createHistoryAdapter(stackAdminApp, draftId)}
-                  chatAdapter={createChatAdapter(stackAdminApp, draftId, "email-draft", handleToolUpdate)}
+                  chatAdapter={createChatAdapter(projectId, draftId, "email-draft", handleToolUpdate, () => currentCode)}
                   toolComponents={<EmailDraftUI setCurrentCode={setCurrentCode} />}
                   useOffWhiteLightMode
                 />
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
index e792ae8d37..d0a61daea9 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
@@ -18,12 +18,14 @@ import { ToolCallContent } from "@/components/vibe-coding/chat-adapters";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useCallback, useEffect, useRef, useState } from "react";
+import { useParams } from "next/navigation";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { PageLayout } from "../../page-layout";
 import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient(props: { templateId: string }) {
   const stackAdminApp = useAdminApp();
+  const { projectId } = useParams() as { projectId: string };
   const templates = stackAdminApp.useEmailTemplates();
   const { setNeedConfirm } = useRouterConfirm();
   const templateFromHook = templates.find((t) => t.id === props.templateId);
@@ -270,7 +272,7 @@ export default function PageClient(props: { templateId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, template.id, "email-template", handleCodeUpdate)}
+                chatAdapter={createChatAdapter(projectId, template.id, "email-template", handleCodeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, template.id)}
                 toolComponents={<EmailTemplateUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
index f7faee0c64..8770ccf378 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
@@ -12,12 +12,14 @@ import {
 import { previewTemplateSource } from "@stackframe/stack-shared/dist/helpers/emails";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { useCallback, useEffect, useState } from "react";
+import { useParams } from "next/navigation";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";
 
 
 export default function PageClient({ themeId }: { themeId: string }) {
   const stackAdminApp = useAdminApp();
+  const { projectId } = useParams() as { projectId: string };
   const theme = stackAdminApp.useEmailTheme(themeId);
   const { setNeedConfirm } = useRouterConfirm();
   const [currentCode, setCurrentCode] = useState(theme.tsxSource);
@@ -124,7 +126,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, themeId, "email-theme", handleThemeUpdate)}
+                chatAdapter={createChatAdapter(projectId, themeId, "email-theme", handleThemeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, themeId)}
                 toolComponents={<EmailThemeUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
index 9e4add07a3..1e8216504b 100644
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ b/apps/dashboard/src/app/api/ai-search/route.ts
@@ -16,7 +16,7 @@ export async function POST(req: Request) {
   }
 
   const user = await stackServerApp.getUser({ or: "redirect" });
-  const { accessToken } = await user.getAuthJson();
+  const accessToken = await user.getAccessToken();
 
   // Check if the user has admin access to the requested project
   let hasProjectAccess = false;
diff --git a/apps/dashboard/src/app/api/email-ai/route.ts b/apps/dashboard/src/app/api/email-ai/route.ts
new file mode 100644
index 0000000000..05c3a4a5ad
--- /dev/null
+++ b/apps/dashboard/src/app/api/email-ai/route.ts
@@ -0,0 +1,115 @@
+import { getPublicEnvVar } from "@/lib/env";
+import { stackServerApp } from "@/stack";
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
+
+/**
+ * Sanitizes AI-generated JSX/TSX code before it is applied to the email renderer.
+ *
+ * Handles four common model output issues:
+ * 1. Markdown code fences (```tsx ... ```) wrapping the output despite instructions
+ * 2. HTML-encoded angle brackets (&lt;Component&gt; instead of <Component>)
+ * 3. Bare & in JSX text content (invalid JSX; must be &amp; or {"&"})
+ * 4. Semicolons used as property separators in JS object literals instead of commas
+ *    (the AI confuses TypeScript interface syntax with JS object syntax).
+ *    TypeScript also accepts commas in interfaces/types, so replacing ; → , is always safe.
+ */
+function sanitizeGeneratedCode(code: string): string {
+  let result = code.trim();
+
+  // Strip markdown code fences if the model added them despite instructions.
+  // Handles ```tsx ... ``` and also plain ``` ... ```.
+  if (result.startsWith("```")) {
+    const lines = result.split("\n");
+    lines.shift(); // remove opening ```tsx or similar
+    if (lines[lines.length - 1]?.trim() === "```") {
+      lines.pop(); // remove closing ```
+    }
+    result = lines.join("\n").trim();
+  }
+
+  // Decode common HTML entities that models sometimes emit inside code.
+  // This fixes things like `&amp;&amp;` (should be `&&`) and `&lt;Container&gt;`.
+  // Only decodes the entities we expect in generated TSX.
+  result = result
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, "&");
+
+  // Fix the common model mistake of using `;` as a property separator in object literals.
+  // Replace `;` with `,` only when it looks like `key: value;` followed by another `key:`.
+  // This avoids touching for-loops and other valid `;` usage.
+  result = result.replace(/;(\s*\n\s*[A-Za-z_$][\w$]*\s*:)/g, ",$1");
+
+  return result;
+}
+
+
+export async function POST(req: Request) {
+  const payload = await req.json() as {
+    projectId: string,
+    systemPrompt: string,
+    tools: string[],
+    messages: unknown[],
+    quality?: string,
+    speed?: string,
+  };
+
+  const { projectId, systemPrompt, tools, messages, quality = "smartest", speed = "fast" } = payload;
+
+  const user = await stackServerApp.getUser({ or: "redirect" });
+  const accessToken = await user.getAccessToken();
+
+  const projects = await user.listOwnedProjects();
+  const hasProjectAccess = projects.some((p) => p.id === projectId);
+
+  if (!hasProjectAccess || !accessToken) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 403,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
+  const backendBaseUrl =
+    getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ??
+    getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ??
+    throwErr("Backend API URL is not configured (NEXT_PUBLIC_STACK_API_URL)");
+
+  const backendResponse = await fetch(
+    `${backendBaseUrl}/api/latest/ai/query/generate`,
+    {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-stack-access-type": "admin",
+        "x-stack-project-id": projectId,
+        "x-stack-admin-access-token": accessToken, //TODO not entirely sure
+      },
+      body: JSON.stringify({ quality, speed, systemPrompt, tools, messages }),
+    }
+  );
+
+  if (!backendResponse.ok) {
+    const error = await backendResponse.json().catch(() => ({ error: "Unknown error" }));
+    return new Response(JSON.stringify(error), {
+      status: backendResponse.status,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
+  const result = await backendResponse.json() as { content: Array<{ type: string, args?: { content?: string, [key: string]: unknown }, [key: string]: unknown }> };
+  const sanitized = {
+    content: result.content.map((item) => {
+      if (item.type === "tool-call" && typeof item.args?.content === "string") {
+        return { ...item, args: { ...item.args, content: sanitizeGeneratedCode(item.args.content) } };
+      }
+      return item;
+    }),
+  };
+
+  return new Response(JSON.stringify(sanitized), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index a2480d05ce..918a2a015d 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -12,51 +12,62 @@ const isToolCall = (content: { type: string }): content is ToolCallContent => {
   return content.type === "tool-call";
 };
 
+const CONTEXT_MAP = {
+  "email-theme": { systemPrompt: "email-assistant-theme", tools: ["create-email-theme"] },
+  "email-template": { systemPrompt: "email-wysiwyg-editor", tools: ["create-email-template"] },
+  "email-draft": { systemPrompt: "email-assistant-draft", tools: ["create-email-draft"] },
+} as const;
+
 export function createChatAdapter(
-  adminApp: StackAdminApp,
+  projectId: string,
   threadId: string,
   contextType: "email-theme" | "email-template" | "email-draft",
-  onToolCall: (toolCall: ToolCallContent) => void
+  onToolCall: (toolCall: ToolCallContent) => void,
+  getCurrentSource?: () => string,
 ): ChatModelAdapter {
   return {
     async run({ messages, abortSignal }) {
       try {
         const formattedMessages = [];
         for (const msg of messages) {
-          // Separate tool calls from other content
-          const toolCalls = msg.content.filter(isToolCall);
-          const nonToolContent = msg.content.filter(c => !isToolCall(c));
-          // Only add the message if it has non-tool content
-          if (nonToolContent.length > 0) {
-            formattedMessages.push({
-              role: msg.role,
-              content: nonToolContent
-            });
+          const textContent = msg.content.filter(c => !isToolCall(c));
+          if (textContent.length > 0) {
+            formattedMessages.push({ role: msg.role, content: textContent });
           }
-          // Add tool results as separate messages
-          toolCalls.forEach(toolCall => {
-            formattedMessages.push({
-              role: "tool",
-              content: [{
-                type: "tool-result",
-                toolCallId: toolCall.toolCallId,
-                toolName: toolCall.toolName,
-                result: toolCall.result,
-              }],
-            });
-          });
         }
+        const currentSource = getCurrentSource?.() ?? "";
+        const contextMessages: Array<{ role: "user" | "assistant", content: string }> = currentSource ? [
+          { role: "user", content: `Here is the current source:\n\`\`\`tsx\n${currentSource}\n\`\`\`` },
+          { role: "assistant", content: "Got it. What would you like to change?" },
+        ] : [];
+
+        const { systemPrompt, tools } = CONTEXT_MAP[contextType];
+
+        const response = await fetch("/api/email-ai", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            projectId,
+            systemPrompt,
+            tools: [...tools],
+            messages: [...contextMessages, ...formattedMessages],
+          }),
+          signal: abortSignal,
+        });
+
+        if (!response.ok) {
+          throw new Error(`AI request failed: ${response.status}`);
+        }
+
+        const result: { content: ChatContent } = await response.json();
 
-        const response = await adminApp.sendChatMessage(threadId, contextType, formattedMessages, abortSignal);
-        if (response.content.some(isToolCall)) {
-          const toolCall = response.content.find(isToolCall);
+        if (result.content.some(isToolCall)) {
+          const toolCall = result.content.find(isToolCall);
           if (toolCall) {
             onToolCall(toolCall);
           }
         }
-        return {
-          content: response.content,
-        };
+        return { content: result.content };
       } catch (error) {
         if (abortSignal.aborted) {
           return {};
diff --git a/apps/dashboard/src/components/vibe-coding/draft-tool-components.tsx b/apps/dashboard/src/components/vibe-coding/draft-tool-components.tsx
index 3f0a0f87c8..8a69bbbe53 100644
--- a/apps/dashboard/src/components/vibe-coding/draft-tool-components.tsx
+++ b/apps/dashboard/src/components/vibe-coding/draft-tool-components.tsx
@@ -11,7 +11,7 @@ export const EmailDraftUI = ({ setCurrentCode }: EmailDraftUIProps) => {
     { content: string },
     "success"
   >({
-    toolName: "createEmailTemplate",
+    toolName: "createEmailDraft",
     render: ({ args }) => {
       return (
         <Card className="flex items-center gap-2 p-4 justify-between">
diff --git a/packages/stack-shared/src/interface/admin-interface.ts b/packages/stack-shared/src/interface/admin-interface.ts
index 0c10351d31..9cd597ceea 100644
--- a/packages/stack-shared/src/interface/admin-interface.ts
+++ b/packages/stack-shared/src/interface/admin-interface.ts
@@ -420,28 +420,6 @@ export class StackAdminInterface extends StackServerInterface {
     );
   }
 
-
-  async sendChatMessage(
-    threadId: string,
-    contextType: "email-theme" | "email-template" | "email-draft",
-    messages: Array<{ role: string, content: any }>,
-    abortSignal?: AbortSignal,
-  ): Promise<{ content: ChatContent }> {
-    const response = await this.sendAdminRequest(
-      `/internal/ai-chat/${threadId}`,
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-        },
-        body: JSON.stringify({ context_type: contextType, messages }),
-        signal: abortSignal,
-      },
-      null,
-    );
-    return await response.json();
-  }
-
   async saveChatMessage(threadId: string, message: any): Promise<void> {
     await this.sendAdminRequest(
       `/internal/ai-chat/${threadId}`,
diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index 389f53db74..73bb2774ac 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -25,7 +25,6 @@ import { clientVersion, createCache, getBaseUrl, getDefaultExtraRequestHeaders,
 import { _StackServerAppImplIncomplete } from "./server-app-impl";
 
 import { CompleteConfig, EnvironmentConfigOverrideOverride } from "@stackframe/stack-shared/dist/config/schema";
-import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
 import type { EditableMetadata } from "@stackframe/stack-shared/dist/utils/jsx-editable-transpiler";
 import { branchConfigSourceSchema } from "@stackframe/stack-shared/dist/schema-fields";
 import * as yup from "yup";
@@ -629,16 +628,6 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     }
     await this._adminEmailDraftsCache.refresh([]);
   }
-
-  async sendChatMessage(
-    threadId: string,
-    contextType: "email-theme" | "email-template" | "email-draft",
-    messages: Array<{ role: string, content: any }>,
-    abortSignal?: AbortSignal,
-  ): Promise<{ content: ChatContent }> {
-    return await this._interface.sendChatMessage(threadId, contextType, messages, abortSignal);
-  }
-
   async saveChatMessage(threadId: string, message: any): Promise<void> {
     await this._interface.saveChatMessage(threadId, message);
   }
diff --git a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
index 5e3c6db5f3..4864b43513 100644
--- a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
+++ b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
@@ -1,4 +1,3 @@
-import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
 import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@stackframe/stack-shared/dist/interface/crud/analytics";
 import type { AdminGetSessionReplayChunkEventsResponse, AdminGetSessionReplayAllEventsResponse } from "@stackframe/stack-shared/dist/interface/crud/session-replays";
 import type { Transaction, TransactionType } from "@stackframe/stack-shared/dist/interface/crud/transactions";
@@ -95,13 +94,6 @@ export type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId ext
     createEmailTheme(displayName: string): Promise<{ id: string }>,
     updateEmailTheme(id: string, tsxSource: string): Promise<void>,
     deleteEmailTheme(id: string): Promise<void>,
-
-    sendChatMessage(
-      threadId: string,
-      contextType: "email-theme" | "email-template" | "email-draft",
-      messages: Array<{ role: string, content: any }>,
-      abortSignal?: AbortSignal,
-    ): Promise<{ content: ChatContent }>,
     saveChatMessage(threadId: string, message: any): Promise<void>,
     listChatMessages(threadId: string): Promise<{ messages: Array<any> }>,
     applyWysiwygEdit(options: {

From 592c2c0c17ac23c9f8bbd23d0325ba4e403ab66c Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Thu, 19 Feb 2026 19:32:35 -0800
Subject: [PATCH 04/21] docs ai working

---
 .../app/api/latest/ai/query/[mode]/route.ts   |   7 +-
 apps/backend/src/lib/ai/prompts.ts            |  42 ++-
 docs/package.json                             |   4 +-
 docs/src/app/api/chat/route.ts                | 245 +++---------------
 docs/src/components/chat/ai-chat.tsx          | 158 +++++++----
 5 files changed, 185 insertions(+), 271 deletions(-)

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index dc4f034cdf..c1063d4b05 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -9,7 +9,7 @@ import { yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/sc
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Json } from "@stackframe/stack-shared/dist/utils/json";
-import { ModelMessage, generateText, streamText } from "ai";
+import { ModelMessage, generateText, stepCountIs, streamText } from "ai";
 
 export const POST = createSmartRouteHandler({
   metadata: {
@@ -57,6 +57,9 @@ export const POST = createSmartRouteHandler({
     const tools = await getTools(body.tools as ToolName[], { auth: fullReq.auth });
     const toolsArg = Object.keys(tools).length > 0 ? tools : undefined;
     const messages = body.messages as ModelMessage[];
+    const promptId = body.systemPrompt as SystemPromptId;
+    const isDocsOrSearch = promptId === "docs-ask-ai" || promptId === "command-center-ask-ai";
+    const stepLimit = toolsArg == null ? 1 : isDocsOrSearch ? 50 : 5;
 
     if (mode === "stream") {
       const result = streamText({
@@ -64,6 +67,7 @@ export const POST = createSmartRouteHandler({
         system: systemPrompt,
         messages,
         tools: toolsArg,
+        stopWhen: stepCountIs(stepLimit),
       });
       return {
         statusCode: 200,
@@ -76,6 +80,7 @@ export const POST = createSmartRouteHandler({
         system: systemPrompt,
         messages,
         tools: toolsArg,
+        stopWhen: stepCountIs(stepLimit),
       });
 
       const contentBlocks: Array<
diff --git a/apps/backend/src/lib/ai/prompts.ts b/apps/backend/src/lib/ai/prompts.ts
index c88d936773..45901f8d19 100644
--- a/apps/backend/src/lib/ai/prompts.ts
+++ b/apps/backend/src/lib/ai/prompts.ts
@@ -67,25 +67,27 @@ You are a Stack Auth assistant in a dashboard search bar.
 `,
 
   "docs-ask-ai": `
-## Context: Documentation Assistant
+  # Stack Auth AI Assistant System Prompt
+
+You are Stack Auth's AI assistant. You help users with Stack Auth - a complete authentication and user management solution.
 
 **CRITICAL**: Keep responses SHORT and concise. ALWAYS use the available tools to pull relevant documentation for every question. There should almost never be a question where you don't retrieve relevant docs.
 
 Think step by step about what to say. Being wrong is 100x worse than saying you don't know.
 
-**TOOL USAGE WORKFLOW:**
+## TOOL USAGE WORKFLOW:
 1. **FIRST**, use \`search_docs\` with relevant keywords to find related documentation
 2. **THEN**, use \`get_docs_by_id\` to retrieve the full content of the most relevant pages
 3. Base your answer on the actual documentation content retrieved
 4. When referring to API endpoints, **always cite the actual endpoint** (e.g., "GET /users/me") not the documentation URL
 
-**CORE RESPONSIBILITIES:**
+## CORE RESPONSIBILITIES:
 1. Help users implement Stack Auth in their applications
 2. Answer questions about authentication, user management, and authorization using Stack Auth
 3. Provide guidance on Stack Auth features, configuration, and best practices
 4. Help with framework integrations (Next.js, React, etc.) using Stack Auth
 
-**WHAT TO CONSIDER STACK AUTH-RELATED:**
+## WHAT TO CONSIDER STACK AUTH-RELATED:
 - Authentication implementation in any framework (Next.js, React, etc.)
 - User management, registration, login, logout
 - Session management and security
@@ -96,17 +98,29 @@ Think step by step about what to say. Being wrong is 100x worse than saying you
 - Stack Auth configuration and setup
 - Troubleshooting authentication issues
 
-**RESPONSE FORMAT:**
+## SUPPORT CONTACT INFORMATION:
+When users need personalized support, have complex issues, or ask for help beyond what you can provide from the documentation, direct them to:
+- **Discord Community**: https://discord.stack-auth.com (best for quick questions and community help)
+- **Email Support**: team@stack-auth.com (for technical support and detailed inquiries)
+
+## RESPONSE GUIDELINES:
+1. Be concise and direct. Only provide detailed explanations when specifically requested
+2. For every question, use the available tools to retrieve the most relevant documentation sections
+3. If you're uncertain, say "I don't know" rather than making definitive negative statements
+4. For complex issues or personalized help, suggest Discord or email support
+
+## RESPONSE FORMAT:
 - Use markdown formatting for better readability
 - **ALWAYS include code examples** - Show users how to actually implement solutions
 - Include code blocks with proper syntax highlighting (typescript, bash, etc.)
 - Use bullet points for lists
 - Bold important concepts
 - Provide practical, working examples
+- Focus on giving complete, helpful answers
 - **When referencing documentation, use links with the base URL: https://docs.stack-auth.com**
 - Example: For setup docs, use https://docs.stack-auth.com/docs/getting-started/setup
 
-**CODE EXAMPLE GUIDELINES:**
+## CODE EXAMPLE GUIDELINES:
 - For API calls, show both the HTTP endpoint AND the SDK method
 - For example, when explaining "get current user":
   * Show the HTTP API endpoint: GET /api/v1/users/me
@@ -115,7 +129,7 @@ Think step by step about what to say. Being wrong is 100x worse than saying you
 - Always show complete, runnable code snippets with proper language tags
 - Include context like "HTTP API", "SDK (React)", "SDK (Next.js)" etc.
 
-**STACK AUTH HTTP API HEADERS (CRITICAL):**
+## STACK AUTH HTTP API HEADERS (CRITICAL):
 Stack Auth does NOT use standard "Authorization: Bearer" headers. When showing HTTP/REST API examples, ALWAYS use these Stack Auth-specific headers:
 
 **For client-side requests (browser/mobile):**
@@ -158,19 +172,27 @@ const response = await fetch('https://api.stack-auth.com/api/v1/users/USER_ID',
 
 NEVER show "Authorization: Bearer" for Stack Auth API calls - this is incorrect and will not work.
 
-**WHEN UNSURE:**
+## WHEN UNSURE:
 - If you're unsure about a Stack Auth feature, say "As an AI, I don't know" or "As an AI, I'm not certain" clearly
 - Avoid saying things are "not possible" or "impossible", instead say that you don't know
 - Ask clarifying questions to better understand the user's needs
+- Product to help with related Stack Auth topics that might be useful
 - Provide the best information you can based on your knowledge, but acknowledge limitations
 - If the issue is complex or requires personalized assistance, direct them to Discord or email support
 
-**MANDATORY BEHAVIOR:**
+## KEY STACK AUTH CONCEPTS TO REMEMBER:
+- The core philosophy is complete authentication and user management
+- All features work together - authentication, user management, teams, permissions
+- Built for modern frameworks like Next.js, React, and more
+- Supports multiple authentication methods: OAuth, email/password, magic links
+- Team and permission management for multi-tenant applications
+
+## MANDATORY BEHAVIOR:
 This is not optional - retrieve relevant documentation for every question.
 - Be direct and to the point. Only elaborate when users specifically ask for more detail.
 
 Remember: You're here to help users succeed with Stack Auth. Be helpful but concise, ask questions when needed, always pull relevant docs, and don't hesitate to direct users to support channels when they need additional help.
-`,
+  `,
 
   "email-wysiwyg-editor": `
 You are an expert email designer and senior frontend engineer specializing in react-email and Tailwind CSS.
diff --git a/docs/package.json b/docs/package.json
index 9fe8ed7ffd..9d56fc53e6 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -18,7 +18,7 @@
     "clear-docs": "node scripts/clear-docs.js"
   },
   "dependencies": {
-    "@ai-sdk/react": "^1.2.12",
+    "@ai-sdk/react": "^3.0.0",
     "@openrouter/ai-sdk-provider": "0.7.5",
     "@modelcontextprotocol/sdk": "^1.17.2",
     "@phosphor-icons/react": "^2.1.10",
@@ -31,7 +31,7 @@
     "@stackframe/stack": "workspace:^",
     "@stackframe/stack-shared": "workspace:^",
     "@vercel/mcp-adapter": "^1.0.0",
-    "ai": "^4.3.17",
+    "ai": "^6.0.0",
     "class-variance-authority": "^0.7.1",
     "fumadocs-core": "15.3.3",
     "fumadocs-mdx": "11.6.4",
diff --git a/docs/src/app/api/chat/route.ts b/docs/src/app/api/chat/route.ts
index 788bc41950..475a96068a 100644
--- a/docs/src/app/api/chat/route.ts
+++ b/docs/src/app/api/chat/route.ts
@@ -1,208 +1,49 @@
-import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { createOpenRouter } from '@openrouter/ai-sdk-provider';
-import { experimental_createMCPClient as createMCPClient, streamText } from 'ai';
-
-// Allow streaming responses up to 30 seconds
-export const maxDuration = 30;
-
-// Create OpenRouter AI instance
-const openrouter = createOpenRouter({
-  apiKey: process.env.STACK_OPENROUTER_API_KEY,
-});
-
-// Helper function to get error message
-function getErrorMessage(error: unknown): string {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  return String(error);
-}
+import { stackServerApp } from "@/stack";
+import { convertToModelMessages, UIMessage } from "ai";
 
 export async function POST(request: Request) {
-  const { messages } = await request.json();
-
-  // Create MCP client for Stack Auth documentation with error handling
-  let tools = {};
-  try {
-    // Use local MCP server in development, production server in production
-    const mcpUrl = process.env.NODE_ENV === 'development'
-      ? new URL('/api/internal/mcp', 'http://localhost:8104')
-      : new URL('/api/internal/mcp', 'https://mcp.stack-auth.com');
-
-    const stackAuthMcp = await createMCPClient({
-      transport: new StreamableHTTPClientTransport(mcpUrl),
-    });
-    tools = await stackAuthMcp.tools();
-  } catch (error) {
-    console.error('Failed to initialize MCP client or retrieve tools:', error);
-    return new Response(
-      JSON.stringify({
-        error: 'Documentation service temporarily unavailable',
-        details: 'Our documentation service is currently unreachable. Please try again in a moment, or visit https://docs.stack-auth.com directly for help.',
-      }),
-      {
-        status: 503,
-        headers: { 'Content-Type': 'application/json' },
-      }
-    );
+  const payload = await request.json() as { messages?: UIMessage[] };
+  const messages = Array.isArray(payload.messages) ? payload.messages : [];
+
+  const backendBaseUrl =
+    process.env.NEXT_PUBLIC_STACK_API_URL ??
+    "https://api.stack-auth.com";
+
+  const modelMessages = await convertToModelMessages(messages);
+  const requestHeaders: Record<string, string> = {
+    "content-type": "application/json",
+  };
+
+  const user = await stackServerApp.getUser();
+  if (user != null) {
+    const accessToken = await user.getAccessToken();
+    if (accessToken != null) {
+      requestHeaders["x-stack-access-type"] = "client";
+      requestHeaders["x-stack-access-token"] = accessToken;
+    }
   }
 
-  // Create a comprehensive system prompt that restricts AI to Stack Auth topics
-  const systemPrompt = `
-# Stack Auth AI Assistant System Prompt
-
-You are Stack Auth's AI assistant. You help users with Stack Auth - a complete authentication and user management solution.
-
-**CRITICAL**: Keep responses SHORT and concise. ALWAYS use the available tools to pull relevant documentation for every question. There should almost never be a question where you don't retrieve relevant docs.
-
-Think step by step about what to say. Being wrong is 100x worse than saying you don't know.
-
-## TOOL USAGE WORKFLOW:
-1. **FIRST**, use \`search_docs\` with relevant keywords to find related documentation
-2. **THEN**, use \`get_docs_by_id\` to retrieve the full content of the most relevant pages
-3. Base your answer on the actual documentation content retrieved
-4. When referring to API endpoints, **always cite the actual endpoint** (e.g., "GET /users/me") not the documentation URL
-
-## CORE RESPONSIBILITIES:
-1. Help users implement Stack Auth in their applications
-2. Answer questions about authentication, user management, and authorization using Stack Auth
-3. Provide guidance on Stack Auth features, configuration, and best practices
-4. Help with framework integrations (Next.js, React, etc.) using Stack Auth
-
-## WHAT TO CONSIDER STACK AUTH-RELATED:
-- Authentication implementation in any framework (Next.js, React, etc.)
-- User management, registration, login, logout
-- Session management and security
-- OAuth providers and social auth
-- Database configuration and user data
-- API routes and middleware
-- Authorization and permissions
-- Stack Auth configuration and setup
-- Troubleshooting authentication issues
-
-## SUPPORT CONTACT INFORMATION:
-When users need personalized support, have complex issues, or ask for help beyond what you can provide from the documentation, direct them to:
-- **Discord Community**: https://discord.stack-auth.com (best for quick questions and community help)
-- **Email Support**: team@stack-auth.com (for technical support and detailed inquiries)
-
-## RESPONSE GUIDELINES:
-1. Be concise and direct. Only provide detailed explanations when specifically requested
-2. For every question, use the available tools to retrieve the most relevant documentation sections
-3. If you're uncertain, say "I don't know" rather than making definitive negative statements
-4. For complex issues or personalized help, suggest Discord or email support
-
-## RESPONSE FORMAT:
-- Use markdown formatting for better readability
-- **ALWAYS include code examples** - Show users how to actually implement solutions
-- Include code blocks with proper syntax highlighting (typescript, bash, etc.)
-- Use bullet points for lists
-- Bold important concepts
-- Provide practical, working examples
-- Focus on giving complete, helpful answers
-- **When referencing documentation, use links with the base URL: https://docs.stack-auth.com**
-- Example: For setup docs, use https://docs.stack-auth.com/docs/getting-started/setup
-
-## CODE EXAMPLE GUIDELINES:
-- For API calls, show both the HTTP endpoint AND the SDK method
-- For example, when explaining "get current user":
-  * Show the HTTP API endpoint: GET /api/v1/users/me
-  * Show the SDK usage: const user = useUser();
-  * Include necessary imports and authentication headers
-- Always show complete, runnable code snippets with proper language tags
-- Include context like "HTTP API", "SDK (React)", "SDK (Next.js)" etc.
-
-## STACK AUTH HTTP API HEADERS (CRITICAL):
-Stack Auth does NOT use standard "Authorization: Bearer" headers. When showing HTTP/REST API examples, ALWAYS use these Stack Auth-specific headers:
-
-**For client-side requests (browser/mobile):**
-\`\`\`
-X-Stack-Access-Type: client
-X-Stack-Project-Id: <your-project-id>
-X-Stack-Publishable-Client-Key: <your-publishable-client-key>
-X-Stack-Access-Token: <user-access-token>  // for authenticated requests
-\`\`\`
-
-**For server-side requests (backend):**
-\`\`\`
-X-Stack-Access-Type: server
-X-Stack-Project-Id: <your-project-id>
-X-Stack-Secret-Server-Key: <your-secret-server-key>
-\`\`\`
-
-**Example HTTP request (client-side, authenticated):**
-\`\`\`typescript
-const response = await fetch('https://api.stack-auth.com/api/v1/users/me', {
-  headers: {
-    'X-Stack-Access-Type': 'client',
-    'X-Stack-Project-Id': 'YOUR_PROJECT_ID',
-    'X-Stack-Publishable-Client-Key': 'YOUR_PUBLISHABLE_CLIENT_KEY',
-    'X-Stack-Access-Token': 'USER_ACCESS_TOKEN',
-  },
-});
-\`\`\`
-
-**Example HTTP request (server-side):**
-\`\`\`typescript
-const response = await fetch('https://api.stack-auth.com/api/v1/users/USER_ID', {
-  headers: {
-    'X-Stack-Access-Type': 'server',
-    'X-Stack-Project-Id': 'YOUR_PROJECT_ID',
-    'X-Stack-Secret-Server-Key': 'YOUR_SECRET_SERVER_KEY',
-  },
-});
-\`\`\`
-
-NEVER show "Authorization: Bearer" for Stack Auth API calls - this is incorrect and will not work.
-
-## WHEN UNSURE:
-- If you're unsure about a Stack Auth feature, say "As an AI, I don't know" or "As an AI, I'm not certain" clearly
-- Avoid saying things are "not possible" or "impossible", instead say that you don't know
-- Ask clarifying questions to better understand the user's needs
-- Product to help with related Stack Auth topics that might be useful
-- Provide the best information you can based on your knowledge, but acknowledge limitations
-- If the issue is complex or requires personalized assistance, direct them to Discord or email support
-
-## KEY STACK AUTH CONCEPTS TO REMEMBER:
-- The core philosophy is complete authentication and user management
-- All features work together - authentication, user management, teams, permissions
-- Built for modern frameworks like Next.js, React, and more
-- Supports multiple authentication methods: OAuth, email/password, magic links
-- Team and permission management for multi-tenant applications
-
-## MANDATORY BEHAVIOR:
-This is not optional - retrieve relevant documentation for every question.
-- Be direct and to the point. Only elaborate when users specifically ask for more detail.
-
-Remember: You're here to help users succeed with Stack Auth. Be helpful but concise, ask questions when needed, always pull relevant docs, and don't hesitate to direct users to support channels when they need additional help.
-`;
-
-  try {
-    const result = streamText({
-      model: openrouter('anthropic/claude-4.5-sonnet'),
-      tools: {
-        ...tools,
-      },
-      maxSteps: 50,
-      system: systemPrompt,
-      messages,
-      temperature: 0.3,
-      maxTokens: 4096, // Ensure we have enough tokens for complete responses
-    });
-
-    return result.toDataStreamResponse({
-      getErrorMessage,
-    });
-  } catch (error) {
-    console.error('Chat API Error:', error);
-    return new Response(
-      JSON.stringify({
-        error: 'Failed to process chat request',
-        details: getErrorMessage(error),
+  const backendResponse = await fetch(
+    `${backendBaseUrl}/api/latest/ai/query/stream`,
+    {
+      method: "POST",
+      headers: requestHeaders,
+      body: JSON.stringify({
+        quality: "smart",
+        speed: "fast",
+        systemPrompt: "docs-ask-ai",
+        tools: ["docs"],
+        messages: modelMessages,
       }),
-      {
-        status: 500,
-        headers: { 'Content-Type': 'application/json' },
-      }
-    );
-  }
+    }
+  );
+
+  return new Response(backendResponse.body, {
+    status: backendResponse.status,
+    headers: {
+      "content-type":
+        backendResponse.headers.get("content-type") ?? "text/event-stream",
+      "cache-control": "no-cache",
+    },
+  });
 }
diff --git a/docs/src/components/chat/ai-chat.tsx b/docs/src/components/chat/ai-chat.tsx
index 066be35981..72a30ebd1a 100644
--- a/docs/src/components/chat/ai-chat.tsx
+++ b/docs/src/components/chat/ai-chat.tsx
@@ -1,12 +1,35 @@
 'use client';
 
-import { useChat } from '@ai-sdk/react';
+import { useChat, type UIMessage } from '@ai-sdk/react';
+import { DefaultChatTransport } from 'ai';
 import { runAsynchronously } from '@stackframe/stack-shared/dist/utils/promises';
 import { ChevronDown, ChevronUp, ExternalLink, FileText, Maximize2, Minimize2, Send, X } from 'lucide-react';
 import { useEffect, useRef, useState } from 'react';
 import { useSidebar } from '../layouts/sidebar-context';
 import { MessageFormatter } from './message-formatter';
 
+type ToolInvocationPart = {
+  type: `tool-${string}`,
+  toolCallId: string,
+  state: "input-streaming" | "input-available" | "output-available" | "output-error" | "approval-requested" | "approval-responded" | "output-denied",
+  input: unknown,
+  output?: unknown,
+  errorText?: string,
+};
+
+function getMessageContent(message: UIMessage): string {
+  return message.parts
+    .filter((part): part is { type: "text", text: string } => part.type === "text")
+    .map(part => part.text)
+    .join("");
+}
+
+function getToolInvocations(message: UIMessage): ToolInvocationPart[] {
+  return message.parts
+    .filter((part) => part.type.startsWith("tool-") || part.type === "dynamic-tool")
+    .map((part) => part as unknown as ToolInvocationPart);
+}
+
 // Stack Auth Icon Component (just the icon, not full logo)
 function StackIcon({ size = 20, className }: { size?: number, className?: string }) {
   return (
@@ -335,25 +358,36 @@ export function AIChatDrawer() {
   const topPosition = 'top-3';
   const height = isHomePage && isScrolled ? 'h-[calc(100vh-1.5rem)]' : 'h-[calc(100vh-1.5rem)]';
 
+  const [input, setInput] = useState('');
+
   const {
     messages,
-    input,
-    handleInputChange,
-    handleSubmit,
-    isLoading,
+    sendMessage,
+    status,
     error,
   } = useChat({
-    api: '/api/chat',
-    initialMessages: [],
+    transport: new DefaultChatTransport({ api: '/api/chat' }),
     onError: (error: Error) => {
       console.error('Chat error:', error);
     },
-    onFinish: (message) => {
-      // Send AI response to Discord
-      runAsynchronously(() => sendAIResponseToDiscord(message.content));
+    onFinish: ({ message }: { message: UIMessage }) => {
+      runAsynchronously(() => sendAIResponseToDiscord(getMessageContent(message)));
     },
   });
 
+  const isLoading = status === 'submitted' || status === 'streaming';
+
+  // Debug: log messages, status, and errors
+  useEffect(() => {
+    console.log('[docs-chat] status:', status);
+    console.log('[docs-chat] error:', error);
+    console.log('[docs-chat] messages:', JSON.stringify(messages.map(m => ({
+      id: m.id,
+      role: m.role,
+      parts: m.parts.map(p => ({ type: p.type, ...(p.type === 'text' ? { text: (p as { text: string }).text.slice(0, 100) } : {}) })),
+    })), null, 2));
+  }, [messages, status, error]);
+
   // Auto-scroll to bottom when new messages are added
   useEffect(() => {
     const container = messagesContainerRef.current;
@@ -379,6 +413,14 @@ export function AIChatDrawer() {
     }
   }, [input]);
 
+  const submitMessage = () => {
+    const text = input.trim();
+    if (!text || isLoading) return;
+    setInput('');
+    if (editableRef.current) editableRef.current.textContent = '';
+    runAsynchronously(() => sendMessage({ text }));
+  };
+
   // Function to send AI response to Discord webhook
   const sendAIResponseToDiscord = async (response: string) => {
     try {
@@ -441,8 +483,8 @@ export function AIChatDrawer() {
   };
 
   // Enhanced submit handler that also sends to Discord
-  const handleChatSubmit = async (e: React.FormEvent) => {
-    if (!input.trim()) return;
+  const handleChatSubmit = () => {
+    if (!input.trim() || isLoading) return;
 
     // Update session data
     setSessionData(prev => ({
@@ -453,8 +495,7 @@ export function AIChatDrawer() {
     // Send message to Discord webhook
     runAsynchronously(() => sendToDiscord(input.trim()));
 
-    // Continue with normal chat submission
-    handleSubmit(e);
+    submitMessage();
   };
 
   // Starter prompts for users
@@ -477,13 +518,8 @@ export function AIChatDrawer() {
   ];
 
   const handleStarterPromptClick = (prompt: string) => {
-    // Use the handleInputChange from useChat to update the input
-    handleInputChange({ target: { value: prompt } } as React.ChangeEvent<HTMLInputElement>);
-  };
-
-  // Helper function for safe async event handling
-  const handleSubmitSafely = () => {
-    runAsynchronously(() => handleChatSubmit({} as React.FormEvent));
+    setInput(prompt);
+    if (editableRef.current) editableRef.current.textContent = prompt;
   };
 
   return (
@@ -558,35 +594,51 @@ export function AIChatDrawer() {
             </div>
           </div>
         ) : (
-          messages.map((message) => (
-            <div
-              key={message.id}
-              className={`flex ${
-                message.role === 'user' ? 'justify-end' : 'justify-start'
-              }`}
-            >
+          messages.map((message) => {
+            const messageContent = getMessageContent(message);
+            const toolInvocations = message.role === "assistant" ? getToolInvocations(message) : [];
+
+            if (message.role === "assistant" && !messageContent && toolInvocations.length === 0) {
+              return null;
+            }
+
+            return (
               <div
-                className={`max-w-[85%] p-2 rounded-lg text-xs ${
-                  message.role === 'user'
-                    ? 'bg-fd-primary/10 border border-fd-primary/20 text-fd-foreground'
-                    : 'bg-fd-muted text-fd-foreground border border-fd-border'
+                key={message.id}
+                className={`flex ${
+                  message.role === 'user' ? 'justify-end' : 'justify-start'
                 }`}
               >
-                {message.role === 'user' ? (
-                  <div className="whitespace-pre-wrap break-words">
-                    {message.content}
-                  </div>
-                ) : (
-                  <>
-                    {message.toolInvocations?.map((toolCall, index) => (
-                      <ToolCallDisplay key={index} toolCall={toolCall} />
-                    ))}
-                    <MessageFormatter content={message.content} />
-                  </>
-                )}
+                <div
+                  className={`max-w-[85%] p-2 rounded-lg text-xs ${
+                    message.role === 'user'
+                      ? 'bg-fd-primary/10 border border-fd-primary/20 text-fd-foreground'
+                      : 'bg-fd-muted text-fd-foreground border border-fd-border'
+                  }`}
+                >
+                  {message.role === 'user' ? (
+                    <div className="whitespace-pre-wrap break-words">
+                      {messageContent}
+                    </div>
+                  ) : (
+                    <>
+                      {toolInvocations.map((part, index) => (
+                        <ToolCallDisplay
+                          key={index}
+                          toolCall={{
+                            toolName: part.type === "dynamic-tool" ? (part as unknown as { toolName: string }).toolName : part.type.replace(/^tool-/, ""),
+                            args: part.input as { id?: string, search_query?: string },
+                            result: part.output as { content?: { text: string }[], text?: string } | undefined,
+                          }}
+                        />
+                      ))}
+                      {messageContent && <MessageFormatter content={messageContent} />}
+                    </>
+                  )}
+                </div>
               </div>
-            </div>
-          ))
+            );
+          })
         )}
 
         {isLoading && (
@@ -631,10 +683,7 @@ export function AIChatDrawer() {
                 style={{ lineHeight: "1.4", minHeight: "20px" }}
                 onInput={(e) => {
                   const value = e.currentTarget.textContent || "";
-                  handleInputChange({
-                    target: { value },
-                  } as React.ChangeEvent<HTMLInputElement>);
-
+                  setInput(value);
                   // Clean up the div if it's empty to show placeholder
                   if (!value.trim()) {
                     e.currentTarget.innerHTML = "";
@@ -643,7 +692,7 @@ export function AIChatDrawer() {
                 onKeyDown={(e) => {
                   if (e.key === "Enter" && !e.shiftKey) {
                     e.preventDefault();
-                    handleSubmitSafely();
+                    handleChatSubmit();
                   }
                 }}
                 onPaste={(e) => {
@@ -651,17 +700,14 @@ export function AIChatDrawer() {
                   const text = e.clipboardData.getData("text/plain");
                   e.currentTarget.textContent =
                     (e.currentTarget.textContent || "") + text;
-                  const value = e.currentTarget.textContent;
-                  handleInputChange({
-                    target: { value },
-                  } as React.ChangeEvent<HTMLInputElement>);
+                  setInput(e.currentTarget.textContent || "");
                 }}
                 data-placeholder="Ask about Stack Auth..."
               />
             </div>
             <button
               disabled={!input.trim() || isLoading}
-              onClick={handleSubmitSafely}
+              onClick={handleChatSubmit}
               className="h-8 w-8 rounded-full p-0 shrink-0 bg-fd-primary text-fd-primary-foreground hover:bg-fd-primary/90 disabled:opacity-50 disabled:cursor-not-allowed flex items-center justify-center"
             >
               <Send className="w-4 h-4" />

From bca85476bc752f02c66416c43099a4d72309a7c3 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 23 Feb 2026 16:30:05 -0800
Subject: [PATCH 05/21] bug fix

---
 docs/src/app/api/chat/route.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/src/app/api/chat/route.ts b/docs/src/app/api/chat/route.ts
index 475a96068a..998b52b10f 100644
--- a/docs/src/app/api/chat/route.ts
+++ b/docs/src/app/api/chat/route.ts
@@ -14,11 +14,16 @@ export async function POST(request: Request) {
     "content-type": "application/json",
   };
 
+  const projectId = process.env.NEXT_PUBLIC_STACK_PROJECT_ID;
+  const publishableClientKey = process.env.NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY;
+
   const user = await stackServerApp.getUser();
-  if (user != null) {
+  if (user != null && projectId != null && publishableClientKey != null) {
     const accessToken = await user.getAccessToken();
     if (accessToken != null) {
       requestHeaders["x-stack-access-type"] = "client";
+      requestHeaders["x-stack-project-id"] = projectId;
+      requestHeaders["x-stack-publishable-client-key"] = publishableClientKey;
       requestHeaders["x-stack-access-token"] = accessToken;
     }
   }

From 8dbbf9b3307d7f00ede6bf93e5a3eaeea8c9765f Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 23 Feb 2026 16:34:31 -0800
Subject: [PATCH 06/21] pnpm update

---
 pnpm-lock.yaml | 99 +++++++++-----------------------------------------
 1 file changed, 18 insertions(+), 81 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c464a7c39d..279f1741f4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -722,14 +722,14 @@ importers:
   docs:
     dependencies:
       '@ai-sdk/react':
-        specifier: ^1.2.12
-        version: 1.2.12(react@18.3.1)(zod@3.25.76)
+        specifier: ^3.0.0
+        version: 3.0.83(react@18.3.1)(zod@3.25.76)
       '@modelcontextprotocol/sdk':
         specifier: ^1.17.2
         version: 1.17.2
       '@openrouter/ai-sdk-provider':
         specifier: 0.7.5
-        version: 0.7.5(ai@4.3.17(react@18.3.1)(zod@3.25.76))(zod@3.25.76)
+        version: 0.7.5(ai@6.0.81(zod@3.25.76))(zod@3.25.76)
       '@phosphor-icons/react':
         specifier: ^2.1.10
         version: 2.1.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -761,8 +761,8 @@ importers:
         specifier: ^1.0.0
         version: 1.0.0(@modelcontextprotocol/sdk@1.17.2)(next@15.5.10(@babel/core@7.26.0)(@opentelemetry/api@1.9.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1))
       ai:
-        specifier: ^4.3.17
-        version: 4.3.17(react@18.3.1)(zod@3.25.76)
+        specifier: ^6.0.0
+        version: 6.0.81(zod@3.25.76)
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -2311,16 +2311,6 @@ packages:
     resolution: {integrity: sha512-oGMAgGoQdBXbZqNG0Ze56CHjDZ1IDYOwGYxYjO5KLSlz5HiNQ9udIXsPZ61VWaHGZ5XW/jyjmr6t2xz2jGVwbQ==}
     engines: {node: '>=18'}
 
-  '@ai-sdk/react@1.2.12':
-    resolution: {integrity: sha512-jK1IZZ22evPZoQW3vlkZ7wvjYGYF+tRBKXtrcolduIkQ/m/sOAVcVeVDUDvh1T91xCnWCdUGCPZg2avZ90mv3g==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      react: ^18 || ^19 || ^19.0.0-rc
-      zod: ^3.23.8
-    peerDependenciesMeta:
-      zod:
-        optional: true
-
   '@ai-sdk/react@3.0.83':
     resolution: {integrity: sha512-UsHr+/N0pqGY90BwPFFpWXhY5eVYjNgcWCvSeDMRrzfPvtcd2yqHXlwR7/bveRryVB4NmJ2z6sjyLyOgOHRQdw==}
     engines: {node: '>=18'}
@@ -8657,9 +8647,6 @@ packages:
   '@types/debug@4.1.12':
     resolution: {integrity: sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==}
 
-  '@types/diff-match-patch@1.0.36':
-    resolution: {integrity: sha512-xFdR6tkm0MWvBfO8xXCSsinYxHcqkQUlcHeSpMC2ukzOb6lwQAfDmW+Qt0AvlGd8HpsS28qKsB+oPeJn9I39jg==}
-
   '@types/elliptic@6.4.18':
     resolution: {integrity: sha512-UseG6H5vjRiNpQvrhy4VF/JXdA3V/Fp5amvveaL+fs28BZ6xIKJBPnUPRlEaZpysD9MbpfaLi8lbl7PGUAkpWw==}
 
@@ -9210,16 +9197,6 @@ packages:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
 
-  ai@4.3.17:
-    resolution: {integrity: sha512-uWqIQ94Nb1GTYtYElGHegJMOzv3r2mCKNFlKrqkft9xrfvIahTI5OdcnD5U9612RFGuUNGmSDTO1/YRNFXobaQ==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      react: ^18 || ^19 || ^19.0.0-rc
-      zod: ^3.23.8
-    peerDependenciesMeta:
-      react:
-        optional: true
-
   ai@6.0.81:
     resolution: {integrity: sha512-F9EEhjl2dn1VGS5tbU64ldLbqRemV9X1WHghVblpJlPCWuyYj1xpPQsj+G0TRs/SyAGnbpG1yYpl9mkwfr1H8w==}
     engines: {node: '>=18'}
@@ -10529,9 +10506,6 @@ packages:
   didyoumean@1.2.2:
     resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
 
-  diff-match-patch@1.0.5:
-    resolution: {integrity: sha512-IayShXAgj/QMXgB0IWmKx+rOPuGMhqm5w6jvFxmVenXKIzRqTAAsbBPT3kWQeGANj3jGgvcvv4yK6SxqYmikgw==}
-
   diff-sequences@29.6.3:
     resolution: {integrity: sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -12376,11 +12350,6 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
-  jsondiffpatch@0.6.0:
-    resolution: {integrity: sha512-3QItJOXp2AP1uv7waBkao5nCvhEv+QmJAd38Ybq7wNI74Q+BBmnLn4EDKz6yI9xGAIQoUF87qHt+kc1IVxB4zQ==}
-    engines: {node: ^18.0.0 || >=20.0.0}
-    hasBin: true
-
   jsonfile@4.0.0:
     resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
 
@@ -15653,11 +15622,6 @@ packages:
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
 
-  use-sync-external-store@1.5.0:
-    resolution: {integrity: sha512-Rb46I4cGGVBmjamjphe8L/UnvJD+uPPtTkNvX5mZgqdbavhI4EbgIWJiIHXJ8bc/i9EQGPRh4DwEURJ552Do0A==}
-    peerDependencies:
-      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-
   use-sync-external-store@1.6.0:
     resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
     peerDependencies:
@@ -16307,15 +16271,15 @@ snapshots:
     dependencies:
       json-schema: 0.4.0
 
-  '@ai-sdk/react@1.2.12(react@18.3.1)(zod@3.25.76)':
+  '@ai-sdk/react@3.0.83(react@18.3.1)(zod@3.25.76)':
     dependencies:
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      '@ai-sdk/ui-utils': 1.2.11(zod@3.25.76)
+      '@ai-sdk/provider-utils': 4.0.14(zod@3.25.76)
+      ai: 6.0.81(zod@3.25.76)
       react: 18.3.1
       swr: 2.3.4(react@18.3.1)
       throttleit: 2.1.0
-    optionalDependencies:
-      zod: 3.25.76
+    transitivePeerDependencies:
+      - zod
 
   '@ai-sdk/react@3.0.83(react@19.2.3)(zod@3.25.76)':
     dependencies:
@@ -19109,11 +19073,11 @@ snapshots:
 
   '@one-ini/wasm@0.1.1': {}
 
-  '@openrouter/ai-sdk-provider@0.7.5(ai@4.3.17(react@18.3.1)(zod@3.25.76))(zod@3.25.76)':
+  '@openrouter/ai-sdk-provider@0.7.5(ai@6.0.81(zod@3.25.76))(zod@3.25.76)':
     dependencies:
       '@ai-sdk/provider': 1.1.3
       '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      ai: 4.3.17(react@18.3.1)(zod@3.25.76)
+      ai: 6.0.81(zod@3.25.76)
       zod: 3.25.76
 
   '@openrouter/ai-sdk-provider@2.2.3(ai@6.0.81(zod@3.25.76))(zod@3.25.76)':
@@ -22744,14 +22708,14 @@ snapshots:
   '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@18.3.12)(react@18.3.1)':
     dependencies:
       react: 18.3.1
-      use-sync-external-store: 1.5.0(react@18.3.1)
+      use-sync-external-store: 1.6.0(react@18.3.1)
     optionalDependencies:
       '@types/react': 18.3.12
 
   '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@18.3.12)(react@19.2.3)':
     dependencies:
       react: 19.2.3
-      use-sync-external-store: 1.5.0(react@19.2.3)
+      use-sync-external-store: 1.6.0(react@19.2.3)
     optionalDependencies:
       '@types/react': 18.3.12
 
@@ -24486,8 +24450,6 @@ snapshots:
     dependencies:
       '@types/ms': 2.1.0
 
-  '@types/diff-match-patch@1.0.36': {}
-
   '@types/elliptic@6.4.18':
     dependencies:
       '@types/bn.js': 5.1.5
@@ -25250,18 +25212,6 @@ snapshots:
 
   agent-base@7.1.4: {}
 
-  ai@4.3.17(react@18.3.1)(zod@3.25.76):
-    dependencies:
-      '@ai-sdk/provider': 1.1.3
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      '@ai-sdk/react': 1.2.12(react@18.3.1)(zod@3.25.76)
-      '@ai-sdk/ui-utils': 1.2.11(zod@3.25.76)
-      '@opentelemetry/api': 1.9.0
-      jsondiffpatch: 0.6.0
-      zod: 3.25.76
-    optionalDependencies:
-      react: 18.3.1
-
   ai@6.0.81(zod@3.25.76):
     dependencies:
       '@ai-sdk/gateway': 3.0.41(zod@3.25.76)
@@ -26672,8 +26622,6 @@ snapshots:
 
   didyoumean@1.2.2: {}
 
-  diff-match-patch@1.0.5: {}
-
   diff-sequences@29.6.3: {}
 
   dijkstrajs@1.0.3: {}
@@ -27813,7 +27761,7 @@ snapshots:
 
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.3
+      eventsource-parser: 3.0.6
 
   execa@5.1.1:
     dependencies:
@@ -29364,12 +29312,6 @@ snapshots:
 
   json5@2.2.3: {}
 
-  jsondiffpatch@0.6.0:
-    dependencies:
-      '@types/diff-match-patch': 1.0.36
-      chalk: 5.3.0
-      diff-match-patch: 1.0.5
-
   jsonfile@4.0.0:
     optionalDependencies:
       graceful-fs: 4.2.11
@@ -32998,13 +32940,13 @@ snapshots:
     dependencies:
       dequal: 2.0.3
       react: 18.3.1
-      use-sync-external-store: 1.5.0(react@18.3.1)
+      use-sync-external-store: 1.6.0(react@18.3.1)
 
   swr@2.3.4(react@19.2.3):
     dependencies:
       dequal: 2.0.3
       react: 19.2.3
-      use-sync-external-store: 1.5.0(react@19.2.3)
+      use-sync-external-store: 1.6.0(react@19.2.3)
 
   symbol-tree@3.2.4: {}
 
@@ -33842,18 +33784,13 @@ snapshots:
     dependencies:
       react: 19.2.1
 
-  use-sync-external-store@1.5.0(react@18.3.1):
+  use-sync-external-store@1.6.0(react@18.3.1):
     dependencies:
       react: 18.3.1
 
-  use-sync-external-store@1.5.0(react@19.2.3):
-    dependencies:
-      react: 19.2.3
-
   use-sync-external-store@1.6.0(react@19.2.3):
     dependencies:
       react: 19.2.3
-    optional: true
 
   util-deprecate@1.0.2: {}
 

From 4379976ace2a843b2799c30a7c7edfd9ac6eb789 Mon Sep 17 00:00:00 2001
From: Konstantin Wohlwend <n2d4xc@gmail.com>
Date: Mon, 23 Feb 2026 10:54:04 -0800
Subject: [PATCH 07/21] More stringent caching mitigation

---
 apps/backend/src/app/not-found.tsx | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/apps/backend/src/app/not-found.tsx b/apps/backend/src/app/not-found.tsx
index 6879ab7de6..9efba77133 100644
--- a/apps/backend/src/app/not-found.tsx
+++ b/apps/backend/src/app/not-found.tsx
@@ -1,3 +1,13 @@
-export default function NotFound() {
-  return "Not Found";
+import { connection } from "next/server";
+
+export const dynamic = "force-dynamic";
+export const fetchCache = "force-no-store";
+export const revalidate = 0;
+
+export default async function NotFound() {
+  await connection();  // guarantees we will never prerender
+
+  return <div>
+    404 Not Found
+  </div>;
 }

From 87c18e445e82c94358623fe81553d8fc48a704df Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 23 Feb 2026 18:01:14 -0800
Subject: [PATCH 08/21] minor issues fixed

---
 .../app/api/latest/ai/query/[mode]/route.ts   |  31 +++--
 .../latest/internal/wysiwyg-edit/route.tsx    | 127 ++++++++----------
 apps/backend/src/lib/ai/prompts.ts            |  55 ++++++++
 apps/backend/src/lib/ai/schema.ts             |   3 +
 .../src/lib/ai/tools/create-email-theme.ts    |  47 ++-----
 apps/backend/src/lib/ai/tools/index.ts        |  11 +-
 apps/backend/src/lib/ai/tools/sql-query.ts    |  92 ++++---------
 apps/dashboard/src/app/api/ai-search/route.ts |  17 +--
 .../src/components/commands/ask-ai.tsx        |   2 +-
 .../components/vibe-coding/chat-adapters.ts   |  17 ++-
 .../backend/endpoints/api/v1/ai-query.test.ts |  28 ++--
 docs/src/app/api/chat/route.ts                |  35 +++--
 docs/src/components/chat/ai-chat.tsx          |  32 +----
 13 files changed, 234 insertions(+), 263 deletions(-)

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index c1063d4b05..d01308d66d 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -17,7 +17,7 @@ export const POST = createSmartRouteHandler({
   },
   request: yupObject({
     params: yupObject({
-      mode: yupString().defined(),
+      mode: yupString().oneOf(["stream", "generate"]).defined(),
     }),
     body: requestBodySchema,
   }),
@@ -25,10 +25,6 @@ export const POST = createSmartRouteHandler({
   async handler({ params, body }, fullReq) {
     const { mode } = params;
 
-    if (mode !== "stream" && mode !== "generate") {
-      throw new StatusError(StatusError.BadRequest, `Invalid mode: ${mode}. Must be "stream" or "generate".`);
-    }
-
     if (!validateToolNames(body.tools)) {
       throw new StatusError(StatusError.BadRequest, `Invalid tool names in request.`);
     }
@@ -43,22 +39,26 @@ export const POST = createSmartRouteHandler({
     }
 
     if (apiKey === "FORWARD_TO_PRODUCTION") {
+      const prodResponse = await forwardToProduction(fullReq.headers, mode, body);
       return {
-        statusCode: 200,
+        statusCode: prodResponse.status,
         bodyType: "response" as const,
-        body: await forwardToProduction(fullReq.headers, mode, body),
+        body: prodResponse,
       };
     }
 
     const isAuthenticated = fullReq.auth != null;
+    const quality = body.quality as ModelQuality;
+    const speed = body.speed as ModelSpeed;
+    const systemPromptId = body.systemPrompt as SystemPromptId;
+    const toolNames = body.tools as ToolName[];
 
-    const model = selectModel(body.quality as ModelQuality, body.speed as ModelSpeed, isAuthenticated);
-    const systemPrompt = getFullSystemPrompt(body.systemPrompt as SystemPromptId);
-    const tools = await getTools(body.tools as ToolName[], { auth: fullReq.auth });
+    const model = selectModel(quality, speed, isAuthenticated);
+    const systemPrompt = getFullSystemPrompt(systemPromptId);
+    const tools = await getTools(toolNames, { auth: fullReq.auth });
     const toolsArg = Object.keys(tools).length > 0 ? tools : undefined;
     const messages = body.messages as ModelMessage[];
-    const promptId = body.systemPrompt as SystemPromptId;
-    const isDocsOrSearch = promptId === "docs-ask-ai" || promptId === "command-center-ask-ai";
+    const isDocsOrSearch = systemPromptId === "docs-ask-ai" || systemPromptId === "command-center-ask-ai";
     const stepLimit = toolsArg == null ? 1 : isDocsOrSearch ? 50 : 5;
 
     if (mode === "stream") {
@@ -103,14 +103,19 @@ export const POST = createSmartRouteHandler({
           });
         }
 
+        const toolResultsByCallId = new Map(
+          step.toolResults.map((r) => [r.toolCallId, r])
+        );
+
         step.toolCalls.forEach((toolCall) => {
+          const toolResult = toolResultsByCallId.get(toolCall.toolCallId);
           contentBlocks.push({
             type: "tool-call",
             toolName: toolCall.toolName,
             toolCallId: toolCall.toolCallId,
             args: toolCall.input,
             argsText: JSON.stringify(toolCall.input),
-            result: (toolCall as any).result ?? null,
+            result: (toolResult?.output ?? null) as Json,
           });
         });
       });
diff --git a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx b/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
index 697ab00b87..3e96d0dd91 100644
--- a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
+++ b/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
@@ -1,26 +1,25 @@
+import { forwardToProduction } from "@/lib/ai/forward";
 import { selectModel } from "@/lib/ai/models";
+import { getFullSystemPrompt } from "@/lib/ai/prompts";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { generateText } from "ai";
 
-const WYSIWYG_SYSTEM_PROMPT = `You are an expert at editing React/JSX code. Your task is to update a specific text string in the source code.
-
-RULES:
-1. You will be given the original source code and details about a text edit the user wants to make.
-2. Find the text at the specified location and replace it with the new text.
-3. If there are multiple occurrences of the same text, use the provided location info (line, column, occurrence index) to identify the correct one.
-4. The text you're given is given as plaintext, so you should escape it properly. Be smart about what the user's intent may have been; if it contains eg. an added newline character, that's because the user added a newline character, so depending on the context sometimes you should replace it with <br />, sometimes you should create a new <p>, and sometimes you should do something else. Change it in a good-faith interpretation of what the user may have wanted to do, not in perfect spec-compliance. 
-5. If the text is part of a template literal or JSX expression, only change the static text portion.
-6. Return ONLY the complete updated source code, nothing else.
-7. Do NOT add any explanation, markdown formatting, or code fences - just the raw source code.
-8. Context: The user is editing the text in a WYSIWYG editor. They expect that the change they made will be reflected as-is, without massively the rest of the source code. However, in most cases, the user don't actually care about the rest of the source code, so in the rare cases where things are complex and you would have to change a bit more than just the text node, you should make the changes that sound reasonable from a UX perspective.
-9. If the user added whitespace padding at the very end or the very beginning of the text node, that was probably an accident and you can ignore it.
-
-IMPORTANT:
-- The location info includes: line number, column, source context (lines before/after), JSX path, parent element.
-- Use all available information to find the exact text to replace.
-`;
+const AI_REQUEST_TIMEOUT_MS = 120_000;
+
+function stripCodeFences(code: string): string {
+  if (!code.startsWith("```")) {
+    return code;
+  }
+  const lines = code.split("\n");
+  lines.shift();
+  if (lines[lines.length - 1]?.trim() === "```") {
+    lines.pop();
+  }
+  return lines.join("\n");
+}
 
 const editMetadataSchema = yupObject({
   id: yupString().defined(),
@@ -109,42 +108,13 @@ export const POST = createSmartRouteHandler({
 
     const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
 
-    // Mock mode: no API key configured — perform a simple string replacement without calling AI
-    if (apiKey === "") { //TODO have a special env variable for this
-      let replacedSource: string;
-
-      // Handle edge case: empty old_text can't be meaningfully replaced
-      if (old_text === "") {
-        // Just return original source with the note
-        replacedSource = source_code;
-      } else {
-        // Use occurrence index from metadata to replace the correct occurrence
-        const occurrenceIndex = metadata.occurrenceIndex;
-        const parts = source_code.split(old_text);
-
-        // Validate that the occurrence index is valid (1-based index from metadata)
-        // parts.length - 1 equals the number of occurrences of old_text in source_code
-        if (occurrenceIndex < 1 || occurrenceIndex > parts.length - 1) {
-          // Fallback to first occurrence if index is invalid
-          replacedSource = source_code.replace(old_text, new_text);
-        } else {
-          // Replace only the occurrence at the specified index (convert 1-based to 0-based)
-          const zeroBasedIndex = occurrenceIndex - 1;
-          replacedSource = parts.slice(0, zeroBasedIndex + 1).join(old_text) +
-            new_text +
-            parts.slice(zeroBasedIndex + 1).join(old_text);
-        }
-      }
-
-      const updatedSource = `// NOTE: You haven't specified a STACK_OPENROUTER_API_KEY, so we're using a mock mode where we just replace the old text with the new text instead of calling AI.\n\n${replacedSource}`;
-      return {
-        statusCode: 200,
-        bodyType: "json",
-        body: { updated_source: updatedSource },
-      };
+    if (apiKey === "") {
+      throw new StatusError(
+        StatusError.InternalServerError,
+        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY environment variable."
+      );
     }
 
-    // Build the prompt for the AI
     const userPrompt = `
 ## Source Code to Edit
 \`\`\`tsx
@@ -185,30 +155,45 @@ ${html_context.slice(0, 500)}
 Please update the source code to change "${old_text}" to "${new_text}" at the specified location. Return ONLY the complete updated source code.
 `;
 
-    // This route requires admin auth, so the caller is always authenticated.
-    // "smart" + "fast" is appropriate for surgical text-node replacement.
-    const model = selectModel("smart", "fast", /* isAuthenticated= */ true);
+    if (apiKey === "FORWARD_TO_PRODUCTION") {
+      const prodResponse = await forwardToProduction(fullReq.headers, "generate", {
+        quality: "smart",
+        speed: "fast",
+        systemPrompt: "wysiwyg-edit",
+        tools: [],
+        messages: [{ role: "user", content: userPrompt }],
+      });
+
+      if (!prodResponse.ok) {
+        throw new StatusError(prodResponse.status, `Production AI request failed: ${prodResponse.status}`);
+      }
+
+      const prodResult = await prodResponse.json() as { content?: Array<{ type: string, text?: string }> };
+      const textBlock = Array.isArray(prodResult.content)
+        ? prodResult.content.find((b) => b.type === "text" && b.text)
+        : undefined;
+      const updatedSource = stripCodeFences(textBlock?.text?.trim() ?? source_code);
+
+      return {
+        statusCode: 200,
+        bodyType: "json",
+        body: { updated_source: updatedSource },
+      };
+    }
+
+    const model = selectModel("smart", "fast", true);
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), AI_REQUEST_TIMEOUT_MS);
 
     const result = await generateText({
       model,
-      system: WYSIWYG_SYSTEM_PROMPT,
+      system: getFullSystemPrompt("wysiwyg-edit"),
       messages: [{ role: "user", content: userPrompt }],
-    });
-
-    // Extract the updated source code from the response
-    let updatedSource = result.text.trim();
-
-    // Remove any markdown code fences if the AI added them despite instructions
-    if (updatedSource.startsWith("```")) {
-      const lines = updatedSource.split("\n");
-      // Remove first line (```tsx or similar)
-      lines.shift();
-      // Remove last line if it's ```
-      if (lines[lines.length - 1]?.trim() === "```") {
-        lines.pop();
-      }
-      updatedSource = lines.join("\n");
-    }
+      abortSignal: controller.signal,
+    }).finally(() => clearTimeout(timeoutId));
+
+    const updatedSource = stripCodeFences(result.text.trim());
 
     return {
       statusCode: 200,
diff --git a/apps/backend/src/lib/ai/prompts.ts b/apps/backend/src/lib/ai/prompts.ts
index 45901f8d19..dba9e44541 100644
--- a/apps/backend/src/lib/ai/prompts.ts
+++ b/apps/backend/src/lib/ai/prompts.ts
@@ -34,7 +34,9 @@ For personalized support, complex issues, or help beyond documentation:
 export type SystemPromptId =
   | "command-center-ask-ai"
   | "docs-ask-ai"
+  | "wysiwyg-edit"
   | "email-wysiwyg-editor"
+  | "email-assistant-template"
   | "email-assistant-theme"
   | "email-assistant-draft"
   | "create-dashboard"
@@ -194,6 +196,25 @@ This is not optional - retrieve relevant documentation for every question.
 Remember: You're here to help users succeed with Stack Auth. Be helpful but concise, ask questions when needed, always pull relevant docs, and don't hesitate to direct users to support channels when they need additional help.
   `,
 
+  "wysiwyg-edit": `
+You are an expert at editing React/JSX code. Your task is to update a specific text string in the source code.
+
+RULES:
+1. You will be given the original source code and details about a text edit the user wants to make.
+2. Find the text at the specified location and replace it with the new text.
+3. If there are multiple occurrences of the same text, use the provided location info (line, column, occurrence index) to identify the correct one.
+4. The text you're given is given as plaintext, so you should escape it properly. Be smart about what the user's intent may have been; if it contains eg. an added newline character, that's because the user added a newline character, so depending on the context sometimes you should replace it with <br />, sometimes you should create a new <p>, and sometimes you should do something else. Change it in a good-faith interpretation of what the user may have wanted to do, not in perfect spec-compliance.
+5. If the text is part of a template literal or JSX expression, only change the static text portion.
+6. Return ONLY the complete updated source code, nothing else.
+7. Do NOT add any explanation, markdown formatting, or code fences - just the raw source code.
+8. Context: The user is editing the text in a WYSIWYG editor. They expect that the change they made will be reflected as-is, without massively the rest of the source code. However, in most cases, the user don't actually care about the rest of the source code, so in the rare cases where things are complex and you would have to change a bit more than just the text node, you should make the changes that sound reasonable from a UX perspective.
+9. If the user added whitespace padding at the very end or the very beginning of the text node, that was probably an accident and you can ignore it.
+
+IMPORTANT:
+- The location info includes: line number, column, source context (lines before/after), JSX path, parent element.
+- Use all available information to find the exact text to replace.
+`,
+
   "email-wysiwyg-editor": `
 You are an expert email designer and senior frontend engineer specializing in react-email and Tailwind CSS.
 Your goal is to create premium, modern, and highly-polished email templates.
@@ -225,6 +246,40 @@ RULES:
 11. YOU MUST call the \`createEmailTemplate\` tool with the complete code. NEVER output code directly in the chat.
 12. Output raw TSX source code — NEVER HTML-encode angle brackets. Write \`<Container>\`, not \`&lt;Container&gt;\`.
 13. NEVER use bare & in JSX text content — it is invalid JSX and causes a build error. Use \`&amp;\` or \`{"&"}\` instead.
+`,
+
+  "email-assistant-template": `
+Do not include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
+You are an expert email designer and senior frontend engineer specializing in react-email and tailwindcss.
+Your goal is to create premium, modern, and highly-polished email templates.
+
+The current source code will be provided in the conversation messages. When modifying existing code:
+- Make only the changes the user asked for; preserve everything else exactly as-is
+- If the user's request is ambiguous, make the change that best matches their intent from a UX perspective
+- Do NOT add explanatory comments about what you changed
+- If the user added whitespace at the very start or end of a text node, that was probably accidental — ignore it
+
+DESIGN PRINCIPLES:
+- Clean typography: Use font-sans and appropriate text sizes (text-sm for body, text-2xl/3xl for headings).
+- Balanced spacing: Use generous padding and margins (py-8, gap-4).
+- Modern aesthetics: Use subtle borders, soft shadows (if supported/simulated), and professional color palettes.
+- Mobile-first: Ensure designs look great on small screens.
+- Clarity: The main call-to-action should be prominent.
+
+TECHNICAL RULES:
+- YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL.
+- Always include a <Subject /> component.
+- Always include a <NotificationCategory /> component.
+- Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
+- Use only tailwind classes for styling.
+- Export 'variablesSchema' using arktype.
+- Export 'EmailTemplate' component.
+- Define 'EmailTemplate.PreviewVariables' with realistic example data.
+- Import email components only from \`@react-email/components\`, schema types from \`arktype\`, and Stack Auth helpers from \`@stackframe/emails\` (Subject, NotificationCategory, Props).
+- EVERY component you use in JSX must be explicitly imported. If you use \`<Hr />\`, import \`Hr\`. If you use \`<Img />\`, import \`Img\`. Never use a component without importing it.
+- YOU MUST call the \`createEmailTemplate\` tool with the complete code. NEVER output code directly in the chat.
+- Output raw TSX source code — NEVER HTML-encode angle brackets. Write \`<Container>\`, not \`&lt;Container&gt;\`.
+- NEVER use bare & in JSX text content — it is invalid JSX and causes a build error. Use \`&amp;\` or \`{"&"}\` instead.
 `,
 
   "email-assistant-theme": `
diff --git a/apps/backend/src/lib/ai/schema.ts b/apps/backend/src/lib/ai/schema.ts
index 69c09de022..ed3416953f 100644
--- a/apps/backend/src/lib/ai/schema.ts
+++ b/apps/backend/src/lib/ai/schema.ts
@@ -8,10 +8,13 @@ export const requestBodySchema = yupObject({
   systemPrompt: yupString().oneOf([
     "command-center-ask-ai",
     "docs-ask-ai",
+    "wysiwyg-edit",
     "email-wysiwyg-editor",
+    "email-assistant-template",
     "email-assistant-theme",
     "email-assistant-draft",
     "create-dashboard",
+    "edit-dashboard",
     "run-query",
   ]).defined(),
   messages: yupArray(
diff --git a/apps/backend/src/lib/ai/tools/create-email-theme.ts b/apps/backend/src/lib/ai/tools/create-email-theme.ts
index 5b88b0a6fb..2af8307c25 100644
--- a/apps/backend/src/lib/ai/tools/create-email-theme.ts
+++ b/apps/backend/src/lib/ai/tools/create-email-theme.ts
@@ -14,55 +14,30 @@ export function createEmailThemeTool(auth: SmartRequestAuth | null) {
   return tool({
     description: `
 Create a new email theme.
-
-The email theme is a React component that wraps all emails with a consistent layout.
-
-EXACT PROP SIGNATURE (do not change or add props):
-\`\`\`tsx
-type EmailThemeProps = {
-  children: React.ReactNode,    // required — the email body
-  unsubscribeLink?: string,     // optional URL string — use as href={unsubscribeLink}, NOT as a function call
-}
-\`\`\`
-
-Other requirements:
-- Must include \`<Html>\`, \`<Head>\`, and a \`<Tailwind>\` wrapper (the theme owns the full document)
-- Import ONLY from \`@react-email/components\` — no other packages
-- Use standard Tailwind utility classes in \`className\` props — do NOT pass a \`config\` prop to \`<Tailwind>\`
-- EVERY component used in JSX must be explicitly imported
-- JavaScript object literals use COMMAS between properties, never semicolons
-
-The user's current email theme can be found in the conversation messages.
+The email theme is a React component that is used to render the email theme.
+It must use react-email components.
+It must be exported as a function with name "EmailTheme".
+It must take one prop, children, which is a React node.
+It must not import from any package besides "@react-email/components".
+It uses tailwind classes inside of the <Tailwind> tag.
 
 Here is an example of a valid email theme:
 \`\`\`tsx
-import { Body, Container, Head, Hr, Html, Link, Section, Text, Tailwind } from '@react-email/components'
+import { Container, Head, Html, Tailwind } from '@react-email/components'
 
-export function EmailTheme({ children, unsubscribeLink }: { children: React.ReactNode, unsubscribeLink?: string }) {
+export function EmailTheme({ children }: { children: React.ReactNode }) {
   return (
     <Html>
       <Head />
       <Tailwind>
-        <Body className="bg-gray-50 font-sans">
-          <Container className="mx-auto max-w-[600px] py-8 px-4">
-            <Section className="bg-white rounded-lg shadow-sm p-8">
-              {children}
-            </Section>
-            <Section className="mt-6 text-center">
-              <Hr className="border-gray-200 mb-4" />
-              {unsubscribeLink && (
-                <Text className="text-xs text-gray-400">
-                  <Link href={unsubscribeLink} className="text-gray-400 underline">Unsubscribe</Link>
-                </Text>
-              )}
-            </Section>
-          </Container>
-        </Body>
+        <Container>{children}</Container>
       </Tailwind>
     </Html>
   )
 }
 \`\`\`
+
+The user's current email theme can be found in the conversation messages.
 `,
     inputSchema: z.object({
       content: z.string().describe("The content of the email theme"),
diff --git a/apps/backend/src/lib/ai/tools/index.ts b/apps/backend/src/lib/ai/tools/index.ts
index 40b1da5a13..7275e14162 100644
--- a/apps/backend/src/lib/ai/tools/index.ts
+++ b/apps/backend/src/lib/ai/tools/index.ts
@@ -28,14 +28,8 @@ export async function getTools(
   for (const toolName of toolNames) {
     switch (toolName) {
       case "docs": {
-        // Docs tools come from MCP server - returns multiple tools
-        try {
-          const docsTools = await createDocsTools();
-          Object.assign(tools, docsTools);
-        } catch (error) {
-          console.error("Failed to load docs tools:", error);
-          // Continue without docs tools rather than failing completely
-        }
+        const docsTools = await createDocsTools();
+        Object.assign(tools, docsTools);
         break;
       }
 
@@ -44,7 +38,6 @@ export async function getTools(
         if (sqlTool != null) {
           tools["queryAnalytics"] = sqlTool;
         }
-        // If null (no auth), skip this tool silently
         break;
       }
 
diff --git a/apps/backend/src/lib/ai/tools/sql-query.ts b/apps/backend/src/lib/ai/tools/sql-query.ts
index 8a17f97648..610956bd54 100644
--- a/apps/backend/src/lib/ai/tools/sql-query.ts
+++ b/apps/backend/src/lib/ai/tools/sql-query.ts
@@ -10,78 +10,40 @@ export function createSqlQueryTool(auth: SmartRequestAuth | null) {
   }
 
   return tool({
-    description: `Run a ClickHouse SQL query against the project's analytics database.
-
-**CRITICAL**: Only SELECT queries are allowed. Project filtering is automatic - do not add WHERE project_id = ... clauses.
-
-**Available Tables:**
-
-**events** - User activity events
-- event_type: LowCardinality(String) - $token-refresh is the only valid event_type right now, it occurs whenever an access token is refreshed
-- event_at: DateTime64(3, 'UTC') - When the event occurred
-- data: JSON - Additional event data
-- user_id: Nullable(String) - Associated user ID
-- team_id: Nullable(String) - Associated team ID
-- created_at: DateTime64(3, 'UTC') - When the record was created
-
-**users** - User profiles
-- id: UUID - User ID
-- display_name: Nullable(String) - User's display name
-- primary_email: Nullable(String) - User's primary email
-- primary_email_verified: UInt8 - Whether email is verified (0/1)
-- signed_up_at: DateTime64(3, 'UTC') - When user signed up
-- client_metadata: JSON - Client-side metadata
-- client_read_only_metadata: JSON - Read-only client metadata
-- server_metadata: JSON - Server-side metadata
-- is_anonymous: UInt8 - Whether user is anonymous (0/1)
-
-**Query Guidelines:**
-- Always include LIMIT clause (default to LIMIT 100)
-- Use appropriate date functions: toDate(), toStartOfDay(), toStartOfWeek(), etc.
-- For counting: COUNT(*) or COUNT(DISTINCT column)
-- Only SELECT queries allowed - no DDL/DML
-
-**Example Queries:**
-- Count users: SELECT COUNT(*) FROM users
-- Recent signups: SELECT * FROM users ORDER BY signed_up_at DESC LIMIT 10
-- Events today: SELECT COUNT(*) FROM events WHERE toDate(event_at) = today()
-- Event types: SELECT event_type, COUNT(*) as count FROM events GROUP BY event_type ORDER BY count DESC LIMIT 10`,
+    description: "Run a ClickHouse SQL query against the project's analytics database. Only SELECT queries are allowed. Project filtering is automatic.",
     inputSchema: z.object({
       query: z
         .string()
         .describe("The ClickHouse SQL query to execute. Only SELECT queries are allowed. Always include LIMIT clause."),
     }),
     execute: async ({ query }: { query: string }) => {
-      try {
-        const client = getClickhouseExternalClient();
-        const resultSet = await client.query({
-          query,
-          clickhouse_settings: {
-            SQL_project_id: auth.tenancy.project.id,
-            SQL_branch_id: auth.tenancy.branchId,
-            max_execution_time: 5, // 5 seconds timeout
-            readonly: "1",
-            allow_ddl: 0,
-            max_result_rows: "10000",
-            max_result_bytes: (10 * 1024 * 1024).toString(), // 10MB
-            result_overflow_mode: "throw",
-          },
-          format: "JSONEachRow",
-        });
-
-        const rows = await resultSet.json<Record<string, unknown>[]>();
-
-        return {
-          success: true,
-          rowCount: rows.length,
-          result: rows,
-        };
-      } catch (error) {
-        return {
-          success: false,
+      const client = getClickhouseExternalClient();
+      return await client.query({
+        query,
+        clickhouse_settings: {
+          SQL_project_id: auth.tenancy.project.id,
+          SQL_branch_id: auth.tenancy.branchId,
+          max_execution_time: 5,
+          readonly: "1",
+          allow_ddl: 0,
+          max_result_rows: "10000",
+          max_result_bytes: (10 * 1024 * 1024).toString(),
+          result_overflow_mode: "throw",
+        },
+        format: "JSONEachRow",
+      })
+        .then(async (resultSet) => {
+          const rows = await resultSet.json<Record<string, unknown>[]>();
+          return {
+            success: true as const,
+            rowCount: rows.length,
+            result: rows,
+          };
+        })
+        .catch((error: unknown) => ({
+          success: false as const,
           error: error instanceof Error ? error.message : "Query failed",
-        };
-      }
+        }));
     },
   });
 }
diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
index 1e8216504b..db61fe4129 100644
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ b/apps/dashboard/src/app/api/ai-search/route.ts
@@ -18,7 +18,6 @@ export async function POST(req: Request) {
   const user = await stackServerApp.getUser({ or: "redirect" });
   const accessToken = await user.getAccessToken();
 
-  // Check if the user has admin access to the requested project
   let hasProjectAccess = false;
   if (projectId) {
     const projects = await user.listOwnedProjects();
@@ -29,7 +28,6 @@ export async function POST(req: Request) {
   // so the backend can scope Clickhouse queries to the right project via auth context
   const tools = hasProjectAccess ? ["docs", "sql-query"] : ["docs"];
 
-  // Convert UIMessage[] (sent by useChat) to ModelMessage[] (expected by the backend)
   const modelMessages = await convertToModelMessages(messages);
 
   const backendBaseUrl =
@@ -41,9 +39,7 @@ export async function POST(req: Request) {
     "content-type": "application/json",
   };
 
-  // Pass project admin auth so the backend's sql-query tool can scope queries to this project.
-  // The dashboard user's access token acts as the admin access token for their owned projects
-  // (same mechanism used by StackAdminApp.projectOwnerSession internally).
+
   if (projectId && hasProjectAccess && accessToken) {
     requestHeaders["x-stack-access-type"] = "admin";
     requestHeaders["x-stack-project-id"] = projectId;
@@ -65,9 +61,14 @@ export async function POST(req: Request) {
     }
   );
 
-  // Stream the response directly back to the client.
-  // Only forward safe headers — avoid leaking internal Next.js routing headers
-  // (x-middleware-rewrite etc.) which would cause a NextResponse.rewrite() error.
+  if (!backendResponse.ok) {
+    const error = await backendResponse.json().catch(() => ({ error: "Unknown error" }));
+    return new Response(JSON.stringify(error), {
+      status: backendResponse.status,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
   return new Response(backendResponse.body, {
     status: backendResponse.status,
     headers: {
diff --git a/apps/dashboard/src/components/commands/ask-ai.tsx b/apps/dashboard/src/components/commands/ask-ai.tsx
index 9d35726045..ec8638fe50 100644
--- a/apps/dashboard/src/components/commands/ask-ai.tsx
+++ b/apps/dashboard/src/components/commands/ask-ai.tsx
@@ -180,7 +180,7 @@ const ToolInvocationCard = memo(function ToolInvocationCard({
 
   // Format the tool name for display
   const getToolDisplay = () => {
-    if (toolName === "sql-query" || toolName === "queryAnalytics") {
+    if (toolName === "queryAnalytics") {
       return { label: "Analytics Query", icon: DatabaseIcon };
     }
     return { label: toolName, icon: DatabaseIcon };
diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index 918a2a015d..299da6b5c6 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -14,13 +14,12 @@ const isToolCall = (content: { type: string }): content is ToolCallContent => {
 
 const CONTEXT_MAP = {
   "email-theme": { systemPrompt: "email-assistant-theme", tools: ["create-email-theme"] },
-  "email-template": { systemPrompt: "email-wysiwyg-editor", tools: ["create-email-template"] },
+  "email-template": { systemPrompt: "email-assistant-template", tools: ["create-email-template"] },
   "email-draft": { systemPrompt: "email-assistant-draft", tools: ["create-email-draft"] },
 } as const;
 
 export function createChatAdapter(
   projectId: string,
-  threadId: string,
   contextType: "email-theme" | "email-template" | "email-draft",
   onToolCall: (toolCall: ToolCallContent) => void,
   getCurrentSource?: () => string,
@@ -59,15 +58,15 @@ export function createChatAdapter(
           throw new Error(`AI request failed: ${response.status}`);
         }
 
-        const result: { content: ChatContent } = await response.json();
+        const result = await response.json() as { content?: ChatContent };
+        const content: ChatContent = Array.isArray(result.content) ? result.content : [];
 
-        if (result.content.some(isToolCall)) {
-          const toolCall = result.content.find(isToolCall);
-          if (toolCall) {
-            onToolCall(toolCall);
-          }
+        const toolCall = content.find(isToolCall);
+        if (toolCall) {
+          onToolCall(toolCall);
         }
-        return { content: result.content };
+
+        return { content };
       } catch (error) {
         if (abortSignal.aborted) {
           return {};
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
index 975640de95..05942974b8 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
@@ -1,8 +1,14 @@
 import { describe } from "vitest";
 import { it } from "../../../../helpers";
 import { niceBackendFetch, Project } from "../../../backend-helpers";
-// Note: Since tests run with FORWARD_TO_PRODUCTION, actual AI responses won't be tested.
-// These tests focus on request validation, structure, and error handling.
+import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
+
+const hasRealAiKey = (() => {
+  const key = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
+  return key !== "" && key !== "FORWARD_TO_PRODUCTION";
+})();
+
+const describeWithAi = hasRealAiKey ? describe : describe.skip;
 
 describe("AI Query Endpoint - Validation", () => {
   it("rejects invalid mode in URL", async ({ expect }) => {
@@ -206,7 +212,7 @@ describe("AI Query Endpoint - Validation", () => {
   }, 10000); // 60 seconds for AI API call
 });
 
-describe("AI Query Endpoint - Authentication", () => {
+describeWithAi("AI Query Endpoint - Authentication", () => {
   it("accepts authenticated requests with admin access", async ({ expect }) => {
     await Project.createAndSwitch();
 
@@ -246,7 +252,7 @@ describe("AI Query Endpoint - Authentication", () => {
   }, 10000); // 60 seconds for AI API call
 });
 
-describe("AI Query Endpoint - System Prompts", () => {
+describeWithAi("AI Query Endpoint - System Prompts", () => {
   const systemPrompts = [
     "command-center-ask-ai",
     "docs-ask-ai",
@@ -277,7 +283,7 @@ describe("AI Query Endpoint - System Prompts", () => {
   }
 });
 
-describe("AI Query Endpoint - Tools", () => {
+describeWithAi("AI Query Endpoint - Tools", () => {
   const validTools = [
     "docs",
     "sql-query",
@@ -324,7 +330,7 @@ describe("AI Query Endpoint - Tools", () => {
   }, 10000); // 60 seconds for AI API call
 });
 
-describe("AI Query Endpoint - Mode Handling", () => {
+describeWithAi("AI Query Endpoint - Mode Handling", () => {
   it("stream mode returns response (forwarded to production)", async ({ expect }) => {
     const response = await niceBackendFetch("/api/v1/ai/query/stream", {
       method: "POST",
@@ -362,7 +368,7 @@ describe("AI Query Endpoint - Mode Handling", () => {
   }, 10000); // 60 seconds for AI API call
 });
 
-describe("AI Query Endpoint - Quality and Speed Combinations", () => {
+describeWithAi("AI Query Endpoint - Quality and Speed Combinations", () => {
   const qualities = ["dumb", "smart", "smartest"];
   const speeds = ["slow", "fast"];
 
@@ -388,7 +394,7 @@ describe("AI Query Endpoint - Quality and Speed Combinations", () => {
   }
 });
 
-describe("AI Query Endpoint - Response Structure", () => {
+describeWithAi("AI Query Endpoint - Response Structure", () => {
   it("generate mode returns body with content array", async ({ expect }) => {
     const response = await niceBackendFetch("/api/v1/ai/query/generate", {
       method: "POST",
@@ -424,7 +430,7 @@ describe("AI Query Endpoint - Response Structure", () => {
   }, 10000);
 });
 
-describe("AI Query Endpoint - Message Formats", () => {
+describeWithAi("AI Query Endpoint - Message Formats", () => {
   it("accepts multi-turn conversation (user → assistant → user)", async ({ expect }) => {
     const response = await niceBackendFetch("/api/v1/ai/query/generate", {
       method: "POST",
@@ -504,7 +510,7 @@ describe("AI Query Endpoint - Invalid Message Structure", () => {
   });
 });
 
-describe("AI Query Endpoint - Tool Behavior", () => {
+describeWithAi("AI Query Endpoint - Tool Behavior", () => {
   it("sql-query tool is gracefully omitted when unauthenticated (no error)", async ({ expect }) => {
     // Without auth, createSqlQueryTool returns null and the tool is silently skipped
     const response = await niceBackendFetch("/api/v1/ai/query/generate", {
@@ -551,7 +557,7 @@ describe("AI Query Endpoint - Tool Behavior", () => {
   }, 10000);
 });
 
-describe("AI Query Endpoint - Auth Edge Cases", () => {
+describeWithAi("AI Query Endpoint - Auth Edge Cases", () => {
   it("smartest quality without auth falls back to cheaper model and succeeds", async ({ expect }) => {
     // Unauthenticated + smartest → falls back to x-ai/grok-4.1-fast per model matrix
     const response = await niceBackendFetch("/api/v1/ai/query/generate", {
diff --git a/docs/src/app/api/chat/route.ts b/docs/src/app/api/chat/route.ts
index 998b52b10f..626f7c0668 100644
--- a/docs/src/app/api/chat/route.ts
+++ b/docs/src/app/api/chat/route.ts
@@ -1,4 +1,3 @@
-import { stackServerApp } from "@/stack";
 import { convertToModelMessages, UIMessage } from "ai";
 
 export async function POST(request: Request) {
@@ -10,24 +9,28 @@ export async function POST(request: Request) {
     "https://api.stack-auth.com";
 
   const modelMessages = await convertToModelMessages(messages);
-  const requestHeaders: Record<string, string> = {
-    "content-type": "application/json",
-  };
 
   const projectId = process.env.NEXT_PUBLIC_STACK_PROJECT_ID;
   const publishableClientKey = process.env.NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY;
 
-  const user = await stackServerApp.getUser();
-  if (user != null && projectId != null && publishableClientKey != null) {
-    const accessToken = await user.getAccessToken();
-    if (accessToken != null) {
-      requestHeaders["x-stack-access-type"] = "client";
-      requestHeaders["x-stack-project-id"] = projectId;
-      requestHeaders["x-stack-publishable-client-key"] = publishableClientKey;
-      requestHeaders["x-stack-access-token"] = accessToken;
-    }
+  const requestHeaders: Record<string, string> = {
+    "content-type": "application/json",
+  };
+
+  if (projectId != null && publishableClientKey != null) {
+    requestHeaders["x-stack-access-type"] = "client";
+    requestHeaders["x-stack-project-id"] = projectId;
+    requestHeaders["x-stack-publishable-client-key"] = publishableClientKey;
   }
 
+  const errorResponse = new Response(
+    JSON.stringify({
+      error: "Documentation service temporarily unavailable",
+      details: "Our documentation service is currently unreachable. Please try again in a moment, or visit https://docs.stack-auth.com directly for help.",
+    }),
+    { status: 503, headers: { "content-type": "application/json" } }
+  );
+
   const backendResponse = await fetch(
     `${backendBaseUrl}/api/latest/ai/query/stream`,
     {
@@ -41,7 +44,11 @@ export async function POST(request: Request) {
         messages: modelMessages,
       }),
     }
-  );
+  ).catch(() => errorResponse);
+
+  if (!backendResponse.ok) {
+    return errorResponse;
+  }
 
   return new Response(backendResponse.body, {
     status: backendResponse.status,
diff --git a/docs/src/components/chat/ai-chat.tsx b/docs/src/components/chat/ai-chat.tsx
index 72a30ebd1a..4061b2f8f0 100644
--- a/docs/src/components/chat/ai-chat.tsx
+++ b/docs/src/components/chat/ai-chat.tsx
@@ -1,22 +1,13 @@
 'use client';
 
 import { useChat, type UIMessage } from '@ai-sdk/react';
-import { DefaultChatTransport } from 'ai';
 import { runAsynchronously } from '@stackframe/stack-shared/dist/utils/promises';
+import { DefaultChatTransport, type DynamicToolUIPart } from 'ai';
 import { ChevronDown, ChevronUp, ExternalLink, FileText, Maximize2, Minimize2, Send, X } from 'lucide-react';
 import { useEffect, useRef, useState } from 'react';
 import { useSidebar } from '../layouts/sidebar-context';
 import { MessageFormatter } from './message-formatter';
 
-type ToolInvocationPart = {
-  type: `tool-${string}`,
-  toolCallId: string,
-  state: "input-streaming" | "input-available" | "output-available" | "output-error" | "approval-requested" | "approval-responded" | "output-denied",
-  input: unknown,
-  output?: unknown,
-  errorText?: string,
-};
-
 function getMessageContent(message: UIMessage): string {
   return message.parts
     .filter((part): part is { type: "text", text: string } => part.type === "text")
@@ -24,10 +15,10 @@ function getMessageContent(message: UIMessage): string {
     .join("");
 }
 
-function getToolInvocations(message: UIMessage): ToolInvocationPart[] {
-  return message.parts
-    .filter((part) => part.type.startsWith("tool-") || part.type === "dynamic-tool")
-    .map((part) => part as unknown as ToolInvocationPart);
+function getToolInvocations(message: UIMessage): DynamicToolUIPart[] {
+  return message.parts.filter(
+    (part): part is DynamicToolUIPart => part.type === "dynamic-tool"
+  );
 }
 
 // Stack Auth Icon Component (just the icon, not full logo)
@@ -377,17 +368,6 @@ export function AIChatDrawer() {
 
   const isLoading = status === 'submitted' || status === 'streaming';
 
-  // Debug: log messages, status, and errors
-  useEffect(() => {
-    console.log('[docs-chat] status:', status);
-    console.log('[docs-chat] error:', error);
-    console.log('[docs-chat] messages:', JSON.stringify(messages.map(m => ({
-      id: m.id,
-      role: m.role,
-      parts: m.parts.map(p => ({ type: p.type, ...(p.type === 'text' ? { text: (p as { text: string }).text.slice(0, 100) } : {}) })),
-    })), null, 2));
-  }, [messages, status, error]);
-
   // Auto-scroll to bottom when new messages are added
   useEffect(() => {
     const container = messagesContainerRef.current;
@@ -626,7 +606,7 @@ export function AIChatDrawer() {
                         <ToolCallDisplay
                           key={index}
                           toolCall={{
-                            toolName: part.type === "dynamic-tool" ? (part as unknown as { toolName: string }).toolName : part.type.replace(/^tool-/, ""),
+                            toolName: part.toolName,
                             args: part.input as { id?: string, search_query?: string },
                             result: part.output as { content?: { text: string }[], text?: string } | undefined,
                           }}

From 97dead30079ba0ea07c3d82829cf3c5245a26565 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 23 Feb 2026 18:26:37 -0800
Subject: [PATCH 09/21] minor bug fixes

---
 apps/dashboard/src/components/vibe-coding/chat-adapters.ts | 1 +
 apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index 299da6b5c6..3f09121556 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -20,6 +20,7 @@ const CONTEXT_MAP = {
 
 export function createChatAdapter(
   projectId: string,
+  threadId: string,
   contextType: "email-theme" | "email-template" | "email-draft",
   onToolCall: (toolCall: ToolCallContent) => void,
   getCurrentSource?: () => string,
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
index 05942974b8..fb3e0f2987 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
@@ -25,7 +25,7 @@ describe("AI Query Endpoint - Validation", () => {
     });
 
     expect(response.status).toBe(400);
-    expect(response.body).toEqual(expect.stringContaining("Invalid mode"));
+    expect(response.body).toEqual(expect.stringContaining("must be one of the following values: stream, generate"));
   });
 
   it("rejects missing quality field", async ({ expect }) => {

From c6caf88fdac98d979b1879f976c1679e64649623 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 23 Feb 2026 18:53:37 -0800
Subject: [PATCH 10/21] bug fixes

---
 apps/dashboard/src/app/api/ai-search/route.ts | 52 +++++++++++--------
 .../backend/endpoints/api/v1/ai-query.test.ts |  5 +-
 2 files changed, 34 insertions(+), 23 deletions(-)

diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
index db61fe4129..35f023874a 100644
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ b/apps/dashboard/src/app/api/ai-search/route.ts
@@ -35,31 +35,39 @@ export async function POST(req: Request) {
     getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ??
     throwErr("Backend API URL is not configured (NEXT_PUBLIC_STACK_API_URL)");
 
-  const requestHeaders: Record<string, string> = {
-    "content-type": "application/json",
-  };
-
+  const useAdminAuth = projectId != null && hasProjectAccess && accessToken != null;
 
-  if (projectId && hasProjectAccess && accessToken) {
-    requestHeaders["x-stack-access-type"] = "admin";
-    requestHeaders["x-stack-project-id"] = projectId;
-    requestHeaders["x-stack-admin-access-token"] = accessToken;
-  }
+  const makeRequest = async (withAuth: boolean) => {
+    const requestHeaders: Record<string, string> = {
+      "content-type": "application/json",
+    };
 
-  const backendResponse = await fetch(
-    `${backendBaseUrl}/api/latest/ai/query/stream`,
-    {
-      method: "POST",
-      headers: requestHeaders,
-      body: JSON.stringify({
-        quality: "smart",
-        speed: "fast",
-        tools,
-        systemPrompt: "command-center-ask-ai",
-        messages: modelMessages,
-      }),
+    if (withAuth && projectId != null && accessToken != null) {
+      requestHeaders["x-stack-access-type"] = "admin";
+      requestHeaders["x-stack-project-id"] = projectId;
+      requestHeaders["x-stack-admin-access-token"] = accessToken;
     }
-  );
+
+    return await fetch(
+      `${backendBaseUrl}/api/latest/ai/query/stream`,
+      {
+        method: "POST",
+        headers: requestHeaders,
+        body: JSON.stringify({
+          quality: "smart",
+          speed: "fast",
+          tools: withAuth ? tools : ["docs"],
+          systemPrompt: "command-center-ask-ai",
+          messages: modelMessages,
+        }),
+      }
+    );
+  };
+
+  let backendResponse = await makeRequest(useAdminAuth);
+  if (!backendResponse.ok && useAdminAuth) {
+    backendResponse = await makeRequest(false);
+  }
 
   if (!backendResponse.ok) {
     const error = await backendResponse.json().catch(() => ({ error: "Unknown error" }));
diff --git a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
index fb3e0f2987..364beb7811 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/ai-query.test.ts
@@ -25,7 +25,10 @@ describe("AI Query Endpoint - Validation", () => {
     });
 
     expect(response.status).toBe(400);
-    expect(response.body).toEqual(expect.stringContaining("must be one of the following values: stream, generate"));
+    expect(response.body).toMatchObject({
+      code: "SCHEMA_ERROR",
+      error: expect.stringContaining("must be one of the following values: stream, generate"),
+    });
   });
 
   it("rejects missing quality field", async ({ expect }) => {

From a50240c2f972cf8f10112a66a77991071a643432 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 16:41:00 -0800
Subject: [PATCH 11/21] removed comment

---
 apps/dashboard/src/app/api/email-ai/route.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/dashboard/src/app/api/email-ai/route.ts b/apps/dashboard/src/app/api/email-ai/route.ts
index 05c3a4a5ad..52be15a2c3 100644
--- a/apps/dashboard/src/app/api/email-ai/route.ts
+++ b/apps/dashboard/src/app/api/email-ai/route.ts
@@ -84,7 +84,7 @@ export async function POST(req: Request) {
         "content-type": "application/json",
         "x-stack-access-type": "admin",
         "x-stack-project-id": projectId,
-        "x-stack-admin-access-token": accessToken, //TODO not entirely sure
+        "x-stack-admin-access-token": accessToken,
       },
       body: JSON.stringify({ quality, speed, systemPrompt, tools, messages }),
     }

From e066cac7fd24f0640c575105fb8e1ebf6ba9593b Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 17:34:02 -0800
Subject: [PATCH 12/21] pr review changes

---
 .../app/api/latest/ai/query/[mode]/route.ts   |  4 ++-
 apps/dashboard/src/app/api/email-ai/route.ts  | 28 +++++++++++++++----
 docs/package.json                             |  1 -
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index d01308d66d..02f0bc5a32 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -75,13 +75,15 @@ export const POST = createSmartRouteHandler({
         body: result.toUIMessageStreamResponse(),
       };
     } else {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 120_000);
       const result = await generateText({
         model,
         system: systemPrompt,
         messages,
         tools: toolsArg,
         stopWhen: stepCountIs(stepLimit),
-      });
+      }).finally(() => clearTimeout(timeoutId));
 
       const contentBlocks: Array<
         | { type: "text", text: string }
diff --git a/apps/dashboard/src/app/api/email-ai/route.ts b/apps/dashboard/src/app/api/email-ai/route.ts
index 52be15a2c3..e06a186e14 100644
--- a/apps/dashboard/src/app/api/email-ai/route.ts
+++ b/apps/dashboard/src/app/api/email-ai/route.ts
@@ -47,7 +47,23 @@ function sanitizeGeneratedCode(code: string): string {
 
 
 export async function POST(req: Request) {
-  const payload = await req.json() as {
+  const rawPayload: unknown = await req.json();
+
+  if (
+    typeof rawPayload !== "object" || rawPayload == null ||
+    typeof (rawPayload as Record<string, unknown>).projectId !== "string" ||
+    typeof (rawPayload as Record<string, unknown>).systemPrompt !== "string" ||
+    !Array.isArray((rawPayload as Record<string, unknown>).tools) ||
+    !Array.isArray((rawPayload as Record<string, unknown>).messages)
+  ) {
+    return new Response(JSON.stringify({ error: "Invalid request payload: projectId, systemPrompt, tools, and messages are required" }), {
+      status: 400,
+      headers: { "content-type": "application/json" },
+    });
+  }
+
+  // Safe to destructure after runtime validation above
+  const { projectId, systemPrompt, tools, messages, quality = "smartest", speed = "fast" } = rawPayload as {
     projectId: string,
     systemPrompt: string,
     tools: string[],
@@ -56,15 +72,13 @@ export async function POST(req: Request) {
     speed?: string,
   };
 
-  const { projectId, systemPrompt, tools, messages, quality = "smartest", speed = "fast" } = payload;
-
   const user = await stackServerApp.getUser({ or: "redirect" });
   const accessToken = await user.getAccessToken();
 
   const projects = await user.listOwnedProjects();
   const hasProjectAccess = projects.some((p) => p.id === projectId);
 
-  if (!hasProjectAccess || !accessToken) {
+  if (!hasProjectAccess || accessToken == null) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 403,
       headers: { "content-type": "application/json" },
@@ -98,9 +112,11 @@ export async function POST(req: Request) {
     });
   }
 
-  const result = await backendResponse.json() as { content: Array<{ type: string, args?: { content?: string, [key: string]: unknown }, [key: string]: unknown }> };
+  const result: unknown = await backendResponse.json();
+  const contentArr: Array<{ type: string, args?: { content?: string, [key: string]: unknown }, [key: string]: unknown }> =
+    Array.isArray((result as Record<string, unknown> | null)?.content) ? (result as Record<string, unknown>).content as typeof contentArr : [];
   const sanitized = {
-    content: result.content.map((item) => {
+    content: contentArr.map((item) => {
       if (item.type === "tool-call" && typeof item.args?.content === "string") {
         return { ...item, args: { ...item.args, content: sanitizeGeneratedCode(item.args.content) } };
       }
diff --git a/docs/package.json b/docs/package.json
index 8bd0824d96..bad2069455 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -19,7 +19,6 @@
   },
   "dependencies": {
     "@ai-sdk/react": "^3.0.0",
-    "@openrouter/ai-sdk-provider": "0.7.5",
     "@modelcontextprotocol/sdk": "^1.17.2",
     "@phosphor-icons/react": "^2.1.10",
     "@radix-ui/react-collapsible": "^1.1.11",

From 0c232290613d233bb8112902a935235248a4d701 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 18:17:21 -0800
Subject: [PATCH 13/21] refactoring changes

---
 .../email-drafts/[draftId]/page-client.tsx    |   4 +-
 .../[templateId]/page-client.tsx              |   5 +-
 .../email-themes/[themeId]/page-client.tsx    |   4 +-
 apps/dashboard/src/app/api/ai-search/route.ts |  80 +++--------
 apps/dashboard/src/app/api/email-ai/route.ts  | 131 ------------------
 .../components/vibe-coding/chat-adapters.ts   |  68 ++++++---
 .../src/interface/admin-interface.ts          |  48 +++++++
 .../apps/implementations/admin-app-impl.ts    |  28 ++++
 .../stack-app/apps/interfaces/admin-app.ts    |  17 +++
 9 files changed, 163 insertions(+), 222 deletions(-)
 delete mode 100644 apps/dashboard/src/app/api/email-ai/route.ts

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index c70ce90ac7..6ce35a7c86 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -10,13 +10,11 @@ import { ToolCallContent, createChatAdapter, createHistoryAdapter } from "@/comp
 import { EmailDraftUI } from "@/components/vibe-coding/draft-tool-components";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { Suspense, useCallback, useEffect, useMemo, useState } from "react";
-import { useParams } from "next/navigation";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ draftId }: { draftId: string }) {
   const stackAdminApp = useAdminApp();
-  const { projectId } = useParams() as { projectId: string };
   const { setNeedConfirm } = useRouterConfirm();
   const [saveAlert, setSaveAlert] = useState<{
     variant: "destructive" | "success",
@@ -164,7 +162,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
               chatComponent={
                 <AssistantChat
                   historyAdapter={createHistoryAdapter(stackAdminApp, draftId)}
-                  chatAdapter={createChatAdapter(projectId, draftId, "email-draft", handleToolUpdate, () => currentCode)}
+                  chatAdapter={createChatAdapter(stackAdminApp, draftId, "email-draft", handleToolUpdate, () => currentCode)}
                   toolComponents={<EmailDraftUI setCurrentCode={setCurrentCode} />}
                   useOffWhiteLightMode
                 />
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
index d0a61daea9..0f985a0f94 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
@@ -18,14 +18,13 @@ import { ToolCallContent } from "@/components/vibe-coding/chat-adapters";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useCallback, useEffect, useRef, useState } from "react";
-import { useParams } from "next/navigation";
+
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { PageLayout } from "../../page-layout";
 import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient(props: { templateId: string }) {
   const stackAdminApp = useAdminApp();
-  const { projectId } = useParams() as { projectId: string };
   const templates = stackAdminApp.useEmailTemplates();
   const { setNeedConfirm } = useRouterConfirm();
   const templateFromHook = templates.find((t) => t.id === props.templateId);
@@ -272,7 +271,7 @@ export default function PageClient(props: { templateId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(projectId, template.id, "email-template", handleCodeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(stackAdminApp, template.id, "email-template", handleCodeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, template.id)}
                 toolComponents={<EmailTemplateUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
index 8770ccf378..867fcc4b4b 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
@@ -12,14 +12,12 @@ import {
 import { previewTemplateSource } from "@stackframe/stack-shared/dist/helpers/emails";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { useCallback, useEffect, useState } from "react";
-import { useParams } from "next/navigation";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";
 
 
 export default function PageClient({ themeId }: { themeId: string }) {
   const stackAdminApp = useAdminApp();
-  const { projectId } = useParams() as { projectId: string };
   const theme = stackAdminApp.useEmailTheme(themeId);
   const { setNeedConfirm } = useRouterConfirm();
   const [currentCode, setCurrentCode] = useState(theme.tsxSource);
@@ -126,7 +124,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(projectId, themeId, "email-theme", handleThemeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(stackAdminApp, themeId, "email-theme", handleThemeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, themeId)}
                 toolComponents={<EmailThemeUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
index 35f023874a..af8c769b96 100644
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ b/apps/dashboard/src/app/api/ai-search/route.ts
@@ -1,4 +1,3 @@
-import { getPublicEnvVar } from "@/lib/env";
 import { stackServerApp } from "@/stack";
 import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { convertToModelMessages, UIMessage } from "ai";
@@ -6,7 +5,7 @@ import { convertToModelMessages, UIMessage } from "ai";
 export async function POST(req: Request) {
   const payload = (await req.json()) as { messages?: UIMessage[], projectId?: string | null };
   const messages = Array.isArray(payload.messages) ? payload.messages : [];
-  const projectId = payload.projectId ?? null;
+  const projectId = payload.projectId ?? throwErr("projectId is required for ai-search");
 
   if (messages.length === 0) {
     return new Response(JSON.stringify({ error: "Messages are required" }), {
@@ -16,72 +15,27 @@ export async function POST(req: Request) {
   }
 
   const user = await stackServerApp.getUser({ or: "redirect" });
-  const accessToken = await user.getAccessToken();
-
-  let hasProjectAccess = false;
-  if (projectId) {
-    const projects = await user.listOwnedProjects();
-    hasProjectAccess = projects.some((p) => p.id === projectId);
-  }
-
-  // sql-query is only available when the user has admin access to the project,
-  // so the backend can scope Clickhouse queries to the right project via auth context
-  const tools = hasProjectAccess ? ["docs", "sql-query"] : ["docs"];
+  const projects = await user.listOwnedProjects();
+  const project = projects.find((p) => p.id === projectId);
+  const adminApp = project?.app ?? throwErr("User does not have access to project " + projectId);
 
+  // sql-query is available because the admin app scopes Clickhouse queries to the right project
+  const tools = ["docs", "sql-query"];
   const modelMessages = await convertToModelMessages(messages);
 
-  const backendBaseUrl =
-    getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ??
-    getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ??
-    throwErr("Backend API URL is not configured (NEXT_PUBLIC_STACK_API_URL)");
-
-  const useAdminAuth = projectId != null && hasProjectAccess && accessToken != null;
-
-  const makeRequest = async (withAuth: boolean) => {
-    const requestHeaders: Record<string, string> = {
-      "content-type": "application/json",
-    };
-
-    if (withAuth && projectId != null && accessToken != null) {
-      requestHeaders["x-stack-access-type"] = "admin";
-      requestHeaders["x-stack-project-id"] = projectId;
-      requestHeaders["x-stack-admin-access-token"] = accessToken;
-    }
-
-    return await fetch(
-      `${backendBaseUrl}/api/latest/ai/query/stream`,
-      {
-        method: "POST",
-        headers: requestHeaders,
-        body: JSON.stringify({
-          quality: "smart",
-          speed: "fast",
-          tools: withAuth ? tools : ["docs"],
-          systemPrompt: "command-center-ask-ai",
-          messages: modelMessages,
-        }),
-      }
-    );
-  };
-
-  let backendResponse = await makeRequest(useAdminAuth);
-  if (!backendResponse.ok && useAdminAuth) {
-    backendResponse = await makeRequest(false);
-  }
-
-  if (!backendResponse.ok) {
-    const error = await backendResponse.json().catch(() => ({ error: "Unknown error" }));
-    return new Response(JSON.stringify(error), {
-      status: backendResponse.status,
-      headers: { "content-type": "application/json" },
-    });
-  }
+  const response = await adminApp.sendAiQuery({
+    systemPrompt: "command-center-ask-ai",
+    tools,
+    messages: modelMessages,
+    quality: "smart",
+    speed: "fast",
+    mode: "stream",
+  });
 
-  return new Response(backendResponse.body, {
-    status: backendResponse.status,
+  return new Response(response.body, {
+    status: response.status,
     headers: {
-      "content-type":
-        backendResponse.headers.get("content-type") ?? "text/event-stream",
+      "content-type": response.headers.get("content-type") ?? "text/event-stream",
       "cache-control": "no-cache",
     },
   });
diff --git a/apps/dashboard/src/app/api/email-ai/route.ts b/apps/dashboard/src/app/api/email-ai/route.ts
deleted file mode 100644
index e06a186e14..0000000000
--- a/apps/dashboard/src/app/api/email-ai/route.ts
+++ /dev/null
@@ -1,131 +0,0 @@
-import { getPublicEnvVar } from "@/lib/env";
-import { stackServerApp } from "@/stack";
-import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
-
-/**
- * Sanitizes AI-generated JSX/TSX code before it is applied to the email renderer.
- *
- * Handles four common model output issues:
- * 1. Markdown code fences (```tsx ... ```) wrapping the output despite instructions
- * 2. HTML-encoded angle brackets (&lt;Component&gt; instead of <Component>)
- * 3. Bare & in JSX text content (invalid JSX; must be &amp; or {"&"})
- * 4. Semicolons used as property separators in JS object literals instead of commas
- *    (the AI confuses TypeScript interface syntax with JS object syntax).
- *    TypeScript also accepts commas in interfaces/types, so replacing ; → , is always safe.
- */
-function sanitizeGeneratedCode(code: string): string {
-  let result = code.trim();
-
-  // Strip markdown code fences if the model added them despite instructions.
-  // Handles ```tsx ... ``` and also plain ``` ... ```.
-  if (result.startsWith("```")) {
-    const lines = result.split("\n");
-    lines.shift(); // remove opening ```tsx or similar
-    if (lines[lines.length - 1]?.trim() === "```") {
-      lines.pop(); // remove closing ```
-    }
-    result = lines.join("\n").trim();
-  }
-
-  // Decode common HTML entities that models sometimes emit inside code.
-  // This fixes things like `&amp;&amp;` (should be `&&`) and `&lt;Container&gt;`.
-  // Only decodes the entities we expect in generated TSX.
-  result = result
-    .replace(/&lt;/g, "<")
-    .replace(/&gt;/g, ">")
-    .replace(/&quot;/g, '"')
-    .replace(/&#39;/g, "'")
-    .replace(/&amp;/g, "&");
-
-  // Fix the common model mistake of using `;` as a property separator in object literals.
-  // Replace `;` with `,` only when it looks like `key: value;` followed by another `key:`.
-  // This avoids touching for-loops and other valid `;` usage.
-  result = result.replace(/;(\s*\n\s*[A-Za-z_$][\w$]*\s*:)/g, ",$1");
-
-  return result;
-}
-
-
-export async function POST(req: Request) {
-  const rawPayload: unknown = await req.json();
-
-  if (
-    typeof rawPayload !== "object" || rawPayload == null ||
-    typeof (rawPayload as Record<string, unknown>).projectId !== "string" ||
-    typeof (rawPayload as Record<string, unknown>).systemPrompt !== "string" ||
-    !Array.isArray((rawPayload as Record<string, unknown>).tools) ||
-    !Array.isArray((rawPayload as Record<string, unknown>).messages)
-  ) {
-    return new Response(JSON.stringify({ error: "Invalid request payload: projectId, systemPrompt, tools, and messages are required" }), {
-      status: 400,
-      headers: { "content-type": "application/json" },
-    });
-  }
-
-  // Safe to destructure after runtime validation above
-  const { projectId, systemPrompt, tools, messages, quality = "smartest", speed = "fast" } = rawPayload as {
-    projectId: string,
-    systemPrompt: string,
-    tools: string[],
-    messages: unknown[],
-    quality?: string,
-    speed?: string,
-  };
-
-  const user = await stackServerApp.getUser({ or: "redirect" });
-  const accessToken = await user.getAccessToken();
-
-  const projects = await user.listOwnedProjects();
-  const hasProjectAccess = projects.some((p) => p.id === projectId);
-
-  if (!hasProjectAccess || accessToken == null) {
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 403,
-      headers: { "content-type": "application/json" },
-    });
-  }
-
-  const backendBaseUrl =
-    getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ??
-    getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ??
-    throwErr("Backend API URL is not configured (NEXT_PUBLIC_STACK_API_URL)");
-
-  const backendResponse = await fetch(
-    `${backendBaseUrl}/api/latest/ai/query/generate`,
-    {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        "x-stack-access-type": "admin",
-        "x-stack-project-id": projectId,
-        "x-stack-admin-access-token": accessToken,
-      },
-      body: JSON.stringify({ quality, speed, systemPrompt, tools, messages }),
-    }
-  );
-
-  if (!backendResponse.ok) {
-    const error = await backendResponse.json().catch(() => ({ error: "Unknown error" }));
-    return new Response(JSON.stringify(error), {
-      status: backendResponse.status,
-      headers: { "content-type": "application/json" },
-    });
-  }
-
-  const result: unknown = await backendResponse.json();
-  const contentArr: Array<{ type: string, args?: { content?: string, [key: string]: unknown }, [key: string]: unknown }> =
-    Array.isArray((result as Record<string, unknown> | null)?.content) ? (result as Record<string, unknown>).content as typeof contentArr : [];
-  const sanitized = {
-    content: contentArr.map((item) => {
-      if (item.type === "tool-call" && typeof item.args?.content === "string") {
-        return { ...item, args: { ...item.args, content: sanitizeGeneratedCode(item.args.content) } };
-      }
-      return item;
-    }),
-  };
-
-  return new Response(JSON.stringify(sanitized), {
-    status: 200,
-    headers: { "content-type": "application/json" },
-  });
-}
diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index 3f09121556..12ca4c7a4b 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -12,6 +12,41 @@ const isToolCall = (content: { type: string }): content is ToolCallContent => {
   return content.type === "tool-call";
 };
 
+/**
+ * Sanitizes AI-generated JSX/TSX code before it is applied to the email renderer.
+ *
+ * Handles four common model output issues:
+ * 1. Markdown code fences (```tsx ... ```) wrapping the output despite instructions
+ * 2. HTML-encoded angle brackets (&lt;Component&gt; instead of <Component>)
+ * 3. Bare & in JSX text content (invalid JSX; must be &amp; or {"&"})
+ * 4. Semicolons used as property separators in JS object literals instead of commas
+ *    (the AI confuses TypeScript interface syntax with JS object syntax).
+ *    TypeScript also accepts commas in interfaces/types, so replacing ; → , is always safe.
+ */
+function sanitizeGeneratedCode(code: string): string {
+  let result = code.trim();
+
+  if (result.startsWith("```")) {
+    const lines = result.split("\n");
+    lines.shift();
+    if (lines[lines.length - 1]?.trim() === "```") {
+      lines.pop();
+    }
+    result = lines.join("\n").trim();
+  }
+
+  result = result
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, "&");
+
+  result = result.replace(/;(\s*\n\s*[A-Za-z_$][\w$]*\s*:)/g, ",$1");
+
+  return result;
+}
+
 const CONTEXT_MAP = {
   "email-theme": { systemPrompt: "email-assistant-theme", tools: ["create-email-theme"] },
   "email-template": { systemPrompt: "email-assistant-template", tools: ["create-email-template"] },
@@ -19,8 +54,7 @@ const CONTEXT_MAP = {
 } as const;
 
 export function createChatAdapter(
-  projectId: string,
-  threadId: string,
+  adminApp: StackAdminApp,
   contextType: "email-theme" | "email-template" | "email-draft",
   onToolCall: (toolCall: ToolCallContent) => void,
   getCurrentSource?: () => string,
@@ -43,31 +77,27 @@ export function createChatAdapter(
 
         const { systemPrompt, tools } = CONTEXT_MAP[contextType];
 
-        const response = await fetch("/api/email-ai", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            projectId,
-            systemPrompt,
-            tools: [...tools],
-            messages: [...contextMessages, ...formattedMessages],
-          }),
-          signal: abortSignal,
+        const result = await adminApp.sendAiQuery({
+          systemPrompt,
+          tools: [...tools],
+          messages: [...contextMessages, ...formattedMessages],
         });
 
-        if (!response.ok) {
-          throw new Error(`AI request failed: ${response.status}`);
-        }
-
-        const result = await response.json() as { content?: ChatContent };
         const content: ChatContent = Array.isArray(result.content) ? result.content : [];
 
-        const toolCall = content.find(isToolCall);
+        const sanitizedContent: ChatContent = content.map((item) => {
+          if (item.type === "tool-call" && typeof item.args?.content === "string") {
+            return { ...item, args: { ...item.args, content: sanitizeGeneratedCode(item.args.content) } };
+          }
+          return item;
+        });
+
+        const toolCall = sanitizedContent.find(isToolCall);
         if (toolCall) {
           onToolCall(toolCall);
         }
 
-        return { content };
+        return { content: sanitizedContent };
       } catch (error) {
         if (abortSignal.aborted) {
           return {};
diff --git a/packages/stack-shared/src/interface/admin-interface.ts b/packages/stack-shared/src/interface/admin-interface.ts
index cfb5d9c74d..1764251bc4 100644
--- a/packages/stack-shared/src/interface/admin-interface.ts
+++ b/packages/stack-shared/src/interface/admin-interface.ts
@@ -475,6 +475,54 @@ export class StackAdminInterface extends StackServerInterface {
     return { updatedSource: result.updated_source };
   }
 
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode: "stream",
+  }): Promise<Response>;
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode?: "generate",
+  }): Promise<{ content: ChatContent }>;
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode?: "generate" | "stream",
+  }): Promise<{ content: ChatContent } | Response> {
+    const mode = options.mode ?? "generate";
+    const response = await this.sendAdminRequest(
+      `/ai/query/${mode}`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({
+          systemPrompt: options.systemPrompt,
+          tools: options.tools,
+          messages: options.messages,
+          quality: options.quality ?? "smartest",
+          speed: options.speed ?? "fast",
+        }),
+      },
+      null,
+    );
+    if (mode === "stream") {
+      return response;
+    }
+    return await response.json();
+  }
+
   async renderEmailPreview(options: {
     themeId?: string | null | false,
     themeTsxSource?: string,
diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index 2c73e7c58f..ce16c6aed0 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -667,6 +667,34 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     return await this._interface.applyWysiwygEdit(options);
   }
 
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode: "stream",
+  }): Promise<Response>;
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode?: "generate",
+  }): Promise<{ content: ChatContent }>;
+  async sendAiQuery(options: {
+    systemPrompt: string,
+    tools: string[],
+    messages: Array<{ role: string, content: unknown }>,
+    quality?: string,
+    speed?: string,
+    mode?: "generate" | "stream",
+  }): Promise<{ content: ChatContent } | Response> {
+    // any: overload implementation signature is intentionally broader than individual overloads
+    return (this._interface.sendAiQuery as any)(options);
+  }
+
   async createEmailTheme(displayName: string): Promise<{ id: string }> {
     const result = await this._interface.createEmailTheme(displayName);
     await this._adminEmailThemesCache.refresh([]);
diff --git a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
index 4864b43513..2d4aa4ee63 100644
--- a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
+++ b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
@@ -1,3 +1,4 @@
+import type { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
 import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@stackframe/stack-shared/dist/interface/crud/analytics";
 import type { AdminGetSessionReplayChunkEventsResponse, AdminGetSessionReplayAllEventsResponse } from "@stackframe/stack-shared/dist/interface/crud/session-replays";
 import type { Transaction, TransactionType } from "@stackframe/stack-shared/dist/interface/crud/transactions";
@@ -105,6 +106,22 @@ export type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId ext
       domPath: Array<{ tagName: string, index: number }>,
       htmlContext: string,
     }): Promise<{ updatedSource: string }>,
+    sendAiQuery(options: {
+      systemPrompt: string,
+      tools: string[],
+      messages: Array<{ role: string, content: unknown }>,
+      quality?: string,
+      speed?: string,
+      mode: "stream",
+    }): Promise<Response>,
+    sendAiQuery(options: {
+      systemPrompt: string,
+      tools: string[],
+      messages: Array<{ role: string, content: unknown }>,
+      quality?: string,
+      speed?: string,
+      mode?: "generate",
+    }): Promise<{ content: ChatContent }>,
     updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{ renderedHtml: string }>,
     createEmailTemplate(displayName: string): Promise<{ id: string }>,
     deleteEmailTemplate(id: string): Promise<void>,

From 2b6bd542027f85b0b7a1a91c1c5a08add71d894b Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 18:17:27 -0800
Subject: [PATCH 14/21] pnpm changes

---
 pnpm-lock.yaml | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 279f1741f4..98819f33c0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -727,9 +727,6 @@ importers:
       '@modelcontextprotocol/sdk':
         specifier: ^1.17.2
         version: 1.17.2
-      '@openrouter/ai-sdk-provider':
-        specifier: 0.7.5
-        version: 0.7.5(ai@6.0.81(zod@3.25.76))(zod@3.25.76)
       '@phosphor-icons/react':
         specifier: ^2.1.10
         version: 2.1.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -4890,13 +4887,6 @@ packages:
   '@one-ini/wasm@0.1.1':
     resolution: {integrity: sha512-XuySG1E38YScSJoMlqovLru4KTUNSjgVTIjyh7qMX6aNN5HY5Ct5LhRJdxO79JtTzKfzV/bnWpz+zquYrISsvw==}
 
-  '@openrouter/ai-sdk-provider@0.7.5':
-    resolution: {integrity: sha512-zm8vBhQ+GhxN03Y41xviB0nDa20uN77QnMXsIwDeJPqsul8+KycrYFxY4ulXpumeKxjKyOhfyA7a7CJpcYq2ng==}
-    engines: {node: '>=18'}
-    peerDependencies:
-      ai: ^4.3.17
-      zod: ^3.25.34
-
   '@openrouter/ai-sdk-provider@2.2.3':
     resolution: {integrity: sha512-NovC+BaCfEeJwhToDrs8JeDYXXlJdEyz7lcxkjtyePSE4eoAKik872SyDK0MzXKcz8MRkv7XlNhPI6zz4TQp0g==}
     engines: {node: '>=18'}
@@ -19073,13 +19063,6 @@ snapshots:
 
   '@one-ini/wasm@0.1.1': {}
 
-  '@openrouter/ai-sdk-provider@0.7.5(ai@6.0.81(zod@3.25.76))(zod@3.25.76)':
-    dependencies:
-      '@ai-sdk/provider': 1.1.3
-      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
-      ai: 6.0.81(zod@3.25.76)
-      zod: 3.25.76
-
   '@openrouter/ai-sdk-provider@2.2.3(ai@6.0.81(zod@3.25.76))(zod@3.25.76)':
     dependencies:
       ai: 6.0.81(zod@3.25.76)

From 1b8652b5480c5127dd0807d7e5fff943d1b0d3dd Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 18:36:11 -0800
Subject: [PATCH 15/21] minor changes

---
 .../projects/[projectId]/email-drafts/[draftId]/page-client.tsx | 2 +-
 .../[projectId]/email-templates/[templateId]/page-client.tsx    | 2 +-
 .../projects/[projectId]/email-themes/[themeId]/page-client.tsx | 2 +-
 .../src/lib/stack-app/apps/implementations/admin-app-impl.ts    | 1 -
 4 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index 6ce35a7c86..a222ae72dd 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -162,7 +162,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
               chatComponent={
                 <AssistantChat
                   historyAdapter={createHistoryAdapter(stackAdminApp, draftId)}
-                  chatAdapter={createChatAdapter(stackAdminApp, draftId, "email-draft", handleToolUpdate, () => currentCode)}
+                  chatAdapter={createChatAdapter(stackAdminApp, "email-draft", handleToolUpdate, () => currentCode)}
                   toolComponents={<EmailDraftUI setCurrentCode={setCurrentCode} />}
                   useOffWhiteLightMode
                 />
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
index 0f985a0f94..41eb0f3105 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
@@ -271,7 +271,7 @@ export default function PageClient(props: { templateId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, template.id, "email-template", handleCodeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(stackAdminApp, "email-template", handleCodeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, template.id)}
                 toolComponents={<EmailTemplateUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
index 867fcc4b4b..85b42945a4 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
@@ -124,7 +124,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, themeId, "email-theme", handleThemeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(stackAdminApp, "email-theme", handleThemeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, themeId)}
                 toolComponents={<EmailThemeUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index ce16c6aed0..aac413e711 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -691,7 +691,6 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     speed?: string,
     mode?: "generate" | "stream",
   }): Promise<{ content: ChatContent } | Response> {
-    // any: overload implementation signature is intentionally broader than individual overloads
     return (this._interface.sendAiQuery as any)(options);
   }
 

From a72c5bd756107bc782e9b014a5e729d91d1325b2 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:26:02 -0800
Subject: [PATCH 16/21] add comment

---
 .../lib/stack-app/apps/implementations/admin-app-impl.ts   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index aac413e711..3de88df7b4 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -691,7 +691,12 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     speed?: string,
     mode?: "generate" | "stream",
   }): Promise<{ content: ChatContent } | Response> {
-    return (this._interface.sendAiQuery as any)(options);
+    // TypeScript cannot resolve overload-to-overload delegation for `sendAiQuery` on the interface
+    // (the implementation signature is wider than any single overload).  The cast is safe because
+    // all callers are still validated against the strongly-typed overloads declared above; the `any`
+    // only escapes the internal forwarding call.
+    // eslint-disable-next-line `@typescript-eslint/no-explicit-any` -- see comment above
+    return (this._interface.sendAiQuery as (...args: any[]) => Promise<{ content: ChatContent } | Response>)(options);
   }
 
   async createEmailTheme(displayName: string): Promise<{ id: string }> {

From f2ec37116a4ad0c843b18c1a72d6b299e4a35bce Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Wed, 25 Feb 2026 09:18:55 -0800
Subject: [PATCH 17/21] minor bug fix

---
 .../lib/stack-app/apps/implementations/admin-app-impl.ts   | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index 3de88df7b4..2fb66335d3 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -691,12 +691,7 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     speed?: string,
     mode?: "generate" | "stream",
   }): Promise<{ content: ChatContent } | Response> {
-    // TypeScript cannot resolve overload-to-overload delegation for `sendAiQuery` on the interface
-    // (the implementation signature is wider than any single overload).  The cast is safe because
-    // all callers are still validated against the strongly-typed overloads declared above; the `any`
-    // only escapes the internal forwarding call.
-    // eslint-disable-next-line `@typescript-eslint/no-explicit-any` -- see comment above
-    return (this._interface.sendAiQuery as (...args: any[]) => Promise<{ content: ChatContent } | Response>)(options);
+    return await (this._interface.sendAiQuery as (opts: typeof options) => Promise<{ content: ChatContent } | Response>)(options);
   }
 
   async createEmailTheme(displayName: string): Promise<{ id: string }> {

From 250e00081e47ce2f660c105f01fd1b9708b31bd0 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 9 Mar 2026 11:56:14 -0700
Subject: [PATCH 18/21] pr changes

---
 .../app/api/latest/ai/query/[mode]/route.ts   |  22 +-
 .../latest/internal/wysiwyg-edit/route.tsx    | 204 ------------------
 .../email-drafts/[draftId]/page-client.tsx    |  10 +-
 .../[templateId]/page-client.tsx              |  10 +-
 .../email-themes/[themeId]/page-client.tsx    |   9 +-
 apps/dashboard/src/app/api/ai-search/route.ts |  42 ----
 .../src/components/commands/ask-ai.tsx        |  17 +-
 .../components/vibe-coding/chat-adapters.ts   | 108 +++++++++-
 docs/src/app/api/chat/route.ts                |  61 ------
 docs/src/components/chat/ai-chat.tsx          |  12 +-
 .../src/interface/admin-interface.ts          |  81 -------
 .../apps/implementations/admin-app-impl.ts    |  41 ----
 .../stack-app/apps/interfaces/admin-app.ts    |  27 ---
 13 files changed, 147 insertions(+), 497 deletions(-)
 delete mode 100644 apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
 delete mode 100644 apps/dashboard/src/app/api/ai-search/route.ts
 delete mode 100644 docs/src/app/api/chat/route.ts

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index 02f0bc5a32..2285a19617 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -1,15 +1,15 @@
 import { forwardToProduction } from "@/lib/ai/forward";
-import { selectModel, type ModelQuality, type ModelSpeed } from "@/lib/ai/models";
-import { getFullSystemPrompt, type SystemPromptId } from "@/lib/ai/prompts";
+import { selectModel } from "@/lib/ai/models";
+import { getFullSystemPrompt } from "@/lib/ai/prompts";
 import { requestBodySchema } from "@/lib/ai/schema";
-import { getTools, validateToolNames, type ToolName } from "@/lib/ai/tools";
+import { getTools, validateToolNames } from "@/lib/ai/tools";
 import { SmartResponse } from "@/route-handlers/smart-response";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Json } from "@stackframe/stack-shared/dist/utils/json";
-import { ModelMessage, generateText, stepCountIs, streamText } from "ai";
+import { generateText, stepCountIs, streamText } from "ai";
 
 export const POST = createSmartRouteHandler({
   metadata: {
@@ -29,14 +29,8 @@ export const POST = createSmartRouteHandler({
       throw new StatusError(StatusError.BadRequest, `Invalid tool names in request.`);
     }
 
-    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
+    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY");
 
-    if (apiKey === "") {
-      throw new StatusError(
-        StatusError.InternalServerError,
-        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY environment variable."
-      );
-    }
 
     if (apiKey === "FORWARD_TO_PRODUCTION") {
       const prodResponse = await forwardToProduction(fullReq.headers, mode, body);
@@ -48,16 +42,12 @@ export const POST = createSmartRouteHandler({
     }
 
     const isAuthenticated = fullReq.auth != null;
-    const quality = body.quality as ModelQuality;
-    const speed = body.speed as ModelSpeed;
-    const systemPromptId = body.systemPrompt as SystemPromptId;
-    const toolNames = body.tools as ToolName[];
+    const { quality, speed, systemPrompt: systemPromptId, tools: toolNames, messages } = body;
 
     const model = selectModel(quality, speed, isAuthenticated);
     const systemPrompt = getFullSystemPrompt(systemPromptId);
     const tools = await getTools(toolNames, { auth: fullReq.auth });
     const toolsArg = Object.keys(tools).length > 0 ? tools : undefined;
-    const messages = body.messages as ModelMessage[];
     const isDocsOrSearch = systemPromptId === "docs-ask-ai" || systemPromptId === "command-center-ask-ai";
     const stepLimit = toolsArg == null ? 1 : isDocsOrSearch ? 50 : 5;
 
diff --git a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx b/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
deleted file mode 100644
index 3e96d0dd91..0000000000
--- a/apps/backend/src/app/api/latest/internal/wysiwyg-edit/route.tsx
+++ /dev/null
@@ -1,204 +0,0 @@
-import { forwardToProduction } from "@/lib/ai/forward";
-import { selectModel } from "@/lib/ai/models";
-import { getFullSystemPrompt } from "@/lib/ai/prompts";
-import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
-import { adaptSchema, yupArray, yupMixed, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
-import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
-import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
-import { generateText } from "ai";
-
-const AI_REQUEST_TIMEOUT_MS = 120_000;
-
-function stripCodeFences(code: string): string {
-  if (!code.startsWith("```")) {
-    return code;
-  }
-  const lines = code.split("\n");
-  lines.shift();
-  if (lines[lines.length - 1]?.trim() === "```") {
-    lines.pop();
-  }
-  return lines.join("\n");
-}
-
-const editMetadataSchema = yupObject({
-  id: yupString().defined(),
-  loc: yupObject({
-    start: yupNumber().defined(),
-    end: yupNumber().defined(),
-    line: yupNumber().defined(),
-    column: yupNumber().defined(),
-  }).defined(),
-  originalText: yupString().defined(),
-  textHash: yupString().defined(),
-  jsxPath: yupArray(yupString().defined()).defined(),
-  parentElement: yupObject({
-    tagName: yupString().defined(),
-    props: yupMixed().defined(),
-  }).defined(),
-  sourceContext: yupObject({
-    before: yupString().defined(),
-    after: yupString().defined(),
-  }).defined(),
-  siblingIndex: yupNumber().defined(),
-  occurrenceCount: yupNumber().defined(),
-  occurrenceIndex: yupNumber().defined(),
-  sourceFile: yupString().oneOf(["template", "theme"]).defined(),
-});
-
-const domPathItemSchema = yupObject({
-  tag_name: yupString().defined(),
-  index: yupNumber().defined(),
-});
-
-export const POST = createSmartRouteHandler({
-  metadata: {
-    summary: "Apply WYSIWYG text edit",
-    description: "Uses AI to update source code based on a WYSIWYG text edit",
-    tags: ["Internal", "AI"],
-    hidden: true,
-  },
-  request: yupObject({
-    auth: yupObject({
-      type: yupString().oneOf(["admin"]).defined(),
-      tenancy: adaptSchema.defined(),
-    }).defined(),
-    body: yupObject({
-      /** The type of source being edited */
-      source_type: yupString().oneOf(["template", "theme", "draft"]).defined(),
-      /** The current source code to edit */
-      source_code: yupString().defined(),
-      /** The original text that was in the editable region */
-      old_text: yupString().defined(),
-      /** The new text the user wants */
-      new_text: yupString().defined(),
-      /** Metadata from the editable region for locating the text */
-      metadata: editMetadataSchema.defined(),
-      /** DOM path from the iframe for additional context */
-      dom_path: yupArray(domPathItemSchema.defined()).defined(),
-      /** HTML context from the rendered output */
-      html_context: yupString().defined(),
-    }).defined(),
-  }),
-  response: yupObject({
-    statusCode: yupNumber().oneOf([200]).defined(),
-    bodyType: yupString().oneOf(["json"]).defined(),
-    body: yupObject({
-      updated_source: yupString().defined(),
-    }).defined(),
-  }),
-  async handler({ body }, fullReq) {
-    const {
-      source_code,
-      old_text,
-      new_text,
-      metadata,
-      dom_path,
-      html_context,
-    } = body;
-
-    // If no change, return original
-    if (old_text === new_text) {
-      return {
-        statusCode: 200,
-        bodyType: "json",
-        body: { updated_source: source_code },
-      };
-    }
-
-    const apiKey = getEnvVariable("STACK_OPENROUTER_API_KEY", "");
-
-    if (apiKey === "") {
-      throw new StatusError(
-        StatusError.InternalServerError,
-        "OpenRouter API key is not configured. Please set STACK_OPENROUTER_API_KEY environment variable."
-      );
-    }
-
-    const userPrompt = `
-## Source Code to Edit
-\`\`\`tsx
-${source_code}
-\`\`\`
-
-## Edit Request
-- **Old text:** "${old_text}"
-- **New text:** "${new_text}"
-
-## Location Information
-- **Line:** ${metadata.loc.line}
-- **Column:** ${metadata.loc.column}
-- **JSX Path:** ${metadata.jsxPath.join(" > ")}
-- **Parent Element:** <${metadata.parentElement.tagName}>
-- **Sibling Index:** ${metadata.siblingIndex}
-- **Occurrence:** ${metadata.occurrenceIndex} of ${metadata.occurrenceCount}
-
-## Source Context (lines around the text)
-Before:
-\`\`\`
-${metadata.sourceContext.before}
-\`\`\`
-
-After:
-\`\`\`
-${metadata.sourceContext.after}
-\`\`\`
-
-## Runtime DOM Path (for disambiguation)
-${dom_path.map((p, i) => `${i + 1}. <${p.tag_name}> (index: ${p.index})`).join("\n")}
-
-## Rendered HTML Context
-\`\`\`html
-${html_context.slice(0, 500)}
-\`\`\`
-
-Please update the source code to change "${old_text}" to "${new_text}" at the specified location. Return ONLY the complete updated source code.
-`;
-
-    if (apiKey === "FORWARD_TO_PRODUCTION") {
-      const prodResponse = await forwardToProduction(fullReq.headers, "generate", {
-        quality: "smart",
-        speed: "fast",
-        systemPrompt: "wysiwyg-edit",
-        tools: [],
-        messages: [{ role: "user", content: userPrompt }],
-      });
-
-      if (!prodResponse.ok) {
-        throw new StatusError(prodResponse.status, `Production AI request failed: ${prodResponse.status}`);
-      }
-
-      const prodResult = await prodResponse.json() as { content?: Array<{ type: string, text?: string }> };
-      const textBlock = Array.isArray(prodResult.content)
-        ? prodResult.content.find((b) => b.type === "text" && b.text)
-        : undefined;
-      const updatedSource = stripCodeFences(textBlock?.text?.trim() ?? source_code);
-
-      return {
-        statusCode: 200,
-        bodyType: "json",
-        body: { updated_source: updatedSource },
-      };
-    }
-
-    const model = selectModel("smart", "fast", true);
-
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), AI_REQUEST_TIMEOUT_MS);
-
-    const result = await generateText({
-      model,
-      system: getFullSystemPrompt("wysiwyg-edit"),
-      messages: [{ role: "user", content: userPrompt }],
-      abortSignal: controller.signal,
-    }).finally(() => clearTimeout(timeoutId));
-
-    const updatedSource = stripCodeFences(result.text.trim());
-
-    return {
-      statusCode: 200,
-      bodyType: "json",
-      body: { updated_source: updatedSource },
-    };
-  },
-});
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index a222ae72dd..cfdc854481 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -6,8 +6,9 @@ import { EmailThemeSelector } from "@/components/email-theme-selector";
 import { useRouterConfirm } from "@/components/router";
 import { Alert, AlertDescription, AlertTitle, Badge, Button, Card, CardContent, Select, SelectContent, SelectItem, SelectTrigger, SelectValue, Skeleton, Typography } from "@/components/ui";
 import { AssistantChat, CodeEditor, VibeCodeLayout, type ViewportMode, type WysiwygDebugInfo } from "@/components/vibe-coding";
-import { ToolCallContent, createChatAdapter, createHistoryAdapter } from "@/components/vibe-coding/chat-adapters";
+import { ToolCallContent, applyWysiwygEdit, createChatAdapter, createHistoryAdapter } from "@/components/vibe-coding/chat-adapters";
 import { EmailDraftUI } from "@/components/vibe-coding/draft-tool-components";
+import { getPublicEnvVar } from "@/lib/env";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { Suspense, useCallback, useEffect, useMemo, useState } from "react";
 import { AppEnabledGuard } from "../../app-enabled-guard";
@@ -15,6 +16,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ draftId }: { draftId: string }) {
   const stackAdminApp = useAdminApp();
+  const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const { setNeedConfirm } = useRouterConfirm();
   const [saveAlert, setSaveAlert] = useState<{
     variant: "destructive" | "success",
@@ -92,7 +94,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
 
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
-    const result = await stackAdminApp.applyWysiwygEdit({
+    const result = await applyWysiwygEdit(backendBaseUrl, {
       sourceType: 'draft',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -103,7 +105,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [stackAdminApp, currentCode]);
+  }, [backendBaseUrl, currentCode]);
 
   return (
     <AppEnabledGuard appId="emails">
@@ -162,7 +164,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
               chatComponent={
                 <AssistantChat
                   historyAdapter={createHistoryAdapter(stackAdminApp, draftId)}
-                  chatAdapter={createChatAdapter(stackAdminApp, "email-draft", handleToolUpdate, () => currentCode)}
+                  chatAdapter={createChatAdapter(backendBaseUrl, "email-draft", handleToolUpdate, () => currentCode)}
                   toolComponents={<EmailDraftUI setCurrentCode={setCurrentCode} />}
                   useOffWhiteLightMode
                 />
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
index 41eb0f3105..68f0e22b9b 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
@@ -14,7 +14,8 @@ import {
   type ViewportMode,
   type WysiwygDebugInfo,
 } from "@/components/vibe-coding";
-import { ToolCallContent } from "@/components/vibe-coding/chat-adapters";
+import { applyWysiwygEdit, ToolCallContent } from "@/components/vibe-coding/chat-adapters";
+import { getPublicEnvVar } from "@/lib/env";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useCallback, useEffect, useRef, useState } from "react";
@@ -25,6 +26,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient(props: { templateId: string }) {
   const stackAdminApp = useAdminApp();
+  const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const templates = stackAdminApp.useEmailTemplates();
   const { setNeedConfirm } = useRouterConfirm();
   const templateFromHook = templates.find((t) => t.id === props.templateId);
@@ -146,7 +148,7 @@ export default function PageClient(props: { templateId: string }) {
 
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
-    const result = await stackAdminApp.applyWysiwygEdit({
+    const result = await applyWysiwygEdit(backendBaseUrl, {
       sourceType: 'template',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -157,7 +159,7 @@ export default function PageClient(props: { templateId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [stackAdminApp, currentCode]);
+  }, [backendBaseUrl, currentCode]);
 
   if (!template) {
     // Show loading state while waiting for the template (either from hook or direct fetch)
@@ -271,7 +273,7 @@ export default function PageClient(props: { templateId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, "email-template", handleCodeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(backendBaseUrl, "email-template", handleCodeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, template.id)}
                 toolComponents={<EmailTemplateUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
index 85b42945a4..3976a9e041 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
@@ -5,10 +5,12 @@ import { useRouterConfirm } from "@/components/router";
 import { Alert, AlertDescription, AlertTitle } from "@/components/ui";
 import { AssistantChat, CodeEditor, EmailThemeUI, VibeCodeLayout, type ViewportMode, type WysiwygDebugInfo } from "@/components/vibe-coding";
 import {
+  applyWysiwygEdit,
   createChatAdapter,
   createHistoryAdapter,
   ToolCallContent
 } from "@/components/vibe-coding/chat-adapters";
+import { getPublicEnvVar } from "@/lib/env";
 import { previewTemplateSource } from "@stackframe/stack-shared/dist/helpers/emails";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { useCallback, useEffect, useState } from "react";
@@ -18,6 +20,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ themeId }: { themeId: string }) {
   const stackAdminApp = useAdminApp();
+  const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const theme = stackAdminApp.useEmailTheme(themeId);
   const { setNeedConfirm } = useRouterConfirm();
   const [currentCode, setCurrentCode] = useState(theme.tsxSource);
@@ -31,7 +34,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
 
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
-    const result = await stackAdminApp.applyWysiwygEdit({
+    const result = await applyWysiwygEdit(backendBaseUrl, {
       sourceType: 'theme',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -42,7 +45,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [stackAdminApp, currentCode]);
+  }, [backendBaseUrl, currentCode]);
 
   useEffect(() => {
     if (theme.tsxSource === currentCode) return;
@@ -124,7 +127,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(stackAdminApp, "email-theme", handleThemeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(backendBaseUrl, "email-theme", handleThemeUpdate, () => currentCode)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, themeId)}
                 toolComponents={<EmailThemeUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/api/ai-search/route.ts b/apps/dashboard/src/app/api/ai-search/route.ts
deleted file mode 100644
index af8c769b96..0000000000
--- a/apps/dashboard/src/app/api/ai-search/route.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-import { stackServerApp } from "@/stack";
-import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
-import { convertToModelMessages, UIMessage } from "ai";
-
-export async function POST(req: Request) {
-  const payload = (await req.json()) as { messages?: UIMessage[], projectId?: string | null };
-  const messages = Array.isArray(payload.messages) ? payload.messages : [];
-  const projectId = payload.projectId ?? throwErr("projectId is required for ai-search");
-
-  if (messages.length === 0) {
-    return new Response(JSON.stringify({ error: "Messages are required" }), {
-      status: 400,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  const user = await stackServerApp.getUser({ or: "redirect" });
-  const projects = await user.listOwnedProjects();
-  const project = projects.find((p) => p.id === projectId);
-  const adminApp = project?.app ?? throwErr("User does not have access to project " + projectId);
-
-  // sql-query is available because the admin app scopes Clickhouse queries to the right project
-  const tools = ["docs", "sql-query"];
-  const modelMessages = await convertToModelMessages(messages);
-
-  const response = await adminApp.sendAiQuery({
-    systemPrompt: "command-center-ask-ai",
-    tools,
-    messages: modelMessages,
-    quality: "smart",
-    speed: "fast",
-    mode: "stream",
-  });
-
-  return new Response(response.body, {
-    status: response.status,
-    headers: {
-      "content-type": response.headers.get("content-type") ?? "text/event-stream",
-      "cache-control": "no-cache",
-    },
-  });
-}
diff --git a/apps/dashboard/src/components/commands/ask-ai.tsx b/apps/dashboard/src/components/commands/ask-ai.tsx
index ec8638fe50..11606849c4 100644
--- a/apps/dashboard/src/components/commands/ask-ai.tsx
+++ b/apps/dashboard/src/components/commands/ask-ai.tsx
@@ -1,10 +1,11 @@
 import { cn } from "@/components/ui";
 import { useDebouncedAction } from "@/hooks/use-debounced-action";
+import { getPublicEnvVar } from "@/lib/env";
 import { ArrowSquareOutIcon, CaretDownIcon, CheckIcon, CopyIcon, DatabaseIcon, PaperPlaneTiltIcon, SparkleIcon, SpinnerGapIcon, UserIcon } from "@phosphor-icons/react";
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useChat, type UIMessage } from "@ai-sdk/react";
 import { DefaultChatTransport } from "ai";
-import { usePathname } from "next/navigation";
 import { memo, useCallback, useEffect, useRef, useState } from "react";
 import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
@@ -534,11 +535,8 @@ const AIChatPreviewInner = memo(function AIChatPreview({
   const lastMessageCountRef = useRef(0);
   const isNearBottomRef = useRef(true);
 
-  // Extract projectId from URL path (e.g., /projects/abc123/...)
-  const pathname = usePathname();
-  const projectId = pathname.startsWith("/projects/") ? pathname.split("/")[2] : null;
-
   const trimmedQuery = query.trim();
+  const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_BROWSER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_BROWSER_STACK_API_URL is not set");
 
   const {
     messages,
@@ -547,8 +545,13 @@ const AIChatPreviewInner = memo(function AIChatPreview({
     error: aiError,
   } = useChat({
     transport: new DefaultChatTransport({
-      api: "/api/ai-search",
-      body: { projectId },
+      api: `${backendBaseUrl}/api/latest/ai/query/stream`,
+      body: {
+        systemPrompt: "command-center-ask-ai",
+        tools: ["docs"],
+        quality: "smart",
+        speed: "fast",
+      },
     }),
   });
 
diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index 12ca4c7a4b..7edbdbdb20 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -5,6 +5,7 @@ import {
 } from "@assistant-ui/react";
 import { StackAdminApp } from "@stackframe/stack";
 import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
+import type { EditableMetadata } from "@stackframe/stack-shared/dist/utils/jsx-editable-transpiler";
 
 export type ToolCallContent = Extract<ChatContent[number], { type: "tool-call" }>;
 
@@ -47,6 +48,14 @@ function sanitizeGeneratedCode(code: string): string {
   return result;
 }
 
+function stripCodeFences(code: string): string {
+  if (!code.startsWith("```")) return code;
+  const lines = code.split("\n");
+  lines.shift();
+  if (lines[lines.length - 1]?.trim() === "```") lines.pop();
+  return lines.join("\n");
+}
+
 const CONTEXT_MAP = {
   "email-theme": { systemPrompt: "email-assistant-theme", tools: ["create-email-theme"] },
   "email-template": { systemPrompt: "email-assistant-template", tools: ["create-email-template"] },
@@ -54,7 +63,7 @@ const CONTEXT_MAP = {
 } as const;
 
 export function createChatAdapter(
-  adminApp: StackAdminApp,
+  backendBaseUrl: string,
   contextType: "email-theme" | "email-template" | "email-draft",
   onToolCall: (toolCall: ToolCallContent) => void,
   getCurrentSource?: () => string,
@@ -77,13 +86,21 @@ export function createChatAdapter(
 
         const { systemPrompt, tools } = CONTEXT_MAP[contextType];
 
-        const result = await adminApp.sendAiQuery({
-          systemPrompt,
-          tools: [...tools],
-          messages: [...contextMessages, ...formattedMessages],
+        const response = await fetch(`${backendBaseUrl}/api/latest/ai/query/generate`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          signal: abortSignal,
+          body: JSON.stringify({
+            systemPrompt,
+            tools: [...tools],
+            messages: [...contextMessages, ...formattedMessages],
+            quality: "smartest",
+            speed: "fast",
+          }),
         });
 
-        const content: ChatContent = Array.isArray(result.content) ? result.content : [];
+        const json = await response.json() as { content?: ChatContent };
+        const content: ChatContent = Array.isArray(json.content) ? json.content : [];
 
         const sanitizedContent: ChatContent = content.map((item) => {
           if (item.type === "tool-call" && typeof item.args?.content === "string") {
@@ -108,6 +125,85 @@ export function createChatAdapter(
   };
 }
 
+export async function applyWysiwygEdit(
+  backendBaseUrl: string,
+  options: {
+    sourceType: "template" | "theme" | "draft",
+    sourceCode: string,
+    oldText: string,
+    newText: string,
+    metadata: EditableMetadata,
+    domPath: Array<{ tagName: string, index: number }>,
+    htmlContext: string,
+  },
+): Promise<{ updatedSource: string }> {
+  if (options.oldText === options.newText) {
+    return { updatedSource: options.sourceCode };
+  }
+
+  const { sourceCode, oldText, newText, metadata, domPath, htmlContext } = options;
+
+  const userPrompt = `
+## Source Code to Edit
+\`\`\`tsx
+${sourceCode}
+\`\`\`
+
+## Edit Request
+- **Old text:** "${oldText}"
+- **New text:** "${newText}"
+
+## Location Information
+- **Line:** ${metadata.loc.line}
+- **Column:** ${metadata.loc.column}
+- **JSX Path:** ${metadata.jsxPath.join(" > ")}
+- **Parent Element:** <${metadata.parentElement.tagName}>
+- **Sibling Index:** ${metadata.siblingIndex}
+- **Occurrence:** ${metadata.occurrenceIndex} of ${metadata.occurrenceCount}
+
+## Source Context (lines around the text)
+Before:
+\`\`\`
+${metadata.sourceContext.before}
+\`\`\`
+
+After:
+\`\`\`
+${metadata.sourceContext.after}
+\`\`\`
+
+## Runtime DOM Path (for disambiguation)
+${domPath.map((p, i) => `${i + 1}. <${p.tagName}> (index: ${p.index})`).join("\n")}
+
+## Rendered HTML Context
+\`\`\`html
+${htmlContext.slice(0, 500)}
+\`\`\`
+
+Please update the source code to change "${oldText}" to "${newText}" at the specified location. Return ONLY the complete updated source code.
+`;
+
+  const response = await fetch(`${backendBaseUrl}/api/latest/ai/query/generate`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      quality: "smart",
+      speed: "fast",
+      systemPrompt: "wysiwyg-edit",
+      tools: [],
+      messages: [{ role: "user", content: userPrompt }],
+    }),
+  });
+
+  const json = await response.json() as { content?: Array<{ type: string, text?: string }> };
+  const textBlock = Array.isArray(json.content)
+    ? json.content.find((b) => b.type === "text" && b.text)
+    : undefined;
+  const updatedSource = stripCodeFences(textBlock?.text?.trim() ?? sourceCode);
+
+  return { updatedSource };
+}
+
 export function createHistoryAdapter(
   adminApp: StackAdminApp,
   threadId: string,
diff --git a/docs/src/app/api/chat/route.ts b/docs/src/app/api/chat/route.ts
deleted file mode 100644
index 626f7c0668..0000000000
--- a/docs/src/app/api/chat/route.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-import { convertToModelMessages, UIMessage } from "ai";
-
-export async function POST(request: Request) {
-  const payload = await request.json() as { messages?: UIMessage[] };
-  const messages = Array.isArray(payload.messages) ? payload.messages : [];
-
-  const backendBaseUrl =
-    process.env.NEXT_PUBLIC_STACK_API_URL ??
-    "https://api.stack-auth.com";
-
-  const modelMessages = await convertToModelMessages(messages);
-
-  const projectId = process.env.NEXT_PUBLIC_STACK_PROJECT_ID;
-  const publishableClientKey = process.env.NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY;
-
-  const requestHeaders: Record<string, string> = {
-    "content-type": "application/json",
-  };
-
-  if (projectId != null && publishableClientKey != null) {
-    requestHeaders["x-stack-access-type"] = "client";
-    requestHeaders["x-stack-project-id"] = projectId;
-    requestHeaders["x-stack-publishable-client-key"] = publishableClientKey;
-  }
-
-  const errorResponse = new Response(
-    JSON.stringify({
-      error: "Documentation service temporarily unavailable",
-      details: "Our documentation service is currently unreachable. Please try again in a moment, or visit https://docs.stack-auth.com directly for help.",
-    }),
-    { status: 503, headers: { "content-type": "application/json" } }
-  );
-
-  const backendResponse = await fetch(
-    `${backendBaseUrl}/api/latest/ai/query/stream`,
-    {
-      method: "POST",
-      headers: requestHeaders,
-      body: JSON.stringify({
-        quality: "smart",
-        speed: "fast",
-        systemPrompt: "docs-ask-ai",
-        tools: ["docs"],
-        messages: modelMessages,
-      }),
-    }
-  ).catch(() => errorResponse);
-
-  if (!backendResponse.ok) {
-    return errorResponse;
-  }
-
-  return new Response(backendResponse.body, {
-    status: backendResponse.status,
-    headers: {
-      "content-type":
-        backendResponse.headers.get("content-type") ?? "text/event-stream",
-      "cache-control": "no-cache",
-    },
-  });
-}
diff --git a/docs/src/components/chat/ai-chat.tsx b/docs/src/components/chat/ai-chat.tsx
index 4061b2f8f0..fde872a435 100644
--- a/docs/src/components/chat/ai-chat.tsx
+++ b/docs/src/components/chat/ai-chat.tsx
@@ -1,6 +1,7 @@
 'use client';
 
 import { useChat, type UIMessage } from '@ai-sdk/react';
+import { throwErr } from '@stackframe/stack-shared/dist/utils/errors';
 import { runAsynchronously } from '@stackframe/stack-shared/dist/utils/promises';
 import { DefaultChatTransport, type DynamicToolUIPart } from 'ai';
 import { ChevronDown, ChevronUp, ExternalLink, FileText, Maximize2, Minimize2, Send, X } from 'lucide-react';
@@ -350,6 +351,7 @@ export function AIChatDrawer() {
   const height = isHomePage && isScrolled ? 'h-[calc(100vh-1.5rem)]' : 'h-[calc(100vh-1.5rem)]';
 
   const [input, setInput] = useState('');
+  const apiBaseUrl = process.env.NEXT_PUBLIC_STACK_API_URL ?? throwErr("NEXT_PUBLIC_STACK_API_URL is not set");
 
   const {
     messages,
@@ -357,7 +359,15 @@ export function AIChatDrawer() {
     status,
     error,
   } = useChat({
-    transport: new DefaultChatTransport({ api: '/api/chat' }),
+    transport: new DefaultChatTransport({
+      api: `${apiBaseUrl}/api/latest/ai/query/stream`,
+      body: {
+        systemPrompt: "docs-ask-ai",
+        tools: ["docs"],
+        quality: "smart",
+        speed: "fast",
+      },
+    }),
     onError: (error: Error) => {
       console.error('Chat error:', error);
     },
diff --git a/packages/stack-shared/src/interface/admin-interface.ts b/packages/stack-shared/src/interface/admin-interface.ts
index 1764251bc4..63138af855 100644
--- a/packages/stack-shared/src/interface/admin-interface.ts
+++ b/packages/stack-shared/src/interface/admin-interface.ts
@@ -3,7 +3,6 @@ import { KnownErrors } from "../known-errors";
 import { branchConfigSourceSchema, type RestrictedReason } from "../schema-fields";
 import { AccessToken, InternalSession, RefreshToken } from "../sessions";
 import type { MoneyAmount } from "../utils/currency-constants";
-import type { EditableMetadata } from "../utils/jsx-editable-transpiler";
 import { Result } from "../utils/results";
 import type { AnalyticsQueryOptions, AnalyticsQueryResponse } from "./crud/analytics";
 import { EmailOutboxCrud } from "./crud/email-outbox";
@@ -443,86 +442,6 @@ export class StackAdminInterface extends StackServerInterface {
     return await response.json();
   }
 
-  async applyWysiwygEdit(options: {
-    sourceType: "template" | "theme" | "draft",
-    sourceCode: string,
-    oldText: string,
-    newText: string,
-    metadata: EditableMetadata,
-    domPath: Array<{ tagName: string, index: number }>,
-    htmlContext: string,
-  }): Promise<{ updatedSource: string }> {
-    const response = await this.sendAdminRequest(
-      `/internal/wysiwyg-edit`,
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-        },
-        body: JSON.stringify({
-          source_type: options.sourceType,
-          source_code: options.sourceCode,
-          old_text: options.oldText,
-          new_text: options.newText,
-          metadata: options.metadata,
-          dom_path: options.domPath.map(item => ({ tag_name: item.tagName, index: item.index })),
-          html_context: options.htmlContext,
-        }),
-      },
-      null,
-    );
-    const result = await response.json();
-    return { updatedSource: result.updated_source };
-  }
-
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode: "stream",
-  }): Promise<Response>;
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode?: "generate",
-  }): Promise<{ content: ChatContent }>;
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode?: "generate" | "stream",
-  }): Promise<{ content: ChatContent } | Response> {
-    const mode = options.mode ?? "generate";
-    const response = await this.sendAdminRequest(
-      `/ai/query/${mode}`,
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-        },
-        body: JSON.stringify({
-          systemPrompt: options.systemPrompt,
-          tools: options.tools,
-          messages: options.messages,
-          quality: options.quality ?? "smartest",
-          speed: options.speed ?? "fast",
-        }),
-      },
-      null,
-    );
-    if (mode === "stream") {
-      return response;
-    }
-    return await response.json();
-  }
-
   async renderEmailPreview(options: {
     themeId?: string | null | false,
     themeTsxSource?: string,
diff --git a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
index 2fb66335d3..96236c76fc 100644
--- a/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
+++ b/packages/template/src/lib/stack-app/apps/implementations/admin-app-impl.ts
@@ -25,9 +25,7 @@ import { clientVersion, createCache, getBaseUrl, getDefaultExtraRequestHeaders,
 import { _StackServerAppImplIncomplete } from "./server-app-impl";
 
 import { CompleteConfig, EnvironmentConfigOverrideOverride } from "@stackframe/stack-shared/dist/config/schema";
-import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
 import { branchConfigSourceSchema } from "@stackframe/stack-shared/dist/schema-fields";
-import type { EditableMetadata } from "@stackframe/stack-shared/dist/utils/jsx-editable-transpiler";
 import * as yup from "yup";
 import { PushedConfigSource } from "../../projects";
 import { useAsyncCache } from "./common"; // THIS_LINE_PLATFORM react-like
@@ -655,45 +653,6 @@ export class _StackAdminAppImplIncomplete<HasTokenStore extends boolean, Project
     return await this._interface.listChatMessages(threadId);
   }
 
-  async applyWysiwygEdit(options: {
-    sourceType: "template" | "theme" | "draft",
-    sourceCode: string,
-    oldText: string,
-    newText: string,
-    metadata: EditableMetadata,
-    domPath: Array<{ tagName: string, index: number }>,
-    htmlContext: string,
-  }): Promise<{ updatedSource: string }> {
-    return await this._interface.applyWysiwygEdit(options);
-  }
-
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode: "stream",
-  }): Promise<Response>;
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode?: "generate",
-  }): Promise<{ content: ChatContent }>;
-  async sendAiQuery(options: {
-    systemPrompt: string,
-    tools: string[],
-    messages: Array<{ role: string, content: unknown }>,
-    quality?: string,
-    speed?: string,
-    mode?: "generate" | "stream",
-  }): Promise<{ content: ChatContent } | Response> {
-    return await (this._interface.sendAiQuery as (opts: typeof options) => Promise<{ content: ChatContent } | Response>)(options);
-  }
-
   async createEmailTheme(displayName: string): Promise<{ id: string }> {
     const result = await this._interface.createEmailTheme(displayName);
     await this._adminEmailThemesCache.refresh([]);
diff --git a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
index 2d4aa4ee63..310f600ded 100644
--- a/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
+++ b/packages/template/src/lib/stack-app/apps/interfaces/admin-app.ts
@@ -1,10 +1,8 @@
-import type { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
 import { AnalyticsQueryOptions, AnalyticsQueryResponse } from "@stackframe/stack-shared/dist/interface/crud/analytics";
 import type { AdminGetSessionReplayChunkEventsResponse, AdminGetSessionReplayAllEventsResponse } from "@stackframe/stack-shared/dist/interface/crud/session-replays";
 import type { Transaction, TransactionType } from "@stackframe/stack-shared/dist/interface/crud/transactions";
 import { InternalSession } from "@stackframe/stack-shared/dist/sessions";
 import type { MoneyAmount } from "@stackframe/stack-shared/dist/utils/currency-constants";
-import type { EditableMetadata } from "@stackframe/stack-shared/dist/utils/jsx-editable-transpiler";
 import { Result } from "@stackframe/stack-shared/dist/utils/results";
 import { AsyncStoreProperty, EmailConfig } from "../../common";
 import { AdminEmailOutbox, AdminSentEmail } from "../../email";
@@ -97,31 +95,6 @@ export type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId ext
     deleteEmailTheme(id: string): Promise<void>,
     saveChatMessage(threadId: string, message: any): Promise<void>,
     listChatMessages(threadId: string): Promise<{ messages: Array<any> }>,
-    applyWysiwygEdit(options: {
-      sourceType: "template" | "theme" | "draft",
-      sourceCode: string,
-      oldText: string,
-      newText: string,
-      metadata: EditableMetadata,
-      domPath: Array<{ tagName: string, index: number }>,
-      htmlContext: string,
-    }): Promise<{ updatedSource: string }>,
-    sendAiQuery(options: {
-      systemPrompt: string,
-      tools: string[],
-      messages: Array<{ role: string, content: unknown }>,
-      quality?: string,
-      speed?: string,
-      mode: "stream",
-    }): Promise<Response>,
-    sendAiQuery(options: {
-      systemPrompt: string,
-      tools: string[],
-      messages: Array<{ role: string, content: unknown }>,
-      quality?: string,
-      speed?: string,
-      mode?: "generate",
-    }): Promise<{ content: ChatContent }>,
     updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{ renderedHtml: string }>,
     createEmailTemplate(displayName: string): Promise<{ id: string }>,
     deleteEmailTemplate(id: string): Promise<void>,

From f8e4fec268265d8122f25f6ec0586346e8dcdb44 Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 9 Mar 2026 11:57:33 -0700
Subject: [PATCH 19/21] minor bug fix

---
 .../projects/[projectId]/email-drafts/[draftId]/page-client.tsx  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index cfdc854481..da3767b946 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -10,6 +10,7 @@ import { ToolCallContent, applyWysiwygEdit, createChatAdapter, createHistoryAdap
 import { EmailDraftUI } from "@/components/vibe-coding/draft-tool-components";
 import { getPublicEnvVar } from "@/lib/env";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { Suspense, useCallback, useEffect, useMemo, useState } from "react";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";

From c7afb2ff9e6fe6e9889dde6e735a527baae492be Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 9 Mar 2026 15:14:50 -0700
Subject: [PATCH 20/21] more changes

---
 .../app/api/latest/ai/query/[mode]/route.ts   |  6 +++---
 apps/backend/src/lib/ai/prompts.ts            |  7 ++++++-
 apps/backend/src/lib/ai/schema.ts             |  1 -
 .../src/lib/ai/tools/create-email-draft.ts    |  3 ---
 .../email-drafts/[draftId]/page-client.tsx    |  7 +++++--
 .../[templateId]/page-client.tsx              |  8 ++++++--
 .../email-themes/[themeId]/page-client.tsx    |  8 ++++++--
 .../src/components/commands/ask-ai.tsx        |  4 ++++
 .../components/vibe-coding/chat-adapters.ts   | 12 +++++++++--
 apps/dashboard/src/lib/api-headers.ts         | 20 +++++++++++++++++++
 10 files changed, 60 insertions(+), 16 deletions(-)
 create mode 100644 apps/dashboard/src/lib/api-headers.ts

diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
index 2285a19617..ed62c02b60 100644
--- a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
+++ b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -9,7 +9,7 @@ import { yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/sc
 import { getEnvVariable } from "@stackframe/stack-shared/dist/utils/env";
 import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Json } from "@stackframe/stack-shared/dist/utils/json";
-import { generateText, stepCountIs, streamText } from "ai";
+import { generateText, ModelMessage, stepCountIs, streamText } from "ai";
 
 export const POST = createSmartRouteHandler({
   metadata: {
@@ -55,7 +55,7 @@ export const POST = createSmartRouteHandler({
       const result = streamText({
         model,
         system: systemPrompt,
-        messages,
+        messages: messages as ModelMessage[],
         tools: toolsArg,
         stopWhen: stepCountIs(stepLimit),
       });
@@ -70,7 +70,7 @@ export const POST = createSmartRouteHandler({
       const result = await generateText({
         model,
         system: systemPrompt,
-        messages,
+        messages: messages as ModelMessage[],
         tools: toolsArg,
         stopWhen: stepCountIs(stepLimit),
       }).finally(() => clearTimeout(timeoutId));
diff --git a/apps/backend/src/lib/ai/prompts.ts b/apps/backend/src/lib/ai/prompts.ts
index dba9e44541..1260c8617b 100644
--- a/apps/backend/src/lib/ai/prompts.ts
+++ b/apps/backend/src/lib/ai/prompts.ts
@@ -337,8 +337,13 @@ TECHNICAL RULES:
 - YOU MUST WRITE A FULL REACT COMPONENT WHEN CALLING THE createEmailTemplate TOOL.
 - Always include a <Subject />.
 - Do NOT include <Html>, <Head>, <Body>, or <Preview> components (the theme provides those).
-- Use only tailwind classes for styling.
+- Use only tailwind classes for styling. Do NOT use Tailwind classes that require style injection (e.g., hover:, focus:, active:, dark:, group-hover:, media queries). Only use inlineable Tailwind utilities.
 - Export 'EmailTemplate' component.
+- Import email components only from \`@react-email/components\` and Stack Auth helpers from \`@stackframe/emails\` (Subject, NotificationCategory, Props).
+- EVERY component you use in JSX must be explicitly imported. If you use \`<Hr />\`, import \`Hr\`. Never use a component without importing it.
+- YOU MUST call the \`createEmailTemplate\` tool with the complete code. NEVER output code directly in the chat.
+- Output raw TSX source code — NEVER HTML-encode angle brackets. Write \`<Container>\`, not \`&lt;Container&gt;\`.
+- NEVER use bare & in JSX text content — it is invalid JSX and causes a build error. Use \`&amp;\` or \`{"&"}\` instead.
 
 The current source code will be provided in the conversation messages.
 `,
diff --git a/apps/backend/src/lib/ai/schema.ts b/apps/backend/src/lib/ai/schema.ts
index ed3416953f..b02252af5d 100644
--- a/apps/backend/src/lib/ai/schema.ts
+++ b/apps/backend/src/lib/ai/schema.ts
@@ -14,7 +14,6 @@ export const requestBodySchema = yupObject({
     "email-assistant-theme",
     "email-assistant-draft",
     "create-dashboard",
-    "edit-dashboard",
     "run-query",
   ]).defined(),
   messages: yupArray(
diff --git a/apps/backend/src/lib/ai/tools/create-email-draft.ts b/apps/backend/src/lib/ai/tools/create-email-draft.ts
index 4af99f8f2c..12d9a66e6e 100644
--- a/apps/backend/src/lib/ai/tools/create-email-draft.ts
+++ b/apps/backend/src/lib/ai/tools/create-email-draft.ts
@@ -22,9 +22,6 @@ It must export one thing:
 - EmailTemplate: A function that renders the email draft
 It must not import from any package besides "@react-email/components", "@stackframe/emails", and "arktype".
 It uses tailwind classes for all styling.
-The email must include <Html>, <Head />, <Preview />, <Tailwind>, <Body>, and <Container> in the correct hierarchy.
-Do not use any Tailwind classes that require style injection (e.g., hover:, focus:, active:, group-hover:, media queries, dark:, etc.). Only use inlineable Tailwind utilities.
-The <Head /> component must be rendered inside <Tailwind> to support Tailwind style injection
 Here is an example of a valid email draft:
 \`\`\`tsx
 import { Container } from "@react-email/components";
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
index da3767b946..ddc5f73eef 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-drafts/[draftId]/page-client.tsx
@@ -8,6 +8,7 @@ import { Alert, AlertDescription, AlertTitle, Badge, Button, Card, CardContent,
 import { AssistantChat, CodeEditor, VibeCodeLayout, type ViewportMode, type WysiwygDebugInfo } from "@/components/vibe-coding";
 import { ToolCallContent, applyWysiwygEdit, createChatAdapter, createHistoryAdapter } from "@/components/vibe-coding/chat-adapters";
 import { EmailDraftUI } from "@/components/vibe-coding/draft-tool-components";
+import { useUser } from "@stackframe/stack";
 import { getPublicEnvVar } from "@/lib/env";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
 import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
@@ -17,6 +18,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ draftId }: { draftId: string }) {
   const stackAdminApp = useAdminApp();
+  const currentUser = useUser({ or: "redirect" });
   const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const { setNeedConfirm } = useRouterConfirm();
   const [saveAlert, setSaveAlert] = useState<{
@@ -96,6 +98,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
     const result = await applyWysiwygEdit(backendBaseUrl, {
+      currentUser,
       sourceType: 'draft',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -106,7 +109,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [backendBaseUrl, currentCode]);
+  }, [backendBaseUrl, currentCode, currentUser]);
 
   return (
     <AppEnabledGuard appId="emails">
@@ -165,7 +168,7 @@ export default function PageClient({ draftId }: { draftId: string }) {
               chatComponent={
                 <AssistantChat
                   historyAdapter={createHistoryAdapter(stackAdminApp, draftId)}
-                  chatAdapter={createChatAdapter(backendBaseUrl, "email-draft", handleToolUpdate, () => currentCode)}
+                  chatAdapter={createChatAdapter(backendBaseUrl, "email-draft", handleToolUpdate, () => currentCode, currentUser)}
                   toolComponents={<EmailDraftUI setCurrentCode={setCurrentCode} />}
                   useOffWhiteLightMode
                 />
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
index 68f0e22b9b..95f378064c 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-templates/[templateId]/page-client.tsx
@@ -16,7 +16,9 @@ import {
 } from "@/components/vibe-coding";
 import { applyWysiwygEdit, ToolCallContent } from "@/components/vibe-coding/chat-adapters";
 import { getPublicEnvVar } from "@/lib/env";
+import { useUser } from "@stackframe/stack";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useCallback, useEffect, useRef, useState } from "react";
 
@@ -26,6 +28,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient(props: { templateId: string }) {
   const stackAdminApp = useAdminApp();
+  const currentUser = useUser({ or: "redirect" });
   const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const templates = stackAdminApp.useEmailTemplates();
   const { setNeedConfirm } = useRouterConfirm();
@@ -149,6 +152,7 @@ export default function PageClient(props: { templateId: string }) {
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
     const result = await applyWysiwygEdit(backendBaseUrl, {
+      currentUser,
       sourceType: 'template',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -159,7 +163,7 @@ export default function PageClient(props: { templateId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [backendBaseUrl, currentCode]);
+  }, [backendBaseUrl, currentCode, currentUser]);
 
   if (!template) {
     // Show loading state while waiting for the template (either from hook or direct fetch)
@@ -273,7 +277,7 @@ export default function PageClient(props: { templateId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(backendBaseUrl, "email-template", handleCodeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(backendBaseUrl, "email-template", handleCodeUpdate, () => currentCode, currentUser)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, template.id)}
                 toolComponents={<EmailTemplateUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
index 3976a9e041..4f0b778e5c 100644
--- a/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
+++ b/apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/email-themes/[themeId]/page-client.tsx
@@ -11,8 +11,10 @@ import {
   ToolCallContent
 } from "@/components/vibe-coding/chat-adapters";
 import { getPublicEnvVar } from "@/lib/env";
+import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { previewTemplateSource } from "@stackframe/stack-shared/dist/helpers/emails";
 import { KnownErrors } from "@stackframe/stack-shared/dist/known-errors";
+import { useUser } from "@stackframe/stack";
 import { useCallback, useEffect, useState } from "react";
 import { AppEnabledGuard } from "../../app-enabled-guard";
 import { useAdminApp } from "../../use-admin-app";
@@ -20,6 +22,7 @@ import { useAdminApp } from "../../use-admin-app";
 
 export default function PageClient({ themeId }: { themeId: string }) {
   const stackAdminApp = useAdminApp();
+  const currentUser = useUser({ or: "redirect" });
   const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_SERVER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_SERVER_STACK_API_URL is not set");
   const theme = stackAdminApp.useEmailTheme(themeId);
   const { setNeedConfirm } = useRouterConfirm();
@@ -35,6 +38,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
   // Handle WYSIWYG edit commits - calls the AI endpoint to update source code
   const handleWysiwygEditCommit: OnWysiwygEditCommit = useCallback(async (data) => {
     const result = await applyWysiwygEdit(backendBaseUrl, {
+      currentUser,
       sourceType: 'theme',
       sourceCode: currentCode,
       oldText: data.oldText,
@@ -45,7 +49,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
     });
     setCurrentCode(result.updatedSource);
     return result.updatedSource;
-  }, [backendBaseUrl, currentCode]);
+  }, [backendBaseUrl, currentCode, currentUser]);
 
   useEffect(() => {
     if (theme.tsxSource === currentCode) return;
@@ -127,7 +131,7 @@ export default function PageClient({ themeId }: { themeId: string }) {
             }
             chatComponent={
               <AssistantChat
-                chatAdapter={createChatAdapter(backendBaseUrl, "email-theme", handleThemeUpdate, () => currentCode)}
+                chatAdapter={createChatAdapter(backendBaseUrl, "email-theme", handleThemeUpdate, () => currentCode, currentUser)}
                 historyAdapter={createHistoryAdapter(stackAdminApp, themeId)}
                 toolComponents={<EmailThemeUI setCurrentCode={setCurrentCode} />}
                 useOffWhiteLightMode
diff --git a/apps/dashboard/src/components/commands/ask-ai.tsx b/apps/dashboard/src/components/commands/ask-ai.tsx
index 11606849c4..af71becebd 100644
--- a/apps/dashboard/src/components/commands/ask-ai.tsx
+++ b/apps/dashboard/src/components/commands/ask-ai.tsx
@@ -1,7 +1,9 @@
 import { cn } from "@/components/ui";
 import { useDebouncedAction } from "@/hooks/use-debounced-action";
 import { getPublicEnvVar } from "@/lib/env";
+import { buildStackAuthHeaders } from "@/lib/api-headers";
 import { ArrowSquareOutIcon, CaretDownIcon, CheckIcon, CopyIcon, DatabaseIcon, PaperPlaneTiltIcon, SparkleIcon, SpinnerGapIcon, UserIcon } from "@phosphor-icons/react";
+import { useUser } from "@stackframe/stack";
 import { throwErr } from "@stackframe/stack-shared/dist/utils/errors";
 import { runAsynchronously } from "@stackframe/stack-shared/dist/utils/promises";
 import { useChat, type UIMessage } from "@ai-sdk/react";
@@ -534,6 +536,7 @@ const AIChatPreviewInner = memo(function AIChatPreview({
   const followUpInputRef = useRef<HTMLInputElement>(null);
   const lastMessageCountRef = useRef(0);
   const isNearBottomRef = useRef(true);
+  const currentUser = useUser();
 
   const trimmedQuery = query.trim();
   const backendBaseUrl = getPublicEnvVar("NEXT_PUBLIC_BROWSER_STACK_API_URL") ?? getPublicEnvVar("NEXT_PUBLIC_STACK_API_URL") ?? throwErr("NEXT_PUBLIC_BROWSER_STACK_API_URL is not set");
@@ -546,6 +549,7 @@ const AIChatPreviewInner = memo(function AIChatPreview({
   } = useChat({
     transport: new DefaultChatTransport({
       api: `${backendBaseUrl}/api/latest/ai/query/stream`,
+      headers: () => buildStackAuthHeaders(currentUser),
       body: {
         systemPrompt: "command-center-ask-ai",
         tools: ["docs"],
diff --git a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
index 7edbdbdb20..4b0451f8e4 100644
--- a/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
+++ b/apps/dashboard/src/components/vibe-coding/chat-adapters.ts
@@ -5,6 +5,7 @@ import {
 } from "@assistant-ui/react";
 import { StackAdminApp } from "@stackframe/stack";
 import { ChatContent } from "@stackframe/stack-shared/dist/interface/admin-interface";
+import { buildStackAuthHeaders, type CurrentUser } from "@/lib/api-headers";
 import type { EditableMetadata } from "@stackframe/stack-shared/dist/utils/jsx-editable-transpiler";
 
 export type ToolCallContent = Extract<ChatContent[number], { type: "tool-call" }>;
@@ -67,6 +68,7 @@ export function createChatAdapter(
   contextType: "email-theme" | "email-template" | "email-draft",
   onToolCall: (toolCall: ToolCallContent) => void,
   getCurrentSource?: () => string,
+  currentUser?: CurrentUser,
 ): ChatModelAdapter {
   return {
     async run({ messages, abortSignal }) {
@@ -86,9 +88,11 @@ export function createChatAdapter(
 
         const { systemPrompt, tools } = CONTEXT_MAP[contextType];
 
+        const authHeaders = await buildStackAuthHeaders(currentUser);
+
         const response = await fetch(`${backendBaseUrl}/api/latest/ai/query/generate`, {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", ...authHeaders },
           signal: abortSignal,
           body: JSON.stringify({
             systemPrompt,
@@ -135,6 +139,7 @@ export async function applyWysiwygEdit(
     metadata: EditableMetadata,
     domPath: Array<{ tagName: string, index: number }>,
     htmlContext: string,
+    currentUser?: CurrentUser,
   },
 ): Promise<{ updatedSource: string }> {
   if (options.oldText === options.newText) {
@@ -183,9 +188,12 @@ ${htmlContext.slice(0, 500)}
 Please update the source code to change "${oldText}" to "${newText}" at the specified location. Return ONLY the complete updated source code.
 `;
 
+  const { currentUser } = options;
+  const authHeaders = await buildStackAuthHeaders(currentUser);
+
   const response = await fetch(`${backendBaseUrl}/api/latest/ai/query/generate`, {
     method: "POST",
-    headers: { "content-type": "application/json" },
+    headers: { "content-type": "application/json", ...authHeaders },
     body: JSON.stringify({
       quality: "smart",
       speed: "fast",
diff --git a/apps/dashboard/src/lib/api-headers.ts b/apps/dashboard/src/lib/api-headers.ts
new file mode 100644
index 0000000000..3a98542c42
--- /dev/null
+++ b/apps/dashboard/src/lib/api-headers.ts
@@ -0,0 +1,20 @@
+import { getPublicEnvVar } from "@/lib/env";
+
+export type CurrentUser = { getAccessToken: () => Promise<string | null> };
+
+/**
+ * Builds Stack Auth API headers with authentication when available.
+ * Automatically includes access token if user is provided.
+ */
+export async function buildStackAuthHeaders(
+  currentUser?: CurrentUser | null,
+): Promise<Record<string, string>> {
+  const accessToken = currentUser ? await currentUser.getAccessToken() : null;
+
+  return {
+    "x-stack-access-type": "client",
+    "x-stack-project-id": "internal",
+    "x-stack-publishable-client-key": getPublicEnvVar("NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY") ?? "",
+    ...(accessToken ? { "x-stack-access-token": accessToken } : {}),
+  };
+}

From 33ce58b967edf6a95150c28007bc9c0106cf531a Mon Sep 17 00:00:00 2001
From: aadesh18 <110230993+aadesh18@users.noreply.github.com>
Date: Mon, 9 Mar 2026 15:39:39 -0700
Subject: [PATCH 21/21] updated test

---
 .../api/v1/internal/wysiwyg-edit.test.ts      | 166 +++++++++---------
 1 file changed, 81 insertions(+), 85 deletions(-)

diff --git a/apps/e2e/tests/backend/endpoints/api/v1/internal/wysiwyg-edit.test.ts b/apps/e2e/tests/backend/endpoints/api/v1/internal/wysiwyg-edit.test.ts
index a3f38192ab..58b76229fe 100644
--- a/apps/e2e/tests/backend/endpoints/api/v1/internal/wysiwyg-edit.test.ts
+++ b/apps/e2e/tests/backend/endpoints/api/v1/internal/wysiwyg-edit.test.ts
@@ -14,146 +14,142 @@ it("should return the original source when old_text equals new_text", async ({ e
     }
   `;
 
-  const response = await niceBackendFetch("/api/v1/internal/wysiwyg-edit", {
+  const userPrompt = `
+## Source Code to Edit
+\`\`\`tsx
+${sourceCode}
+\`\`\`
+
+## Edit Request
+- **Old text:** "Hello World!"
+- **New text:** "Hello World!"
+
+## Location Information
+- **Line:** 3
+- **Column:** 18
+- **JSX Path:** EmailTemplate > div
+- **Parent Element:** <div>
+- **Sibling Index:** 0
+- **Occurrence:** 1 of 1
+
+## Source Context (lines around the text)
+Before:
+\`\`\`
+\`\`\`
+
+After:
+\`\`\`
+\`\`\`
+
+## Runtime DOM Path (for disambiguation)
+1. <DIV> (index: 0)
+
+## Rendered HTML Context
+\`\`\`html
+<div>Hello World!</div>
+\`\`\`
+
+Please update the source code to change "Hello World!" to "Hello World!" at the specified location. Return ONLY the complete updated source code.
+`;
+
+  const response = await niceBackendFetch("/api/latest/ai/query/generate", {
     method: "POST",
     accessType: "admin",
     headers: {
       'x-stack-admin-access-token': adminAccessToken,
     },
     body: {
-      source_type: "template",
-      source_code: sourceCode,
-      old_text: "Hello World!",
-      new_text: "Hello World!", // Same as old_text
-      metadata: {
-        id: "e0",
-        loc: { start: 50, end: 62, line: 3, column: 18 },
-        originalText: "Hello World!",
-        textHash: "abc123",
-        jsxPath: ["EmailTemplate", "div"],
-        parentElement: { tagName: "div", props: {} },
-        sourceContext: { before: "", after: "" },
-        siblingIndex: 0,
-        occurrenceCount: 1,
-        occurrenceIndex: 1,
-        sourceFile: "template",
-      },
-      dom_path: [{ tag_name: "DIV", index: 0 }],
-      html_context: "<div>Hello World!</div>",
+      systemPrompt: "wysiwyg-edit",
+      tools: [],
+      messages: [{ role: "user", content: userPrompt }],
+      quality: "smart",
+      speed: "fast",
     },
   });
 
   expect(response.status).toBe(200);
-  expect(response.body.updated_source).toBe(sourceCode);
+  const textBlock = Array.isArray(response.body.content)
+    ? response.body.content.find((b: any) => b.type === "text" && b.text)
+    : undefined;
+  const updatedSource = textBlock?.text?.trim() ?? sourceCode;
+  // When old_text equals new_text, the AI should return the original source unchanged
+  expect(updatedSource.includes("Hello World!")).toBe(true);
 });
 
 it("should require admin authentication", async ({ expect }) => {
   await Auth.fastSignUp();
-  const { adminAccessToken } = await Project.createAndGetAdminToken();
+  await Project.createAndGetAdminToken();
 
   // Try without admin token
-  const response = await niceBackendFetch("/api/v1/internal/wysiwyg-edit", {
+  const response = await niceBackendFetch("/api/latest/ai/query/generate", {
     method: "POST",
     accessType: "client",
     body: {
-      source_type: "template",
-      source_code: "const x = 1;",
-      old_text: "1",
-      new_text: "2",
-      metadata: {
-        id: "e0",
-        loc: { start: 10, end: 11, line: 1, column: 10 },
-        originalText: "1",
-        textHash: "abc123",
-        jsxPath: [],
-        parentElement: { tagName: "div", props: {} },
-        sourceContext: { before: "", after: "" },
-        siblingIndex: 0,
-        occurrenceCount: 1,
-        occurrenceIndex: 1,
-        sourceFile: "template",
-      },
-      dom_path: [],
-      html_context: "",
+      systemPrompt: "wysiwyg-edit",
+      tools: [],
+      messages: [{ role: "user", content: "const x = 1;" }],
+      quality: "smart",
+      speed: "fast",
     },
   });
 
   expect(response.status).toBe(401);
 });
 
-it("should validate required fields in metadata", async ({ expect }) => {
+it("should validate required fields in messages", async ({ expect }) => {
   await Auth.fastSignUp();
   const { adminAccessToken } = await Project.createAndGetAdminToken();
 
-  const response = await niceBackendFetch("/api/v1/internal/wysiwyg-edit", {
+  const response = await niceBackendFetch("/api/latest/ai/query/generate", {
     method: "POST",
     accessType: "admin",
     headers: {
       'x-stack-admin-access-token': adminAccessToken,
     },
     body: {
-      source_type: "template",
-      source_code: "const x = 1;",
-      old_text: "1",
-      new_text: "2",
-      metadata: {
-        // Missing required fields
-        id: "e0",
-      },
-      dom_path: [],
-      html_context: "",
+      systemPrompt: "wysiwyg-edit",
+      tools: [],
+      messages: [], // Missing required messages
+      quality: "smart",
+      speed: "fast",
     },
   });
 
   expect(response.status).toBe(400);
 });
 
-it("should accept valid source_type values", async ({ expect }) => {
+it("should accept valid system prompts", async ({ expect }) => {
   await Auth.fastSignUp();
   const { adminAccessToken } = await Project.createAndGetAdminToken();
 
-  const makeRequest = async (sourceType: string) => {
-    return await niceBackendFetch("/api/v1/internal/wysiwyg-edit", {
+  const makeRequest = async (systemPrompt: string) => {
+    return await niceBackendFetch("/api/latest/ai/query/generate", {
       method: "POST",
       accessType: "admin",
       headers: {
         'x-stack-admin-access-token': adminAccessToken,
       },
       body: {
-        source_type: sourceType,
-        source_code: "const x = 1;",
-        old_text: "1",
-        new_text: "1", // Same, so no AI call needed
-        metadata: {
-          id: "e0",
-          loc: { start: 10, end: 11, line: 1, column: 10 },
-          originalText: "1",
-          textHash: "abc123",
-          jsxPath: [],
-          parentElement: { tagName: "div", props: {} },
-          sourceContext: { before: "", after: "" },
-          siblingIndex: 0,
-          occurrenceCount: 1,
-          occurrenceIndex: 1,
-          sourceFile: "template",
-        },
-        dom_path: [],
-        html_context: "",
+        systemPrompt,
+        tools: [],
+        messages: [{ role: "user", content: "const x = 1;" }],
+        quality: "smart",
+        speed: "fast",
       },
     });
   };
 
-  // Valid source types
-  const templateResponse = await makeRequest("template");
-  expect(templateResponse.status).toBe(200);
+  // Valid system prompts
+  const wysiwygResponse = await makeRequest("wysiwyg-edit");
+  expect(wysiwygResponse.status).toBe(200);
 
-  const themeResponse = await makeRequest("theme");
-  expect(themeResponse.status).toBe(200);
+  const emailTemplateResponse = await makeRequest("email-assistant-template");
+  expect(emailTemplateResponse.status).toBe(200);
 
-  const draftResponse = await makeRequest("draft");
-  expect(draftResponse.status).toBe(200);
+  const emailDraftResponse = await makeRequest("email-assistant-draft");
+  expect(emailDraftResponse.status).toBe(200);
 
-  // Invalid source type
-  const invalidResponse = await makeRequest("invalid");
+  // Invalid system prompt
+  const invalidResponse = await makeRequest("invalid-prompt");
   expect(invalidResponse.status).toBe(400);
 });