diff --git a/.gitignore b/.gitignore
index d7452398e9..eef93622aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,7 @@ target/
 
 # rslib
 .rslib
+
+# next
+.next
+.vercel
diff --git a/eslint.config.js b/eslint.config.js
index ea270aa317..2089ad4ebe 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -26,7 +26,9 @@ export default tseslint.config(
 
       // Outputs
       '**/.rslib/**',
+      '**/.next/**',
       '**/.turbo/**',
+      '**/.vercel/**',
       '**/coverage/**',
       'output/**',
       'target/**',
@@ -74,6 +76,7 @@ export default tseslint.config(
       'packages/react/transform/index.d.ts',
       'packages/react/transform/index.cjs',
       'packages/react/transform/**/index.d.ts',
+      'packages/genui/server/next-env.d.ts',
 
       // REPL examples use Lynx platform globals and are not subject to lint rules
       'packages/repl/src/examples/**',
@@ -453,4 +456,13 @@ export default tseslint.config(
       'headers/header-format': 'off',
     },
   },
+  {
+    files: [
+      'packages/genui/server/**/*.{ts,tsx}',
+    ],
+    rules: {
+      'n/file-extension-in-import': 'off',
+      'n/no-unsupported-features/node-builtins': 'off',
+    },
+  },
 );
diff --git a/packages/genui/a2ui-playground/lynx-src/a2ui/App.tsx b/packages/genui/a2ui-playground/lynx-src/a2ui/App.tsx
index 5a4d6fd7a5..f968115c2a 100644
--- a/packages/genui/a2ui-playground/lynx-src/a2ui/App.tsx
+++ b/packages/genui/a2ui-playground/lynx-src/a2ui/App.tsx
@@ -15,9 +15,12 @@ import {
   Row,
   Text,
   createMessageStore,
+  normalizePayloadToMessages as normalizeProtocolMessages,
 } from '@lynx-js/a2ui-reactlynx';
 import type {
+  CatalogComponent,
   CatalogInput,
+  CatalogManifest,
   MessageStore,
   ServerToClientMessage,
   UserActionPayload,
@@ -57,18 +60,25 @@ const DEFAULT_STREAM_DELAY_MS = 800;
 // agent handshake. To include schemas, pair each component with its
 // `catalog.json` manifest — see
 // `packages/genui/a2ui/src/catalog/README.md`.
+function manifestEntry(
+  component: unknown,
+  manifest: CatalogManifest,
+): readonly [CatalogComponent, CatalogManifest] {
+  return [component as CatalogComponent, manifest];
+}
+
 const ALL_BUILTINS: readonly CatalogInput[] = [
-  [Text, textManifest],
-  [Image, imageManifest],
-  [Row, rowManifest],
-  [Column, columnManifest],
-  [List, listManifest],
-  [Card, cardManifest],
-  [Button, buttonManifest],
-  [Divider, dividerManifest],
-  [Icon, iconManifest],
-  [CheckBox, checkBoxManifest],
-  [RadioGroup, radioGroupManifest],
+  manifestEntry(Text, textManifest),
+  manifestEntry(Image, imageManifest),
+  manifestEntry(Row, rowManifest),
+  manifestEntry(Column, columnManifest),
+  manifestEntry(List, listManifest),
+  manifestEntry(Card, cardManifest),
+  manifestEntry(Button, buttonManifest),
+  manifestEntry(Divider, dividerManifest),
+  manifestEntry(Icon, iconManifest),
+  manifestEntry(CheckBox, checkBoxManifest),
+  manifestEntry(RadioGroup, radioGroupManifest),
 ];
 
 interface InitData {
@@ -83,9 +93,6 @@ interface InitData {
 }
 
 type Theme = 'light' | 'dark';
-
-type A2uiMessage = Record<string, unknown> & { messageId?: string };
-type ResponseMessages = A2uiMessage[];
 type ActionMocks = Record<
   string,
   | ServerToClientMessage[]
@@ -184,40 +191,21 @@ function mergeInitDataPreferLeft(a: InitData, b: InitData): InitData {
   };
 }
 
-function normalizePayloadToMessages(payload: unknown): ResponseMessages {
-  if (payload === null || payload === undefined) return [];
-  if (Array.isArray(payload)) return payload as ResponseMessages;
-  if (typeof payload === 'string') {
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-      const parsed = JSON.parse(payload);
-      return normalizePayloadToMessages(parsed);
-    } catch {
-      return [];
-    }
-  }
-  if (
-    typeof payload === 'object'
-    && Array.isArray((payload as Record<string, unknown>).messages)
-  ) {
-    return (payload as Record<string, unknown>).messages as ResponseMessages;
-  }
-  return [];
-}
-
-async function loadMessages(initData: InitData): Promise<ResponseMessages> {
+async function loadMessages(
+  initData: InitData,
+): Promise<ServerToClientMessage[]> {
   if (initData.messagesUrl) {
     // eslint-disable-next-line n/no-unsupported-features/node-builtins
     const res = await fetch(initData.messagesUrl, { cache: 'no-store' });
     const text = await res.text();
     try {
-      return normalizePayloadToMessages(JSON.parse(text));
+      return normalizeProtocolMessages(JSON.parse(text));
     } catch {
-      return normalizePayloadToMessages(text);
+      return normalizeProtocolMessages(text);
     }
   }
   if (initData.messages !== undefined) {
-    return normalizePayloadToMessages(initData.messages);
+    return normalizeProtocolMessages(initData.messages);
   }
   return [];
 }
@@ -414,12 +402,10 @@ export function App() {
         loadActionMocks(streamConfig as InitData),
       ]);
 
-      const initialMessages = rawMessages as ServerToClientMessage[];
+      const initialMessages = rawMessages;
       const actionMocks: ActionMocks = {};
       for (const [name, value] of Object.entries(rawActionMocks)) {
-        actionMocks[name] = normalizePayloadToMessages(
-          value,
-        ) as ServerToClientMessage[];
+        actionMocks[name] = normalizeProtocolMessages(value);
       }
 
       const next = createMessageStore();
diff --git a/packages/genui/a2ui-playground/src/components/MobilePreview.tsx b/packages/genui/a2ui-playground/src/components/MobilePreview.tsx
index 4218d27d53..f22af51b0f 100644
--- a/packages/genui/a2ui-playground/src/components/MobilePreview.tsx
+++ b/packages/genui/a2ui-playground/src/components/MobilePreview.tsx
@@ -1,7 +1,15 @@
 // Copyright 2026 The Lynx Authors. All rights reserved.
 // Licensed under the Apache License Version 2.0 that can be found in the
 // LICENSE file in the root directory of this source tree.
-export function MobilePreview(props: { src: string }) {
+import type { ComponentPropsWithoutRef, Ref } from 'react';
+
+interface MobilePreviewProps {
+  src: string;
+  iframeRef?: Ref<HTMLIFrameElement>;
+  onLoad?: ComponentPropsWithoutRef<'iframe'>['onLoad'];
+}
+
+export function MobilePreview(props: MobilePreviewProps) {
   return (
     <div className='phoneWrap'>
       <div className='phoneFrame'>
@@ -10,7 +18,13 @@ export function MobilePreview(props: { src: string }) {
           <div className='phoneSpeaker' />
         </div>
         <div className='phoneScreen'>
-          <iframe className='phoneIframe' title='preview' src={props.src} />
+          <iframe
+            ref={props.iframeRef}
+            className='phoneIframe'
+            title='preview'
+            src={props.src}
+            onLoad={props.onLoad}
+          />
         </div>
         <div className='phoneHomeIndicator' />
       </div>
diff --git a/packages/genui/a2ui-playground/src/pages/AIChatPage.tsx b/packages/genui/a2ui-playground/src/pages/AIChatPage.tsx
index 0e24b22fe6..175a3a4dad 100644
--- a/packages/genui/a2ui-playground/src/pages/AIChatPage.tsx
+++ b/packages/genui/a2ui-playground/src/pages/AIChatPage.tsx
@@ -1,57 +1,341 @@
 // Copyright 2026 The Lynx Authors. All rights reserved.
 // Licensed under the Apache License Version 2.0 that can be found in the
 // LICENSE file in the root directory of this source tree.
-import { useCallback, useEffect, useRef, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import './AIChatPage.css';
 
 import { PanelResizeHandle } from '../components/PanelResizeHandle.js';
 import { PreviewPanel } from '../components/PreviewPanel.js';
 import { PreviewViewport } from '../components/PreviewViewport.js';
+import { QrCode } from '../components/QrCode.js';
 import { useResizablePanels } from '../hooks/useResizablePanels.js';
+import { DEFAULT_A2UI_DEMO_URL } from '../utils/demoUrl.js';
 import type { Protocol } from '../utils/protocol.js';
+import { buildRenderUrl } from '../utils/renderUrl.js';
 
 interface ChatMessage {
   role: 'user' | 'ai';
   content: string | React.ReactNode;
 }
 
+interface ModelChatMessage {
+  role: 'user' | 'assistant' | 'system';
+  content: string;
+}
+
+interface SseEvent {
+  event: string;
+  data: unknown;
+}
+
+interface A2UIDonePayload {
+  ok?: unknown;
+  text?: unknown;
+  errors?: unknown;
+  validation?: {
+    ok?: unknown;
+    messages?: unknown;
+    errors?: unknown;
+  };
+  error?: unknown;
+  message?: unknown;
+}
+
+interface BrowserResponse {
+  headers: {
+    get(name: string): string | null;
+  };
+  body: {
+    getReader(): {
+      read(): Promise<{
+        done: boolean;
+        value?: Uint8Array;
+      }>;
+    };
+  } | null;
+  json(): Promise<unknown>;
+}
+
 const WELCOME_MESSAGE: ChatMessage = {
   role: 'ai',
   content:
     'I\'m A2UI Assistant. Describe the UI you want to build and I\'ll generate A2UI JSON for you.',
 };
 
-function createMockAiResponse(protocol: Protocol): ChatMessage {
-  return {
-    role: 'ai',
-    content: (
-      <>
-        AI generation is not yet connected. In the meantime, check out the{' '}
-        <a
-          href={`#/${protocol.name}/examples`}
-          style={{ textDecoration: 'underline' }}
-        >
-          Examples
-        </a>{' '}
-        tab to see pre-recorded A2UI scenarios with simulated streaming — you
-        can even adjust the playback speed.
-      </>
-    ),
-  };
-}
-
 const DESKTOP_PREVIEW_MIN_WIDTH = 360;
 const DESKTOP_CHAT_MIN_WIDTH = 360;
 const COMPACT_CHAT_MIN_HEIGHT = 280;
 const COMPACT_PREVIEW_MIN_HEIGHT = 320;
 const RESIZE_BREAKPOINT = 980;
+const ONLINE_A2UI_CHAT_URL = '/a2ui/stream';
+const LOCAL_A2UI_SERVER_PORT = '3060';
+
+function isDevHost(hostname: string): boolean {
+  return (
+    hostname === 'localhost'
+    || hostname === '127.0.0.1'
+    || hostname === '0.0.0.0'
+    || hostname.startsWith('10.')
+    || hostname.startsWith('192.168.')
+    || /^172\.(?:1[6-9]|2\d|3[01])\./u.test(hostname)
+  );
+}
+
+function resolveTrustedA2UIEndpoint(raw: string): string | null {
+  try {
+    const endpoint = new URL(raw, window.location.origin);
+    if (endpoint.origin === window.location.origin) {
+      return endpoint.toString();
+    }
+
+    const isTrustedDevEndpoint = endpoint.protocol === 'http:'
+      && endpoint.port === LOCAL_A2UI_SERVER_PORT
+      && isDevHost(endpoint.hostname);
+    return isTrustedDevEndpoint ? endpoint.toString() : null;
+  } catch {
+    return null;
+  }
+}
+
+function getA2UIChatEndpoint(): string {
+  const fromQuery = new URLSearchParams(window.location.search).get(
+    'a2uiEndpoint',
+  );
+  if (fromQuery) {
+    const trustedEndpoint = resolveTrustedA2UIEndpoint(fromQuery);
+    if (trustedEndpoint) return trustedEndpoint;
+  }
+  if (
+    window.location.protocol === 'http:' && isDevHost(window.location.hostname)
+  ) {
+    return `http://${window.location.hostname}:${LOCAL_A2UI_SERVER_PORT}/a2ui/chat`;
+  }
+  return ONLINE_A2UI_CHAT_URL;
+}
+
+function getErrorMessage(error: unknown): string {
+  if (error instanceof Error) return error.message;
+  return String(error);
+}
+
+function normalizeErrorPayload(payload: unknown): string {
+  if (payload && typeof payload === 'object') {
+    const record = payload as A2UIDonePayload;
+    if (Array.isArray(record.errors) && record.errors.length > 0) {
+      return record.errors
+        .filter((item): item is string => typeof item === 'string')
+        .join(' ');
+    }
+    if (
+      record.validation
+      && Array.isArray(record.validation.errors)
+      && record.validation.errors.length > 0
+    ) {
+      return record.validation.errors
+        .filter((item): item is string => typeof item === 'string')
+        .join(' ');
+    }
+    if (typeof record.error === 'string') return record.error;
+    if (typeof record.message === 'string') return record.message;
+  }
+  return getErrorMessage(payload);
+}
+
+function parseSseData(raw: string): unknown {
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw) as unknown;
+  } catch {
+    return raw;
+  }
+}
+
+function parseSseFrame(frame: string): SseEvent | null {
+  const lines = frame.split(/\r?\n/u);
+  let event = 'message';
+  const dataLines: string[] = [];
+
+  for (const line of lines) {
+    if (line.startsWith('event:')) {
+      event = line.slice('event:'.length).trim();
+      continue;
+    }
+    if (line.startsWith('data:')) {
+      dataLines.push(line.slice('data:'.length).trimStart());
+    }
+  }
+
+  if (dataLines.length === 0) return null;
+  return { event, data: parseSseData(dataLines.join('\n')) };
+}
+
+function normalizeA2UIMessages(payload: unknown): unknown[] {
+  if (Array.isArray(payload)) return payload;
+  if (typeof payload === 'string') {
+    try {
+      return normalizeA2UIMessages(JSON.parse(payload));
+    } catch {
+      return [];
+    }
+  }
+  if (payload && typeof payload === 'object') {
+    const record = payload as A2UIDonePayload & { messages?: unknown };
+    if (Array.isArray(record.messages) && record.messages.length > 0) {
+      return record.messages;
+    }
+    if (
+      record.validation
+      && Array.isArray(record.validation.messages)
+      && record.validation.messages.length > 0
+    ) {
+      return record.validation.messages;
+    }
+    if (typeof record.text === 'string') {
+      return normalizeA2UIMessages(record.text);
+    }
+  }
+  return [];
+}
+
+function parseCompletedArrayItems(raw: string): unknown[] {
+  const trimmed = raw.trimStart();
+  if (!trimmed.startsWith('[')) return [];
+
+  const items: unknown[] = [];
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  let itemStart = -1;
+
+  for (let i = 0; i < trimmed.length; i++) {
+    const ch = trimmed[i];
+
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === '\\') {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+
+    if (ch === '{' || ch === '[') {
+      depth++;
+      if (depth === 2 && ch === '{') {
+        itemStart = i;
+      }
+      continue;
+    }
+
+    if (ch === '}' || ch === ']') {
+      if (depth === 2 && ch === '}' && itemStart !== -1) {
+        const candidate = trimmed.slice(itemStart, i + 1);
+        try {
+          items.push(JSON.parse(candidate));
+        } catch {
+          return items;
+        }
+        itemStart = -1;
+      }
+      depth--;
+    }
+  }
+
+  return items;
+}
+
+async function readA2UIResponse(
+  response: BrowserResponse,
+  onText: (text: string) => void,
+  onMessages: (messages: unknown[]) => void,
+): Promise<unknown[]> {
+  const contentType = response.headers.get('content-type') ?? '';
+  if (!contentType.includes('text/event-stream')) {
+    const payload = await response.json();
+    const messages = normalizeA2UIMessages(payload);
+    if (messages.length === 0) {
+      throw new Error(normalizeErrorPayload(payload));
+    }
+    onMessages(messages);
+    return messages;
+  }
+
+  const reader = response.body?.getReader();
+  if (!reader) return [];
+
+  const decoder = new TextDecoder();
+  let buffer = '';
+  let generatedText = '';
+  let latestMessages: unknown[] = [];
+
+  while (true) {
+    const { done, value } = await reader.read();
+    buffer += decoder.decode(value, { stream: !done });
+    const frames = buffer.split(/\r?\n\r?\n/u);
+    buffer = frames.pop() ?? '';
+
+    for (const frame of frames) {
+      const parsed = parseSseFrame(frame);
+      if (!parsed) continue;
+
+      if (parsed.event === 'delta') {
+        const data = parsed.data as { text?: unknown };
+        if (typeof data.text === 'string') {
+          generatedText += data.text;
+          onText(generatedText);
+          const completed = parseCompletedArrayItems(generatedText);
+          if (completed.length > latestMessages.length) {
+            latestMessages = completed;
+            onMessages(latestMessages);
+          }
+        }
+        continue;
+      }
+
+      if (parsed.event === 'done') {
+        const doneMessages = normalizeA2UIMessages(parsed.data);
+        if (doneMessages.length > 0) {
+          latestMessages = doneMessages;
+          onMessages(latestMessages);
+        } else {
+          throw new Error(normalizeErrorPayload(parsed.data));
+        }
+        return latestMessages;
+      }
+
+      if (parsed.event === 'error') {
+        throw new Error(normalizeErrorPayload(parsed.data));
+      }
+    }
+
+    if (done) break;
+  }
+
+  return latestMessages.length > 0
+    ? latestMessages
+    : normalizeA2UIMessages(generatedText);
+}
 
 export function AIChatPage(props: { protocol: Protocol }) {
   const { protocol } = props;
   const [messages, setMessages] = useState<ChatMessage[]>([WELCOME_MESSAGE]);
   const [inputValue, setInputValue] = useState<string>('');
+  const [renderUrl, setRenderUrl] = useState<string>('');
+  const [generatedJson, setGeneratedJson] = useState<string>('');
+  const [isGenerating, setIsGenerating] = useState<boolean>(false);
   const messagesEndRef = useRef<HTMLDivElement>(null);
+  const previewFrameRef = useRef<HTMLIFrameElement | null>(null);
+  const abortRef = useRef<AbortController | null>(null);
+  const conversationRef = useRef<ModelChatMessage[]>([]);
+  const latestPreviewMessagesRef = useRef<unknown[]>([]);
   const {
     containerRef: pageRef,
     handleResizeStart: handlePanelResizeStart,
@@ -73,22 +357,139 @@ export function AIChatPage(props: { protocol: Protocol }) {
     messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
   });
 
+  const baseUrl = useMemo(() => window.location.href.replace(/#.*$/, ''), []);
+
+  const publishPreviewMessages = useCallback(
+    (nextMessages: unknown[]) => {
+      if (nextMessages.length === 0) return;
+      latestPreviewMessagesRef.current = nextMessages;
+
+      const initData = {
+        protocol,
+        demoUrl: DEFAULT_A2UI_DEMO_URL,
+        messages: nextMessages,
+        instant: true,
+      };
+
+      setRenderUrl((current) => {
+        if (current) {
+          previewFrameRef.current?.contentWindow?.postMessage(
+            { type: 'INIT_LYNX_VIEW', data: initData },
+            window.location.origin,
+          );
+          return current;
+        }
+
+        return buildRenderUrl(initData, baseUrl);
+      });
+    },
+    [baseUrl, protocol],
+  );
+
+  const handlePreviewLoad = useCallback(() => {
+    publishPreviewMessages(latestPreviewMessagesRef.current);
+  }, [publishPreviewMessages]);
+
+  useEffect(() => {
+    return () => {
+      abortRef.current?.abort();
+    };
+  }, []);
+
   const handleSend = useCallback(() => {
     const text = inputValue.trim();
-    if (!text) {
+    if (!text || isGenerating) {
       return;
     }
 
+    abortRef.current?.abort();
+    const controller = new AbortController();
+    abortRef.current = controller;
+
+    const userMessage: ModelChatMessage = { role: 'user', content: text };
+    const nextConversation = [...conversationRef.current, userMessage];
+    conversationRef.current = nextConversation;
+
     setMessages((prev) => [
       ...prev,
       { role: 'user', content: text },
+      { role: 'ai', content: 'Connecting to A2UI agent...' },
     ]);
     setInputValue('');
+    setGeneratedJson('');
+    setIsGenerating(true);
+
+    void (async () => {
+      try {
+        const response = await window.fetch(getA2UIChatEndpoint(), {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ messages: nextConversation }),
+          signal: controller.signal,
+        });
+
+        if (!response.ok) {
+          throw new Error(`A2UI agent request failed: ${response.status}`);
+        }
+
+        let latestText = '';
+        const finalMessages = await readA2UIResponse(
+          response,
+          (nextText) => {
+            latestText = nextText;
+            setGeneratedJson(nextText);
+            setMessages((prev) => {
+              const next = prev.slice();
+              next[next.length - 1] = {
+                role: 'ai',
+                content: `Generating A2UI JSON... ${nextText.length} chars`,
+              };
+              return next;
+            });
+          },
+          publishPreviewMessages,
+        );
+
+        if (finalMessages.length === 0) {
+          throw new Error('A2UI agent did not return valid messages');
+        }
 
-    setTimeout(() => {
-      setMessages((prev) => [...prev, createMockAiResponse(protocol)]);
-    }, 600);
-  }, [inputValue, protocol]);
+        const assistantContent = latestText.length > 0
+          ? latestText
+          : JSON.stringify(finalMessages);
+        conversationRef.current = [
+          ...nextConversation,
+          { role: 'assistant', content: assistantContent },
+        ];
+        setMessages((prev) => {
+          const next = prev.slice();
+          next[next.length - 1] = {
+            role: 'ai',
+            content: `Done. Rendered ${finalMessages.length} A2UI message${
+              finalMessages.length === 1 ? '' : 's'
+            }.`,
+          };
+          return next;
+        });
+      } catch (e) {
+        if (controller.signal.aborted) return;
+        conversationRef.current = nextConversation.slice(0, -1);
+        setMessages((prev) => {
+          const next = prev.slice();
+          next[next.length - 1] = {
+            role: 'ai',
+            content: `Generation failed: ${getErrorMessage(e)}`,
+          };
+          return next;
+        });
+      } finally {
+        if (abortRef.current === controller) {
+          abortRef.current = null;
+        }
+        setIsGenerating(false);
+      }
+    })();
+  }, [inputValue, isGenerating, publishPreviewMessages]);
 
   const handleKeyDown = useCallback(
     (e: React.KeyboardEvent<HTMLInputElement>) => {
@@ -108,7 +509,7 @@ export function AIChatPage(props: { protocol: Protocol }) {
         <div className='chatHeader'>
           <div className='chatHeaderTitleRow'>
             <h2 className='chatHeaderTitle'>Create</h2>
-            <span className='constructionBadge'>Under construction</span>
+            <span className='constructionBadge'>Online Agent</span>
           </div>
           <p className='chatHeaderSub'>Describe the UI you want to build</p>
         </div>
@@ -133,15 +534,17 @@ export function AIChatPage(props: { protocol: Protocol }) {
             type='text'
             placeholder='Describe the UI you want to generate...'
             value={inputValue}
+            disabled={isGenerating}
             onChange={(e) => setInputValue(e.target.value)}
             onKeyDown={handleKeyDown}
           />
           <button
             className='chatSendBtn'
             type='button'
+            disabled={isGenerating}
             onClick={handleSend}
           >
-            Send
+            {isGenerating ? 'Sending' : 'Send'}
           </button>
         </div>
       </div>
@@ -157,16 +560,45 @@ export function AIChatPage(props: { protocol: Protocol }) {
         className='previewPanel'
         style={previewPanelStyle}
         title='Lynx Preview'
-        previewSource={{
-          kind: 'placeholder',
-          item: {
-            title: 'View on Device',
-            description: 'Scan the QR code to preview on your mobile device.',
-            placeholder: 'No render',
-          },
-        }}
+        showPreviewModeSwitch
+        afterBody={
+          <>
+            {generatedJson
+              ? (
+                <div className='chatGeneratedJson'>
+                  <div className='chatGeneratedJsonTitle'>Generated JSON</div>
+                  <pre>{generatedJson}</pre>
+                </div>
+              )
+              : null}
+
+            <div className='previewQrSection'>
+              <div className='previewQrContent'>
+                <div className='previewQrInfo'>
+                  <div className='previewQrTitle'>View on Device</div>
+                  <div className='previewQrDesc'>
+                    Scan the QR code to preview on your mobile device.
+                  </div>
+                </div>
+                {renderUrl
+                  ? <QrCode value={renderUrl} size={80} />
+                  : (
+                    <div className='previewQrPlaceholder'>
+                      <span className='previewQrPlaceholderText'>
+                        No render
+                      </span>
+                    </div>
+                  )}
+              </div>
+            </div>
+          </>
+        }
       >
         <PreviewViewport
+          src={renderUrl}
+          iframeRef={previewFrameRef}
+          onLoad={handlePreviewLoad}
+          retainPreviousFrame
           emptyIcon='💬'
           emptyTitle='Send a message to generate UI'
           emptySubTitle='Generated components will be previewed here'
diff --git a/packages/genui/a2ui-playground/src/styles.css b/packages/genui/a2ui-playground/src/styles.css
index 0f34369f3e..52c1f171a8 100644
--- a/packages/genui/a2ui-playground/src/styles.css
+++ b/packages/genui/a2ui-playground/src/styles.css
@@ -1055,7 +1055,6 @@ html[data-theme="dark"] .phoneHomeIndicator {
 .previewEmptySub {
   font-size: 12px;
 }
-
 /* ── Responsive ── */
 @media (max-width: 980px) {
   .tabNav {
diff --git a/packages/genui/server/AGENTS.md b/packages/genui/server/AGENTS.md
new file mode 100644
index 0000000000..f911a2b619
--- /dev/null
+++ b/packages/genui/server/AGENTS.md
@@ -0,0 +1,118 @@
+# A2UI Server
+
+This package contains the Next.js server for A2UI agent APIs.
+
+## Deployment Model
+
+This server is designed for a **long-lived, single Node.js process**
+(VM, container, or persistent host). It is **not suitable for serverless
+or multi-replica deployments** without an external session store, because:
+
+- Conversation memory (`conversations`) and the agent cache
+  (`agentCache`) live in process memory.
+- The rate limiter is process-local.
+- The OpenAI agent service is a `globalThis` singleton.
+
+If you must run behind serverless (e.g. Vercel Functions) or with
+horizontal scale, plan to externalize state (Redis, Postgres) and front
+the deployment with a shared rate limiter (e.g. an API gateway).
+
+## Required Environment Variables
+
+Before starting this server, explicitly provide these three environment
+variables:
+
+```bash
+export OPENAI_API_KEY="..."
+export OPENAI_BASE_URL="..."
+export OPENAI_MODEL="..."
+```
+
+- `OPENAI_API_KEY` is required by the OpenAI provider.
+- `OPENAI_BASE_URL` selects the OpenAI-compatible API endpoint.
+- `OPENAI_MODEL` selects the model used by the A2UI agent.
+
+The server fails fast at startup (via `instrumentation.ts`) when any of
+these are missing in production. In development, a warning is logged
+instead so the playground keeps working.
+
+## Security
+
+By default, request bodies submitted to `/a2ui/chat`, `/a2ui/stream`,
+and `/a2ui/action` **cannot** override `apiKey` or `baseURL`. This
+prevents an unauthenticated client from turning the server into an open
+proxy that uses arbitrary keys against arbitrary OpenAI-compatible
+endpoints.
+
+For trusted local development workflows where overriding is desirable
+(e.g. the playground swapping providers), opt in explicitly:
+
+```bash
+export A2UI_ALLOW_CLIENT_OVERRIDE="1"
+```
+
+Do **not** enable this flag on a publicly reachable deployment unless
+authentication and an allow-list are added in front of the server.
+
+## Rate Limiting
+
+The `/a2ui/chat`, `/a2ui/stream`, and `/a2ui/action` routes share an
+in-process fixed-window rate limiter keyed by client IP (`x-forwarded-for`
+
+> `x-real-ip` > `unknown`). When a client exceeds the limit, the
+> JSON routes respond with HTTP `429` and the SSE route emits a single
+> `event: error` frame; both responses include the standard
+> `Retry-After` and `X-RateLimit-*` headers.
+
+Tune the limiter with the following optional environment variables:
+
+```bash
+# Maximum number of requests allowed per window per client (default: 20).
+export A2UI_RATE_LIMIT_PER_MIN="20"
+
+# Window size in milliseconds (default: 60000).
+export A2UI_RATE_LIMIT_WINDOW_MS="60000"
+```
+
+Because the counter is in-process, it resets on every server restart and
+is not shared across replicas. For multi-instance deployments, place a
+shared rate limiter (e.g. an API gateway or Redis-backed limiter) in
+front of this server.
+
+## Conversation Memory
+
+Per-thread conversation history is held in memory and pruned with two
+mechanisms:
+
+- **TTL eviction**: threads idle longer than `A2UI_THREAD_TTL_MS`
+  (default `1800000`, i.e. 30 minutes) are dropped on the next sweep.
+- **LRU cap**: at most `A2UI_MAX_THREADS` (default `500`) threads are
+  retained; the oldest are evicted when the cap is exceeded.
+
+Sweeps are amortized: each call into `getConversation` triggers a sweep
+at most once per minute, so the steady-state cost stays close to O(1).
+Restarting the server clears all conversation memory.
+
+```bash
+export A2UI_THREAD_TTL_MS="1800000"
+export A2UI_MAX_THREADS="500"
+```
+
+## Development
+
+Run the development server from this package:
+
+```bash
+pnpm dev
+```
+
+The server listens on port `3060` by default.
+
+## Production
+
+Build and start the production server from this package:
+
+```bash
+pnpm build
+pnpm start
+```
diff --git a/packages/genui/server/agent/a2ui-agent.ts b/packages/genui/server/agent/a2ui-agent.ts
new file mode 100644
index 0000000000..726d394d05
--- /dev/null
+++ b/packages/genui/server/agent/a2ui-agent.ts
@@ -0,0 +1,54 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { Agent } from '@mastra/core/agent';
+
+import { BASIC_CATALOG } from './a2ui-catalog';
+import type { A2UICatalog } from './a2ui-catalog';
+import { buildA2UISystemPrompt } from './a2ui-prompt';
+import { createLLMProvider } from './openai-provider';
+import type { OpenAIProviderOptions } from './openai-provider';
+
+export interface A2UIAgentOptions extends OpenAIProviderOptions {
+  catalog?: A2UICatalog | undefined;
+  systemAppendix?: string | undefined;
+}
+
+interface A2UIAgentRunOptions {
+  threadId?: string | undefined;
+  resourceId?: string | undefined;
+}
+
+export interface A2UIAgent {
+  generate: (
+    messages: unknown,
+    options?: A2UIAgentRunOptions,
+  ) => unknown;
+  stream: (
+    messages: unknown,
+    options?: A2UIAgentRunOptions,
+  ) => unknown;
+}
+
+export function createA2UIAgent(opts: A2UIAgentOptions = {}) {
+  const { buildModel, model } = createLLMProvider(opts);
+
+  const catalog = opts.catalog ?? BASIC_CATALOG;
+  const promptOptions = {
+    catalog,
+    ...(opts.systemAppendix === undefined
+      ? {}
+      : { appendix: opts.systemAppendix }),
+  };
+  const instructions = buildA2UISystemPrompt(promptOptions);
+
+  const agent = new Agent({
+    id: 'a2ui-agent',
+    name: 'A2UIAgent',
+    instructions,
+    model: buildModel(model),
+  }) as unknown as A2UIAgent;
+
+  return { agent, model, catalog };
+}
diff --git a/packages/genui/server/agent/a2ui-catalog.ts b/packages/genui/server/agent/a2ui-catalog.ts
new file mode 100644
index 0000000000..ab94b47387
--- /dev/null
+++ b/packages/genui/server/agent/a2ui-catalog.ts
@@ -0,0 +1,336 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+export interface A2UIComponentProp {
+  name: string;
+  type: string;
+  description?: string;
+  required?: boolean;
+  enums?: readonly string[];
+}
+
+export interface A2UIComponentSpec {
+  name: string;
+  summary: string;
+  props: A2UIComponentProp[];
+  requiresAction?: boolean;
+  containerShape?: 'children' | 'child' | 'tabs' | 'trigger-content' | 'none';
+}
+
+export interface A2UICatalog {
+  id: string;
+  label: string;
+  version?: string;
+  components: A2UIComponentSpec[];
+  extraRules?: string[];
+  examples?: string[];
+}
+
+export const BASIC_CATALOG_ID =
+  'https://a2ui.org/specification/v0_9/basic_catalog.json';
+
+const prop = (
+  name: string,
+  type: string,
+  required = false,
+  description = '',
+  enums?: readonly string[],
+): A2UIComponentProp => ({
+  name,
+  type,
+  required,
+  description,
+  ...(enums === undefined ? {} : { enums }),
+});
+
+const DYN = 'DynamicString (string | { path: string })';
+
+export const BASIC_CATALOG: A2UICatalog = {
+  id: BASIC_CATALOG_ID,
+  label: 'A2UI basic catalog (v0.9)',
+  version: 'v0.9',
+  components: [
+    {
+      name: 'Text',
+      summary: 'Display styled text. Supports basic markdown.',
+      props: [
+        prop('text', DYN, true, 'The text content.'),
+        prop(
+          'variant',
+          'string',
+          false,
+          'Typography style.',
+          ['h1', 'h2', 'h3', 'h4', 'h5', 'caption', 'body'],
+        ),
+      ],
+    },
+    {
+      name: 'Image',
+      summary: 'Display an image by URL.',
+      props: [
+        prop('url', DYN, true, 'Image URL.'),
+        prop('description', DYN, false, 'Accessibility / alt text.'),
+        prop(
+          'fit',
+          'string',
+          false,
+          'How the image is resized.',
+          ['contain', 'cover', 'fill', 'none', 'scaleDown'],
+        ),
+        prop(
+          'variant',
+          'string',
+          false,
+          'Size hint.',
+          [
+            'icon',
+            'avatar',
+            'smallFeature',
+            'mediumFeature',
+            'largeFeature',
+            'header',
+          ],
+        ),
+      ],
+    },
+    {
+      name: 'Icon',
+      summary: 'Display a material-style icon by name.',
+      props: [
+        prop(
+          'name',
+          'string | { path: string }',
+          true,
+          'One of the icon enum names, or { path } for a custom path.',
+        ),
+      ],
+    },
+    {
+      name: 'Video',
+      summary: 'Play a video from a URL.',
+      props: [prop('url', DYN, true, 'Video URL.')],
+    },
+    {
+      name: 'AudioPlayer',
+      summary: 'Play an audio file.',
+      props: [
+        prop('url', DYN, true, 'Audio URL.'),
+        prop('description', DYN, false, 'Title / summary.'),
+      ],
+    },
+    {
+      name: 'Divider',
+      summary: 'Horizontal or vertical separator line.',
+      props: [
+        prop('axis', 'string', false, 'Orientation.', [
+          'horizontal',
+          'vertical',
+        ]),
+      ],
+    },
+    {
+      name: 'Row',
+      summary: 'Horizontal layout container.',
+      containerShape: 'children',
+      props: [
+        prop(
+          'children',
+          'string[] | ChildTemplate',
+          true,
+          'Child ids or a template object.',
+        ),
+        prop('justify', 'string', false, 'Main-axis arrangement.', [
+          'start',
+          'center',
+          'end',
+          'spaceAround',
+          'spaceBetween',
+          'spaceEvenly',
+          'stretch',
+        ]),
+        prop('align', 'string', false, 'Cross-axis alignment.', [
+          'start',
+          'center',
+          'end',
+          'stretch',
+        ]),
+      ],
+    },
+    {
+      name: 'Column',
+      summary: 'Vertical layout container.',
+      containerShape: 'children',
+      props: [
+        prop(
+          'children',
+          'string[] | ChildTemplate',
+          true,
+          'Child ids or a template object.',
+        ),
+        prop('justify', 'string', false, 'Main-axis arrangement.', [
+          'start',
+          'center',
+          'end',
+          'spaceAround',
+          'spaceBetween',
+          'spaceEvenly',
+          'stretch',
+        ]),
+        prop('align', 'string', false, 'Cross-axis alignment.', [
+          'start',
+          'center',
+          'end',
+          'stretch',
+        ]),
+      ],
+    },
+    {
+      name: 'List',
+      summary: 'Repeating layout container, commonly bound to a data path.',
+      containerShape: 'children',
+      props: [
+        prop(
+          'children',
+          'string[] | ChildTemplate',
+          true,
+          'Child ids or a template object.',
+        ),
+        prop('direction', 'string', false, 'List direction.', [
+          'vertical',
+          'horizontal',
+        ]),
+        prop('align', 'string', false, 'Cross-axis alignment.', [
+          'start',
+          'center',
+          'end',
+          'stretch',
+        ]),
+      ],
+    },
+    {
+      name: 'Card',
+      summary:
+        'Card container with exactly one child. Wrap multiple elements in a Column/Row first.',
+      containerShape: 'child',
+      props: [
+        prop('child', 'string (component id)', true, 'The single child id.'),
+      ],
+    },
+    {
+      name: 'Tabs',
+      summary: 'Tabbed container; each tab references a child component id.',
+      containerShape: 'tabs',
+      props: [
+        prop(
+          'tabs',
+          'Array<{ title: DynamicString, child: string }>',
+          true,
+          'At least one tab.',
+        ),
+      ],
+    },
+    {
+      name: 'Modal',
+      summary: 'Modal dialog with a trigger component and a content component.',
+      containerShape: 'trigger-content',
+      props: [
+        prop('trigger', 'string (component id)', true, 'Id of the opener.'),
+        prop('content', 'string (component id)', true, 'Id of modal content.'),
+      ],
+    },
+    {
+      name: 'Button',
+      summary: 'Clickable button. MUST always include an action.',
+      requiresAction: true,
+      props: [
+        prop('label', DYN, true, 'Button label.'),
+        prop(
+          'action',
+          '{ name: string, context?: Record<string, any> }',
+          true,
+          'Action dispatched when clicked.',
+        ),
+        prop(
+          'variant',
+          'string',
+          false,
+          'Visual variant.',
+          ['primary', 'secondary', 'tertiary', 'destructive'],
+        ),
+      ],
+    },
+    {
+      name: 'TextField',
+      summary: 'Single-line text input bound to a data path.',
+      props: [
+        prop('label', DYN, false, 'Field label.'),
+        prop('value', '{ path: string }', true, 'Bound data path.'),
+        prop('action', 'Action', false, 'Optional on-change action.'),
+      ],
+    },
+    {
+      name: 'Checkbox',
+      summary: 'Boolean checkbox bound to a data path.',
+      props: [
+        prop('label', DYN, false, 'Checkbox label.'),
+        prop('value', '{ path: string }', true, 'Bound boolean path.'),
+        prop('action', 'Action', false, 'Optional on-change action.'),
+      ],
+    },
+    {
+      name: 'Slider',
+      summary: 'Numeric slider.',
+      props: [
+        prop('value', '{ path: string }', true, 'Bound numeric path.'),
+        prop('min', 'number', false),
+        prop('max', 'number', false),
+        prop('step', 'number', false),
+        prop('action', 'Action', false),
+      ],
+    },
+    {
+      name: 'DatePicker',
+      summary: 'Date selector.',
+      props: [
+        prop('value', '{ path: string }', true, 'Bound date path.'),
+        prop('action', 'Action', false),
+      ],
+    },
+  ],
+};
+
+export function renderCatalogReference(catalog: A2UICatalog): string {
+  const lines: string[] = [];
+  lines.push(
+    `## Component catalog (${catalog.label}; catalogId=${catalog.id})`,
+  );
+  lines.push('');
+  for (const c of catalog.components) {
+    const required = c.props
+      .filter((p) => p.required)
+      .map((p) => p.name)
+      .join(', ');
+    const header = required
+      ? `### ${c.name}  (required: ${required})`
+      : `### ${c.name}`;
+    lines.push(header);
+    lines.push(`- ${c.summary}`);
+    for (const p of c.props) {
+      const req = p.required ? ' [required]' : '';
+      const en = p.enums ? `  enum: ${p.enums.join(' | ')}` : '';
+      const desc = p.description ? ` — ${p.description}` : '';
+      lines.push(`  · ${p.name}: ${p.type}${req}${desc}${en}`);
+    }
+    if (c.requiresAction) {
+      lines.push('  · NOTE: this component MUST include a non-empty `action`.');
+    }
+    lines.push('');
+  }
+  if (catalog.extraRules !== undefined && catalog.extraRules.length > 0) {
+    lines.push('### Additional catalog rules');
+    for (const r of catalog.extraRules) lines.push(`- ${r}`);
+    lines.push('');
+  }
+  return lines.join('\n');
+}
diff --git a/packages/genui/server/agent/a2ui-prompt.ts b/packages/genui/server/agent/a2ui-prompt.ts
new file mode 100644
index 0000000000..275c8898ee
--- /dev/null
+++ b/packages/genui/server/agent/a2ui-prompt.ts
@@ -0,0 +1,194 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import type { A2UICatalog } from './a2ui-catalog';
+import { BASIC_CATALOG, renderCatalogReference } from './a2ui-catalog';
+
+export const A2UI_PROTOCOL_VERSION = 'v0.9';
+
+const PROTOCOL_OVERVIEW = `# A2UI (Agent-to-UI) Protocol v0.9
+
+A2UI is a JSON-based, streaming UI protocol from Google
+(https://github.com/google/A2UI). It lets an LLM agent describe a user interface
+by emitting a sequence of declarative JSON messages that a renderer turns into
+native widgets. There is NO arbitrary code: the renderer only knows the
+components in the agreed-upon catalog.
+
+## Official v0.9 design principles
+- Prompt-first: v0.9 is meant to be embedded directly in the model prompt, so
+  emit JSON that follows the in-context schema and examples exactly.
+- Safe like data, expressive like code: describe UI intent using trusted catalog
+  components only. Never emit JavaScript, HTML, CSS, event handlers or scripts.
+- Structure/data separation: component messages define the flat UI structure;
+  data model messages populate or change values used by dynamic bindings.
+- Progressive rendering: clients may render after each valid message. Prefer a
+  useful minimal UI first, then add data and refinements in later messages.
+- Transport-agnostic: A2UI messages can travel over SSE, REST, WebSocket, A2A,
+  AG UI or MCP. This service wraps the streamed messages in one JSON array for
+  validation and transport convenience.
+
+## Server-to-client message types
+Every message MUST be a top-level JSON object with the field "version": "v0.9"
+and exactly ONE of the following keys:
+
+1. "createSurface"   – initialise a new UI surface.
+2. "updateComponents" – send/replace the list of components on a surface.
+3. "updateDataModel" – set values inside the surface's data model.
+4. "deleteSurface"   – tear down a surface.
+
+## Required ordering for a fresh response
+1. createSurface  (with surfaceId + catalogId)
+2. updateComponents (the FIRST one MUST contain a component whose id is "root")
+3. zero or more updateDataModel  (populate dynamic data referenced by paths)
+4. (optional) further updateComponents / updateDataModel for incremental UI
+
+## Envelope semantics
+- createSurface creates a surface. Once created, its surfaceId and catalogId are
+  fixed. To change catalog/theme, delete and recreate the surface.
+- updateComponents adds or replaces component definitions for that surface. It
+  may reference data paths that will be populated by updateDataModel.
+- updateDataModel replaces the whole data model when "path" is omitted or "/".
+  With a specific "path", it replaces only the value at that JSON Pointer.
+- deleteSurface removes a surface when the UI is no longer needed.
+
+## Component model
+- Components are kept FLAT (adjacency-list style). Children are referenced by
+  string ids, never inlined.
+- Every component object has shape:
+    {
+      "id":        "string",       // unique within the surface
+      "component": "Text|Card|...", // discriminator from the catalog
+      ...component specific props
+    }
+- The component with id "root" is the entry point of the tree.
+- Layout containers (Row / Column / List) take "children": ["id1", "id2", ...]
+  OR a template object for repeating from the data model.
+- Card uses "child": "id".  Modal uses "trigger" + "content".  Tabs uses an
+  array of {title, child}.
+
+## Data binding
+- Static text:  "text": "Hello"
+- Bound text:   "text": { "path": "/user/name" }
+- Bound list children:
+    "children": { "template": { "path": "/items", "componentId": "itemRow" } }
+- Use updateDataModel messages to populate values at those paths.
+- DynamicString/DynamicNumber/DynamicBoolean props accept either a literal value
+  or { "path": "/json/pointer" }. If you bind a prop to a path, create the
+  matching value in updateDataModel.
+
+## Client-to-server events
+- Interactive components carry an "action":
+    { "name": "submit_booking",
+      "context": { "restaurantId": { "path": "/selected/id" } } }
+- The renderer will POST that action back to /a2ui/action with the same
+  surfaceId + threadId. Your next turn may receive an assistant message whose
+  content starts with "A2UI_USER_ACTION:" followed by JSON describing the
+  action; handle it by emitting additional updateComponents / updateDataModel
+  messages to update the same surface.
+`;
+
+function buildHardRules(catalogId: string): string {
+  return `## Hard rules
+1. Output MUST be a JSON ARRAY of A2UI messages. No prose, no Markdown, no
+   code fences, no XML. First character '[' – last character ']'.
+2. Each element MUST include "version": "v0.9".
+3. The first message MUST be createSurface with catalogId = "${catalogId}".
+   Use surfaceId "main" unless the user specifies otherwise.
+4. The second message MUST be updateComponents; its components list MUST
+   contain exactly one component with id "root".
+5. Use property-based component discriminators: "component": "Text", not
+   wrapper objects such as { "Text": {...} }.
+6. Children are referenced by id only. NEVER inline a child component.
+7. Container references MUST point to components present in the same response.
+8. Card.child is exactly one id; wrap multiple elements in Row/Column/List.
+9. Buttons MUST include a non-empty "action.name".
+10. Any "{path:...}" reference MUST be populated by some updateDataModel in the
+   same response.
+11. Ids are kebab-case, unique per surface ("root", "title-text", "submit-btn").
+12. Do not invent components outside the catalog.
+13. No comments, trailing commas or unknown fields.
+14. If the user asks for impossible, unsafe, or unsupported UI, render a concise
+    explanatory A2UI surface using supported components rather than prose.
+`;
+}
+
+const FEW_SHOT_EXAMPLE = `## Example response (login card)
+
+User: "Generate a login card with email + password and a submit button."
+
+Assistant (response body, raw JSON, no fences):
+[
+  {
+    "version": "v0.9",
+    "createSurface": {
+      "surfaceId": "main",
+      "catalogId": "https://a2ui.org/specification/v0_9/basic_catalog.json"
+    }
+  },
+  {
+    "version": "v0.9",
+    "updateComponents": {
+      "surfaceId": "main",
+      "components": [
+        { "id": "root",     "component": "Card",   "child": "form-col" },
+        { "id": "form-col", "component": "Column", "children": ["title", "email", "password", "submit"] },
+        { "id": "title",    "component": "Text",   "text": "Sign in",  "variant": "h2" },
+        { "id": "email",    "component": "TextField", "label": "Email",
+          "value": { "path": "/form/email" } },
+        { "id": "password", "component": "TextField", "label": "Password",
+          "value": { "path": "/form/password" } },
+        { "id": "submit",   "component": "Button",
+          "label": "Sign in",
+          "variant": "primary",
+          "action": {
+            "name": "submit_login",
+            "context": {
+              "email":    { "path": "/form/email" },
+              "password": { "path": "/form/password" }
+            }
+          }
+        }
+      ]
+    }
+  },
+  {
+    "version": "v0.9",
+    "updateDataModel": {
+      "surfaceId": "main",
+      "value": { "form": { "email": "", "password": "" } }
+    }
+  }
+]
+`;
+
+export interface BuildSystemPromptOptions {
+  catalog?: A2UICatalog;
+  appendix?: string;
+}
+
+export function buildA2UISystemPrompt(
+  opts: BuildSystemPromptOptions = {},
+): string {
+  const catalog = opts.catalog ?? BASIC_CATALOG;
+  const parts = [
+    'You are an A2UI (Agent-to-UI) generation agent. Translate the user\'s',
+    'natural-language request into a stream of A2UI v0.9 JSON messages that a',
+    'client renderer can consume. A downstream validator will reject malformed',
+    'output – if you violate the protocol the user sees nothing.',
+    '',
+    PROTOCOL_OVERVIEW,
+    '',
+    renderCatalogReference(catalog),
+    '',
+    buildHardRules(catalog.id),
+    '',
+    FEW_SHOT_EXAMPLE,
+  ];
+  if (opts.appendix) {
+    parts.push('', opts.appendix);
+  }
+  return parts.join('\n');
+}
+
+export const A2UI_SYSTEM_PROMPT = buildA2UISystemPrompt();
diff --git a/packages/genui/server/agent/a2ui-validator.ts b/packages/genui/server/agent/a2ui-validator.ts
new file mode 100644
index 0000000000..a660d2b1c3
--- /dev/null
+++ b/packages/genui/server/agent/a2ui-validator.ts
@@ -0,0 +1,460 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { z } from 'zod';
+
+import type { A2UICatalog } from './a2ui-catalog';
+
+const ChildTemplateSchema = z
+  .object({
+    template: z
+      .object({
+        path: z.string(),
+        componentId: z.string(),
+      })
+      .passthrough(),
+  })
+  .passthrough();
+
+void ChildTemplateSchema;
+
+const ComponentBase = z
+  .object({
+    id: z.string().min(1),
+    component: z.string().min(1),
+  })
+  .passthrough();
+type A2UIComponent = z.infer<typeof ComponentBase> & {
+  action?: unknown;
+  child?: unknown;
+  children?: unknown;
+  content?: unknown;
+  tabs?: unknown;
+  trigger?: unknown;
+};
+
+const CreateSurfaceMessage = z.object({
+  version: z.literal('v0.9'),
+  createSurface: z
+    .object({
+      surfaceId: z.string().min(1),
+      catalogId: z.string().min(1),
+      theme: z.record(z.string(), z.any()).optional(),
+      sendDataModel: z.boolean().optional(),
+    })
+    .passthrough(),
+}).strict();
+
+const UpdateComponentsMessage = z.object({
+  version: z.literal('v0.9'),
+  updateComponents: z
+    .object({
+      surfaceId: z.string().min(1),
+      components: z.array(ComponentBase).min(1),
+    })
+    .passthrough(),
+}).strict();
+
+const UpdateDataModelMessage = z.object({
+  version: z.literal('v0.9'),
+  updateDataModel: z
+    .object({
+      surfaceId: z.string().min(1),
+      path: z.string().optional(),
+      value: z.any().optional(),
+    })
+    .passthrough(),
+}).strict();
+
+const DeleteSurfaceMessage = z.object({
+  version: z.literal('v0.9'),
+  deleteSurface: z
+    .object({
+      surfaceId: z.string().min(1),
+    })
+    .passthrough(),
+}).strict();
+
+const A2UIMessage = z.union([
+  CreateSurfaceMessage,
+  UpdateComponentsMessage,
+  UpdateDataModelMessage,
+  DeleteSurfaceMessage,
+]);
+
+export const A2UIMessageArray = z.array(A2UIMessage).min(1);
+export type A2UIMessage = z.infer<typeof A2UIMessage>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object';
+}
+
+function hasActionName(value: unknown): value is { name: string } {
+  if (!isRecord(value)) return false;
+  const candidate = value as { name?: unknown };
+  return typeof candidate.name === 'string' && candidate.name.length > 0;
+}
+
+export interface ValidationResult {
+  ok: boolean;
+  messages: A2UIMessage[];
+  errors: string[];
+}
+
+function stripCodeFenceWrapper(text: string): string {
+  let body = text.trim();
+  if (body.startsWith('```')) {
+    const firstLineEnd = body.indexOf('\n');
+    const lastFenceStart = body.lastIndexOf('```');
+    if (firstLineEnd !== -1 && lastFenceStart > firstLineEnd) {
+      body = body.slice(firstLineEnd + 1, lastFenceStart).trim();
+    }
+  }
+  return body;
+}
+
+function unescapeInvalidBackticks(text: string): string {
+  // Some models emit "\`" inside JSON strings, which is not a valid JSON escape.
+  return text.replaceAll('\\`', '`');
+}
+
+function extractFirstBalancedJsonArray(text: string): string | null {
+  const start = text.indexOf('[');
+  if (start === -1) return null;
+
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === '\\') {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+
+    if (ch === '[') {
+      depth++;
+      continue;
+    }
+
+    if (ch === ']') {
+      depth--;
+      if (depth === 0) {
+        return text.slice(start, i + 1);
+      }
+    }
+  }
+
+  return null;
+}
+
+function normalizeCatalogId(catalogId: string): string {
+  const trimmed = catalogId.trim();
+  return trimmed.replace(/^`+/u, '').replace(/`+$/u, '').trim();
+}
+
+export function extractJsonArray(text: string): unknown {
+  if (!text || typeof text !== 'string') return null;
+  const body = unescapeInvalidBackticks(stripCodeFenceWrapper(text));
+  const candidates = [body, extractFirstBalancedJsonArray(body)]
+    .filter((candidate): candidate is string => Boolean(candidate));
+
+  for (const candidate of candidates) {
+    try {
+      return JSON.parse(candidate);
+    } catch {
+      // try the next candidate
+    }
+  }
+
+  return null;
+}
+
+export function validateA2UIOutput(
+  raw: string,
+  catalog: A2UICatalog,
+): ValidationResult {
+  const errors: string[] = [];
+  const parsed = extractJsonArray(raw);
+  if (parsed === null) {
+    return {
+      ok: false,
+      messages: [],
+      errors: [
+        'Response was not valid JSON. Output MUST be a raw JSON array of A2UI messages – no prose, no code fences.',
+      ],
+    };
+  }
+  const arr = A2UIMessageArray.safeParse(parsed);
+  if (!arr.success) {
+    for (const issue of arr.error.issues) {
+      errors.push(
+        `Schema violation at ${
+          issue.path.join('.') || '<root>'
+        }: ${issue.message}`,
+      );
+    }
+    return { ok: false, messages: [], errors };
+  }
+
+  const messages = arr.data.map((message) => {
+    if (!('createSurface' in message) || !message.createSurface) {
+      return message;
+    }
+
+    return {
+      ...message,
+      createSurface: {
+        ...message.createSurface,
+        catalogId: normalizeCatalogId(message.createSurface.catalogId),
+      },
+    };
+  });
+  const knownComponents = new Set(catalog.components.map((c) => c.name));
+  const requiresAction = new Set(
+    catalog.components.filter((c) => c.requiresAction).map((c) => c.name),
+  );
+
+  // structural checks ----------------------------------------------------
+  const firstMessage = messages[0];
+  const firstIsCreate = firstMessage
+    && 'createSurface' in firstMessage
+    && firstMessage.createSurface;
+  if (firstIsCreate) {
+    const catalogId = firstMessage.createSurface.catalogId;
+    if (catalogId !== catalog.id) {
+      errors.push(
+        `createSurface.catalogId must equal "${catalog.id}"; received "${catalogId}".`,
+      );
+    }
+  } else {
+    errors.push('The first message MUST be a createSurface.');
+  }
+
+  const surfaces = new Set<string>();
+  const componentsBySurface = new Map<string, Map<string, A2UIComponent>>();
+  const allPaths: { surfaceId: string; path: string }[] = [];
+  const providedPaths: { surfaceId: string; path: string }[] = [];
+
+  for (const msg of messages) {
+    if ('createSurface' in msg && msg.createSurface) {
+      surfaces.add(msg.createSurface.surfaceId);
+    } else if ('updateComponents' in msg && msg.updateComponents) {
+      const sId = msg.updateComponents.surfaceId;
+      if (!surfaces.has(sId)) {
+        errors.push(
+          `updateComponents references surfaceId "${sId}" before createSurface.`,
+        );
+      }
+      const bucket = componentsBySurface.get(sId)
+        ?? new Map<string, A2UIComponent>();
+      for (const rawComponent of msg.updateComponents.components) {
+        const comp = rawComponent as A2UIComponent;
+        if (!knownComponents.has(comp.component)) {
+          errors.push(
+            `Unknown component "${comp.component}" (id=${comp.id}). Allowed: ${
+              [...knownComponents].join(', ')
+            }.`,
+          );
+        }
+        if (bucket.has(comp.id)) {
+          errors.push(
+            `Duplicate component id "${comp.id}" in surface "${sId}".`,
+          );
+        }
+        bucket.set(comp.id, comp);
+        if (requiresAction.has(comp.component)) {
+          const action = comp.action;
+          if (!hasActionName(action)) {
+            errors.push(
+              `${comp.component} (id=${comp.id}) MUST carry action.name.`,
+            );
+          }
+        }
+        const componentPaths: string[] = [];
+        collectPaths(comp, componentPaths);
+        for (const path of componentPaths) {
+          allPaths.push({ surfaceId: sId, path });
+        }
+      }
+      componentsBySurface.set(sId, bucket);
+    } else if ('updateDataModel' in msg && msg.updateDataModel) {
+      const sId = msg.updateDataModel.surfaceId;
+      if (!surfaces.has(sId)) {
+        errors.push(
+          `updateDataModel references surfaceId "${sId}" before createSurface.`,
+        );
+      }
+      const updateDataModel = msg.updateDataModel as
+        & typeof msg.updateDataModel
+        & { value?: unknown };
+      if (
+        !('value' in updateDataModel) || updateDataModel.value === undefined
+      ) {
+        errors.push(
+          `updateDataModel for surface "${sId}" must include a defined value.`,
+        );
+        continue;
+      }
+      const basePath = updateDataModel.path ?? '/';
+      for (
+        const p of flattenProvidedPaths(
+          basePath,
+          updateDataModel.value,
+        )
+      ) {
+        providedPaths.push({ surfaceId: sId, path: p });
+      }
+    } else if ('deleteSurface' in msg && msg.deleteSurface) {
+      surfaces.delete(msg.deleteSurface.surfaceId);
+    }
+  }
+
+  // root existence -------------------------------------------------------
+  for (const [sId, bucket] of componentsBySurface) {
+    if (!bucket.has('root')) {
+      errors.push(
+        `Surface "${sId}" has components but no component with id "root".`,
+      );
+    }
+    // child references exist
+    for (const comp of bucket.values()) {
+      for (const ref of collectChildRefs(comp)) {
+        if (!bucket.has(ref)) {
+          errors.push(
+            `Component "${comp.id}" references missing child "${ref}" in surface "${sId}".`,
+          );
+        }
+      }
+    }
+  }
+
+  // path references -> data model coverage -------------------------------
+  const providedBySurface = new Map<string, Set<string>>();
+  for (const provided of providedPaths) {
+    const bucket = providedBySurface.get(provided.surfaceId)
+      ?? new Set<string>();
+    bucket.add(provided.path);
+    providedBySurface.set(provided.surfaceId, bucket);
+  }
+  for (const referenced of allPaths) {
+    const providedSet = providedBySurface.get(referenced.surfaceId)
+      ?? new Set<string>();
+    const hasMatch = [...providedSet].some(
+      (provided) =>
+        referenced.path === provided
+        || provided.startsWith(
+          referenced.path.endsWith('/')
+            ? referenced.path
+            : referenced.path + '/',
+        ),
+    );
+    if (!hasMatch) {
+      errors.push(
+        `Path "${referenced.path}" is referenced by a component in surface "${referenced.surfaceId}" but not populated by any updateDataModel message for that surface.`,
+      );
+    }
+  }
+
+  return {
+    ok: errors.length === 0,
+    messages: errors.length === 0 ? messages : [],
+    errors,
+  };
+}
+
+function collectPaths(node: unknown, acc: string[]): void {
+  if (!isRecord(node) && !Array.isArray(node)) return;
+  if (Array.isArray(node)) {
+    for (const item of node) collectPaths(item, acc);
+    return;
+  }
+  const record = node as Record<string, unknown> & { path?: unknown };
+  if (typeof record.path === 'string' && Object.keys(record).length <= 2) {
+    acc.push(record.path);
+    return;
+  }
+  for (const value of Object.values(record)) collectPaths(value, acc);
+}
+
+function collectChildRefs(comp: A2UIComponent): string[] {
+  const refs: string[] = [];
+  if (typeof comp.child === 'string') refs.push(comp.child);
+  if (typeof comp.trigger === 'string') refs.push(comp.trigger);
+  if (typeof comp.content === 'string') refs.push(comp.content);
+  if (Array.isArray(comp.children)) {
+    for (const c of comp.children) {
+      if (typeof c === 'string') refs.push(c);
+    }
+  } else if (isRecord(comp.children)) {
+    const children = comp.children as { template?: unknown };
+    const template = children.template;
+    if (isRecord(template)) {
+      const childTemplate = template as { componentId?: unknown };
+      if (typeof childTemplate.componentId === 'string') {
+        refs.push(childTemplate.componentId);
+      }
+    }
+  }
+  if (Array.isArray(comp.tabs)) {
+    for (const tab of comp.tabs) {
+      if (isRecord(tab)) {
+        const tabRecord = tab as { child?: unknown };
+        if (typeof tabRecord.child === 'string') {
+          refs.push(tabRecord.child);
+        }
+      }
+    }
+  }
+  return refs;
+}
+
+function flattenProvidedPaths(basePath: string, value: unknown): string[] {
+  const normalized = basePath.startsWith('/') ? basePath : '/' + basePath;
+  const paths: string[] = [];
+  walk(normalized === '/' ? '' : normalized, value, paths);
+  return paths.length > 0 ? paths : [normalized];
+}
+
+function walk(prefix: string, value: unknown, acc: string[]): void {
+  if (value === null || value === undefined) {
+    if (prefix) acc.push(prefix || '/');
+    return;
+  }
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    acc.push(prefix || '/');
+    return;
+  }
+  const entries = Object.entries(value as Record<string, unknown>);
+  if (entries.length === 0) {
+    acc.push(prefix || '/');
+    return;
+  }
+  for (const [k, v] of entries) {
+    walk(`${prefix}/${k}`, v, acc);
+  }
+}
+
+export function formatErrorsForModel(errors: string[]): string {
+  return [
+    'Your previous response failed A2UI validation with the following errors:',
+    ...errors.map((e) => `- ${e}`),
+    '',
+    'Return a CORRECTED JSON array that fixes every error. Emit only the JSON',
+    'array – no prose, no code fences.',
+  ].join('\n');
+}
diff --git a/packages/genui/server/agent/openai-provider.ts b/packages/genui/server/agent/openai-provider.ts
new file mode 100644
index 0000000000..83e4146600
--- /dev/null
+++ b/packages/genui/server/agent/openai-provider.ts
@@ -0,0 +1,97 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { createOpenAI } from '@ai-sdk/openai';
+import type { AgentConfig } from '@mastra/core/agent';
+
+import { isOfficialOpenAIBaseURL } from './openai-utils';
+import type { ChatMessage } from '../service/a2ui-agent';
+
+export interface OpenAIProviderOptions {
+  apiKey?: string | undefined;
+  baseURL?: string | undefined;
+  model?: string | undefined;
+  api?: 'chat' | 'responses' | undefined;
+}
+
+const DEFAULT_MODEL = 'gpt-4o-mini';
+
+interface LLMProvider {
+  provider: ReturnType<typeof createOpenAI>;
+  buildModel: (id: string) => AgentConfig['model'];
+  model: string;
+  api: 'chat' | 'responses';
+  baseURL: string;
+}
+
+type CompatChatMessage =
+  | ChatMessage
+  | (Omit<ChatMessage, 'role'> & {
+    role: 'developer';
+  });
+
+interface CompatRequestBody {
+  messages?: CompatChatMessage[];
+}
+
+interface OpenAIEnv {
+  OPENAI_API_KEY?: string | undefined;
+  OPENAI_API_STYLE?: 'chat' | 'responses' | undefined;
+  OPENAI_BASE_URL?: string | undefined;
+  OPENAI_MODEL?: string | undefined;
+}
+
+const compatFetch: typeof fetch = async (input, init) => {
+  if (!init || !init.body || typeof init.body !== 'string') {
+    return fetch(input, init);
+  }
+  let body = init.body;
+  try {
+    const parsed = JSON.parse(body) as CompatRequestBody;
+    if (Array.isArray(parsed.messages)) {
+      let touched = false;
+      parsed.messages = parsed.messages.map((m) => {
+        if (m && m.role === 'developer') {
+          touched = true;
+          return { ...m, role: 'system' };
+        }
+        return m;
+      });
+      if (touched) body = JSON.stringify(parsed);
+    }
+  } catch {
+    // body is not JSON, leave as-is
+  }
+  return fetch(input, { ...init, body });
+};
+
+export function createLLMProvider(
+  opts: OpenAIProviderOptions = {},
+): LLMProvider {
+  const env = process.env as OpenAIEnv;
+  const apiKey = opts.apiKey ?? env.OPENAI_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      'OpenAI credentials not provided: set OPENAI_API_KEY env var or pass apiKey',
+    );
+  }
+  const baseURL = opts.baseURL ?? env.OPENAI_BASE_URL
+    ?? 'https://api.openai.com/v1';
+  const model = opts.model ?? env.OPENAI_MODEL ?? DEFAULT_MODEL;
+
+  const isOfficial = isOfficialOpenAIBaseURL(baseURL);
+  const api = opts.api
+    ?? env.OPENAI_API_STYLE
+    ?? (isOfficial ? 'responses' : 'chat');
+
+  const providerSettings = {
+    apiKey,
+    baseURL,
+    ...(isOfficial ? {} : { fetch: compatFetch }),
+  };
+  const provider = createOpenAI(providerSettings);
+  const buildModel = (id: string) =>
+    api === 'chat' ? provider.chat(id) : provider(id);
+  return { provider, buildModel, model, api, baseURL };
+}
diff --git a/packages/genui/server/agent/openai-utils.ts b/packages/genui/server/agent/openai-utils.ts
new file mode 100644
index 0000000000..c0dbaaab32
--- /dev/null
+++ b/packages/genui/server/agent/openai-utils.ts
@@ -0,0 +1,11 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+export function isOfficialOpenAIBaseURL(baseURL: string): boolean {
+  try {
+    return new URL(baseURL).hostname === 'api.openai.com';
+  } catch {
+    return false;
+  }
+}
diff --git a/packages/genui/server/app/a2ui/_shared.ts b/packages/genui/server/app/a2ui/_shared.ts
new file mode 100644
index 0000000000..993774ffec
--- /dev/null
+++ b/packages/genui/server/app/a2ui/_shared.ts
@@ -0,0 +1,49 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import type { A2UICatalog } from '../../agent/a2ui-catalog';
+import type { ChatOptions } from '../../service/a2ui-agent';
+
+export interface A2UIChatBody {
+  messages?: unknown;
+  threadId?: string;
+  resourceId?: string;
+  model?: string;
+  apiKey?: string;
+  baseURL?: string;
+  catalog?: A2UICatalog;
+  maxRepairAttempts?: number;
+  validate?: boolean;
+}
+
+function clientOverridesAllowed(): boolean {
+  return process.env['A2UI_ALLOW_CLIENT_OVERRIDE'] === '1';
+}
+
+export function pickChatOptions(body: {
+  threadId?: string;
+  resourceId?: string;
+  model?: string;
+  apiKey?: string;
+  baseURL?: string;
+  catalog?: A2UICatalog;
+  maxRepairAttempts?: number;
+}): ChatOptions {
+  const allowOverride = clientOverridesAllowed();
+  return {
+    threadId: body.threadId,
+    resourceId: body.resourceId,
+    model: body.model,
+    apiKey: allowOverride ? body.apiKey : undefined,
+    baseURL: allowOverride ? body.baseURL : undefined,
+    catalog: body.catalog,
+    maxRepairAttempts: body.maxRepairAttempts,
+  };
+}
+
+export function errorMessage(
+  err: unknown,
+): { message: string; name?: string } {
+  if (err instanceof Error) return { message: err.message, name: err.name };
+  return { message: String(err) };
+}
diff --git a/packages/genui/server/app/a2ui/action/route.ts b/packages/genui/server/app/a2ui/action/route.ts
new file mode 100644
index 0000000000..e6731da193
--- /dev/null
+++ b/packages/genui/server/app/a2ui/action/route.ts
@@ -0,0 +1,92 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import type { A2UICatalog } from '../../../agent/a2ui-catalog';
+import { getA2UIAgentService } from '../../../service/a2ui-agent';
+import type { ChatMessage } from '../../../service/a2ui-agent';
+import { errorMessage, pickChatOptions } from '../_shared';
+import { corsPreflight, jsonWithCors } from '../cors';
+import { checkRateLimit, rateLimitJsonResponse } from '../rate-limit';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+interface A2UIActionBody {
+  threadId: string;
+  surfaceId?: string;
+  action: {
+    name: string;
+    context?: Record<string, unknown>;
+  };
+  resourceId?: string;
+  model?: string;
+  apiKey?: string;
+  baseURL?: string;
+  catalog?: A2UICatalog;
+  maxRepairAttempts?: number;
+  reset?: boolean;
+}
+
+export function OPTIONS(req: Request) {
+  return corsPreflight(req);
+}
+
+export async function POST(req: Request) {
+  const decision = checkRateLimit(req);
+  if (!decision.ok) {
+    return rateLimitJsonResponse(req, decision);
+  }
+
+  let body: A2UIActionBody;
+  try {
+    body = (await req.json()) as A2UIActionBody;
+  } catch {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'invalid JSON body' },
+      { status: 400 },
+    );
+  }
+
+  if (!body || !body.threadId) {
+    return jsonWithCors(req, { ok: false, error: 'threadId is required' });
+  }
+  if (!body.action || !body.action.name) {
+    return jsonWithCors(req, {
+      ok: false,
+      error: 'action.name is required',
+    });
+  }
+
+  const service = getA2UIAgentService();
+
+  if (body.reset) {
+    service.resetConversation(body.threadId);
+  }
+
+  const conv = service.peekConversation(body.threadId);
+  if (!conv && !body.reset) {
+    return jsonWithCors(req, {
+      ok: false,
+      error: `unknown threadId "${body.threadId}" - call /a2ui/chat first`,
+    });
+  }
+
+  const payload = {
+    surfaceId: body.surfaceId,
+    action: body.action,
+  };
+  const userMessage: ChatMessage = {
+    role: 'user',
+    content: `A2UI_USER_ACTION: ${JSON.stringify(payload)}`,
+  };
+
+  const opts = pickChatOptions(body);
+  try {
+    const validated = await service.generateValidated([userMessage], opts);
+    return jsonWithCors(req, validated);
+  } catch (err: unknown) {
+    const { message, name } = errorMessage(err);
+    return jsonWithCors(req, { ok: false, error: message, name });
+  }
+}
diff --git a/packages/genui/server/app/a2ui/chat/route.ts b/packages/genui/server/app/a2ui/chat/route.ts
new file mode 100644
index 0000000000..ffbdff6aa7
--- /dev/null
+++ b/packages/genui/server/app/a2ui/chat/route.ts
@@ -0,0 +1,73 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import { getA2UIAgentService } from '../../../service/a2ui-agent';
+import type { ChatMessage } from '../../../service/a2ui-agent';
+import { errorMessage, pickChatOptions } from '../_shared';
+import type { A2UIChatBody } from '../_shared';
+import { corsPreflight, jsonWithCors } from '../cors';
+import { checkRateLimit, rateLimitJsonResponse } from '../rate-limit';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+function isChatMessageArray(value: unknown): value is ChatMessage[] {
+  if (!Array.isArray(value) || value.length === 0) return false;
+  return value.every(
+    (item) =>
+      item !== null
+      && typeof item === 'object'
+      && typeof (item as ChatMessage).role === 'string'
+      && typeof (item as ChatMessage).content === 'string',
+  );
+}
+
+export function OPTIONS(req: Request) {
+  return corsPreflight(req);
+}
+
+export async function POST(req: Request) {
+  const decision = checkRateLimit(req);
+  if (!decision.ok) {
+    return rateLimitJsonResponse(req, decision);
+  }
+
+  let body: A2UIChatBody;
+  try {
+    body = (await req.json()) as A2UIChatBody;
+  } catch {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'invalid JSON body' },
+      { status: 400 },
+    );
+  }
+
+  if (!isChatMessageArray(body.messages)) {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'messages is required' },
+      { status: 400 },
+    );
+  }
+  const messages = body.messages;
+
+  const service = getA2UIAgentService();
+  const opts = pickChatOptions(body);
+
+  try {
+    if (body.validate === false) {
+      const { text, usage, finishReason } = await service.generateRaw(
+        messages,
+        opts,
+      );
+      return jsonWithCors(req, { ok: true, text, usage, finishReason });
+    }
+
+    const validated = await service.generateValidated(messages, opts);
+    return jsonWithCors(req, validated);
+  } catch (err: unknown) {
+    const { message, name } = errorMessage(err);
+    return jsonWithCors(req, { ok: false, error: message, name });
+  }
+}
diff --git a/packages/genui/server/app/a2ui/cors.ts b/packages/genui/server/app/a2ui/cors.ts
new file mode 100644
index 0000000000..96b36d1f87
--- /dev/null
+++ b/packages/genui/server/app/a2ui/cors.ts
@@ -0,0 +1,87 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import { NextResponse } from 'next/server';
+
+const DEFAULT_ALLOWED_ORIGINS = new Set([
+  'https://lynx-stack.dev',
+]);
+
+function getConfiguredOrigins(): Set<string> {
+  const { A2UI_CORS_ORIGINS } = process.env;
+  const configured = A2UI_CORS_ORIGINS
+    ?.split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean) ?? [];
+  return new Set([...DEFAULT_ALLOWED_ORIGINS, ...configured]);
+}
+
+function isLocalDevOrigin(origin: string): boolean {
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname;
+    return (
+      url.protocol === 'http:'
+      && (
+        hostname === 'localhost'
+        || hostname === '127.0.0.1'
+        || hostname === '0.0.0.0'
+        || hostname.startsWith('10.')
+        || hostname.startsWith('192.168.')
+        || /^172\.(?:1[6-9]|2\d|3[01])\./u.test(hostname)
+      )
+    );
+  } catch {
+    return false;
+  }
+}
+
+function resolveAllowedOrigin(req: Request): string | null {
+  const origin = req.headers.get('origin');
+  // Server-to-server traffic (no Origin header) is allowed to receive a
+  // wildcard ACAO. Browsers always send Origin on cross-origin requests, so
+  // this only applies to non-browser callers and does not weaken CORS for
+  // browser clients.
+  if (!origin) return '*';
+  if (getConfiguredOrigins().has(origin) || isLocalDevOrigin(origin)) {
+    return origin;
+  }
+  return null;
+}
+
+export function corsHeaders(
+  req: Request,
+  extra?: HeadersInit,
+): Headers {
+  const headers = new Headers(extra);
+  const allowedOrigin = resolveAllowedOrigin(req);
+  if (allowedOrigin) {
+    headers.set('Access-Control-Allow-Origin', allowedOrigin);
+  }
+  headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  headers.set(
+    'Access-Control-Allow-Headers',
+    'Content-Type, Authorization, X-Requested-With',
+  );
+  headers.set('Access-Control-Max-Age', '86400');
+  headers.append('Vary', 'Origin');
+  return headers;
+}
+
+export function corsPreflight(req: Request): Response {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(req),
+  });
+}
+
+export function jsonWithCors(
+  req: Request,
+  body: unknown,
+  init?: ResponseInit,
+): NextResponse {
+  return NextResponse.json(body, {
+    ...init,
+    headers: corsHeaders(req, init?.headers),
+  });
+}
diff --git a/packages/genui/server/app/a2ui/health/route.ts b/packages/genui/server/app/a2ui/health/route.ts
new file mode 100644
index 0000000000..780bbbc3f4
--- /dev/null
+++ b/packages/genui/server/app/a2ui/health/route.ts
@@ -0,0 +1,36 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { isOfficialOpenAIBaseURL } from '../../../agent/openai-utils';
+import { corsPreflight, jsonWithCors } from '../cors';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+export function OPTIONS(req: Request) {
+  return corsPreflight(req);
+}
+
+export function GET(req: Request) {
+  const {
+    OPENAI_API_KEY,
+    OPENAI_API_STYLE,
+    OPENAI_BASE_URL,
+    OPENAI_MODEL,
+  } = process.env;
+  const hasKey = !!OPENAI_API_KEY;
+  const baseURL = OPENAI_BASE_URL ?? 'https://api.openai.com/v1';
+  const isOfficial = isOfficialOpenAIBaseURL(baseURL);
+  const api = (OPENAI_API_STYLE as 'chat' | 'responses' | undefined)
+    ?? (isOfficial ? 'responses' : 'chat');
+
+  return jsonWithCors(req, {
+    ok: hasKey,
+    provider: 'openai',
+    hasKey,
+    baseURL,
+    model: OPENAI_MODEL ?? 'gpt-4o-mini',
+    api,
+  });
+}
diff --git a/packages/genui/server/app/a2ui/rate-limit.ts b/packages/genui/server/app/a2ui/rate-limit.ts
new file mode 100644
index 0000000000..e498315bab
--- /dev/null
+++ b/packages/genui/server/app/a2ui/rate-limit.ts
@@ -0,0 +1,168 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import { corsHeaders, jsonWithCors } from './cors';
+
+interface WindowCounter {
+  count: number;
+  resetAt: number;
+}
+
+const buckets = new Map<string, WindowCounter>();
+
+let lastSweepAt = 0;
+const SWEEP_INTERVAL_MS = 60_000;
+
+function sweepExpired(now: number): void {
+  if (now - lastSweepAt < SWEEP_INTERVAL_MS) return;
+  lastSweepAt = now;
+  for (const [key, value] of buckets) {
+    if (value.resetAt <= now) buckets.delete(key);
+  }
+}
+
+function parsePositiveInt(
+  raw: string | undefined,
+  fallback: number,
+): number {
+  if (!raw) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.floor(n);
+}
+
+interface RateLimitConfig {
+  limit: number;
+  windowMs: number;
+}
+
+function getConfig(): RateLimitConfig {
+  const limit = parsePositiveInt(
+    process.env['A2UI_RATE_LIMIT_PER_MIN'],
+    20,
+  );
+  const windowMs = parsePositiveInt(
+    process.env['A2UI_RATE_LIMIT_WINDOW_MS'],
+    60_000,
+  );
+  return { limit, windowMs };
+}
+
+function getClientKey(req: Request): string {
+  const forwarded = req.headers.get('x-forwarded-for');
+  if (forwarded) {
+    const first = forwarded.split(',')[0]?.trim();
+    if (first) return first;
+  }
+  const realIp = req.headers.get('x-real-ip');
+  if (realIp) return realIp.trim();
+  // Fallback when running locally without a proxy.
+  return 'unknown';
+}
+
+export interface RateLimitDecision {
+  ok: boolean;
+  limit: number;
+  remaining: number;
+  resetAt: number;
+  retryAfterSec: number;
+}
+
+export function checkRateLimit(req: Request): RateLimitDecision {
+  const { limit, windowMs } = getConfig();
+  const now = Date.now();
+  sweepExpired(now);
+
+  const key = getClientKey(req);
+  const existing = buckets.get(key);
+
+  if (!existing || existing.resetAt <= now) {
+    const next: WindowCounter = { count: 1, resetAt: now + windowMs };
+    buckets.set(key, next);
+    return {
+      ok: true,
+      limit,
+      remaining: Math.max(0, limit - 1),
+      resetAt: next.resetAt,
+      retryAfterSec: 0,
+    };
+  }
+
+  if (existing.count >= limit) {
+    return {
+      ok: false,
+      limit,
+      remaining: 0,
+      resetAt: existing.resetAt,
+      retryAfterSec: Math.max(1, Math.ceil((existing.resetAt - now) / 1000)),
+    };
+  }
+
+  existing.count += 1;
+  return {
+    ok: true,
+    limit,
+    remaining: Math.max(0, limit - existing.count),
+    resetAt: existing.resetAt,
+    retryAfterSec: 0,
+  };
+}
+
+function applyRateLimitHeaders(
+  headers: Headers,
+  decision: RateLimitDecision,
+): Headers {
+  headers.set('X-RateLimit-Limit', String(decision.limit));
+  headers.set('X-RateLimit-Remaining', String(decision.remaining));
+  headers.set(
+    'X-RateLimit-Reset',
+    String(Math.ceil(decision.resetAt / 1000)),
+  );
+  if (!decision.ok) {
+    headers.set('Retry-After', String(decision.retryAfterSec));
+  }
+  return headers;
+}
+
+export function rateLimitJsonResponse(
+  req: Request,
+  decision: RateLimitDecision,
+) {
+  const headers = applyRateLimitHeaders(new Headers(), decision);
+  return jsonWithCors(
+    req,
+    {
+      ok: false,
+      error: 'rate limit exceeded, please retry later',
+      retryAfterSec: decision.retryAfterSec,
+    },
+    { status: 429, headers },
+  );
+}
+
+export function rateLimitSseResponse(
+  req: Request,
+  decision: RateLimitDecision,
+): Response {
+  const payload = JSON.stringify({
+    message: 'rate limit exceeded, please retry later',
+    retryAfterSec: decision.retryAfterSec,
+  });
+  const body = new TextEncoder().encode(`event: error\ndata: ${payload}\n\n`);
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(body);
+      controller.close();
+    },
+  });
+  const headers = applyRateLimitHeaders(
+    corsHeaders(req, {
+      'Content-Type': 'text/event-stream; charset=utf-8',
+      'Cache-Control': 'no-cache, no-transform',
+      Connection: 'keep-alive',
+      'X-Accel-Buffering': 'no',
+    }),
+    decision,
+  );
+  return new Response(stream, { status: 429, headers });
+}
diff --git a/packages/genui/server/app/a2ui/reset/route.ts b/packages/genui/server/app/a2ui/reset/route.ts
new file mode 100644
index 0000000000..5c2c624820
--- /dev/null
+++ b/packages/genui/server/app/a2ui/reset/route.ts
@@ -0,0 +1,32 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import { getA2UIAgentService } from '../../../service/a2ui-agent';
+import { corsPreflight, jsonWithCors } from '../cors';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+export function OPTIONS(req: Request) {
+  return corsPreflight(req);
+}
+
+export async function POST(req: Request) {
+  let body: { threadId?: string };
+  try {
+    body = (await req.json()) as { threadId?: string };
+  } catch {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'invalid JSON body' },
+      { status: 400 },
+    );
+  }
+
+  if (!body?.threadId) {
+    return jsonWithCors(req, { ok: false, error: 'threadId is required' });
+  }
+
+  getA2UIAgentService().resetConversation(body.threadId);
+  return jsonWithCors(req, { ok: true });
+}
diff --git a/packages/genui/server/app/a2ui/stream/route.ts b/packages/genui/server/app/a2ui/stream/route.ts
new file mode 100644
index 0000000000..8c610ef62c
--- /dev/null
+++ b/packages/genui/server/app/a2ui/stream/route.ts
@@ -0,0 +1,130 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { BASIC_CATALOG } from '../../../agent/a2ui-catalog';
+import { validateA2UIOutput } from '../../../agent/a2ui-validator';
+import { getA2UIAgentService } from '../../../service/a2ui-agent';
+import type { ChatMessage } from '../../../service/a2ui-agent';
+import { errorMessage, pickChatOptions } from '../_shared';
+import type { A2UIChatBody } from '../_shared';
+import { corsHeaders, corsPreflight, jsonWithCors } from '../cors';
+import { checkRateLimit, rateLimitSseResponse } from '../rate-limit';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+function isChatMessageArray(value: unknown): value is ChatMessage[] {
+  if (!Array.isArray(value) || value.length === 0) return false;
+  return value.every(
+    (item) =>
+      item !== null
+      && typeof item === 'object'
+      && typeof (item as ChatMessage).role === 'string'
+      && typeof (item as ChatMessage).content === 'string',
+  );
+}
+
+function encodeSSE(event: string, data: unknown): Uint8Array {
+  const payload = typeof data === 'string' ? data : JSON.stringify(data);
+  return new TextEncoder().encode(`event: ${event}\ndata: ${payload}\n\n`);
+}
+
+function sseHeaders(req: Request): Headers {
+  return corsHeaders(req, {
+    'Content-Type': 'text/event-stream; charset=utf-8',
+    'Cache-Control': 'no-cache, no-transform',
+    Connection: 'keep-alive',
+    'X-Accel-Buffering': 'no',
+  });
+}
+
+export function OPTIONS(req: Request) {
+  return corsPreflight(req);
+}
+
+export async function POST(req: Request) {
+  const decision = checkRateLimit(req);
+  if (!decision.ok) {
+    return rateLimitSseResponse(req, decision);
+  }
+
+  let body: A2UIChatBody;
+  try {
+    body = (await req.json()) as A2UIChatBody;
+  } catch {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'invalid JSON body' },
+      { status: 400 },
+    );
+  }
+
+  if (!isChatMessageArray(body.messages)) {
+    return jsonWithCors(
+      req,
+      { ok: false, error: 'messages is required' },
+      { status: 400 },
+    );
+  }
+  const messages = body.messages;
+  const opts = pickChatOptions(body);
+  const service = getA2UIAgentService();
+
+  const stream = new ReadableStream<Uint8Array>({
+    async start(controller) {
+      const enqueue = (event: string, data: unknown) => {
+        controller.enqueue(encodeSSE(event, data));
+      };
+
+      try {
+        const { textStream, finalize } = await service.streamAsAsyncIterable(
+          messages,
+          opts,
+        );
+
+        enqueue('start', {
+          threadId: opts.threadId,
+          resourceId: opts.resourceId,
+        });
+
+        for await (const chunk of textStream) {
+          enqueue('delta', { text: chunk });
+        }
+
+        const { text: finalText, usage, finishReason } = await finalize();
+
+        let validation: { ok: boolean; errors: string[]; messages: unknown[] } =
+          {
+            ok: false,
+            errors: ['no text produced'],
+            messages: [],
+          };
+        if (finalText) {
+          const v = validateA2UIOutput(
+            finalText,
+            opts.catalog ?? BASIC_CATALOG,
+          );
+          validation = {
+            ok: v.ok,
+            errors: v.errors,
+            messages: v.ok ? v.messages : [],
+          };
+        }
+
+        enqueue('done', {
+          text: finalText,
+          usage,
+          finishReason,
+          validation,
+        });
+      } catch (err: unknown) {
+        enqueue('error', errorMessage(err));
+      } finally {
+        controller.close();
+      }
+    },
+  });
+
+  return new Response(stream, { status: 200, headers: sseHeaders(req) });
+}
diff --git a/packages/genui/server/app/layout.tsx b/packages/genui/server/app/layout.tsx
new file mode 100644
index 0000000000..1beea47045
--- /dev/null
+++ b/packages/genui/server/app/layout.tsx
@@ -0,0 +1,16 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+import type { ReactNode } from 'react';
+
+export default function RootLayout({
+  children,
+}: Readonly<{
+  children: ReactNode;
+}>) {
+  return (
+    <html lang='en'>
+      <body>{children}</body>
+    </html>
+  );
+}
diff --git a/packages/genui/server/instrumentation.ts b/packages/genui/server/instrumentation.ts
new file mode 100644
index 0000000000..bbc2daaef7
--- /dev/null
+++ b/packages/genui/server/instrumentation.ts
@@ -0,0 +1,25 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+export function register(): void {
+  if (process.env['NEXT_RUNTIME'] !== 'nodejs') return;
+  const { OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_MODEL } = process.env;
+  const missing: string[] = [];
+  if (!OPENAI_API_KEY) missing.push('OPENAI_API_KEY');
+  if (!OPENAI_BASE_URL) missing.push('OPENAI_BASE_URL');
+  if (!OPENAI_MODEL) missing.push('OPENAI_MODEL');
+
+  if (missing.length === 0) return;
+
+  const message =
+    `[a2ui-server] missing required environment variables: ${
+      missing.join(', ')
+    }.\n`
+    + 'See packages/genui/server/AGENTS.md for setup instructions.';
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error(message);
+  } else {
+    console.warn(message);
+  }
+}
diff --git a/packages/genui/server/next-env.d.ts b/packages/genui/server/next-env.d.ts
new file mode 100644
index 0000000000..20e7bcfb03
--- /dev/null
+++ b/packages/genui/server/next-env.d.ts
@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import './.next/dev/types/routes.d.ts';
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
diff --git a/packages/genui/server/next.config.mjs b/packages/genui/server/next.config.mjs
new file mode 100644
index 0000000000..b3616feef1
--- /dev/null
+++ b/packages/genui/server/next.config.mjs
@@ -0,0 +1,10 @@
+// Copyright 2024 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  serverExternalPackages: ['@mastra/core'],
+};
+
+export default nextConfig;
diff --git a/packages/genui/server/package.json b/packages/genui/server/package.json
new file mode 100644
index 0000000000..8d6cf80fec
--- /dev/null
+++ b/packages/genui/server/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "a2ui-server",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "build": "next build",
+    "dev": "next dev -p 3060",
+    "lint": "eslint --ignore-pattern .next --ignore-pattern .vercel .",
+    "start": "next start -p 3060"
+  },
+  "dependencies": {
+    "@ai-sdk/openai": "^3.0.63",
+    "@mastra/core": "1.13.2",
+    "next": "16.2.6",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.13",
+    "@types/react": "^18.3.28",
+    "@types/react-dom": "^19.2.3",
+    "typescript": "^5.9.3"
+  }
+}
diff --git a/packages/genui/server/service/a2ui-agent.ts b/packages/genui/server/service/a2ui-agent.ts
new file mode 100644
index 0000000000..34942602ea
--- /dev/null
+++ b/packages/genui/server/service/a2ui-agent.ts
@@ -0,0 +1,468 @@
+// Copyright 2026 The Lynx Authors. All rights reserved.
+// Licensed under the Apache License Version 2.0 that can be found in the
+// LICENSE file in the root directory of this source tree.
+
+import { createHash } from 'node:crypto';
+
+import { createA2UIAgent } from '../agent/a2ui-agent';
+import type { A2UIAgent } from '../agent/a2ui-agent';
+import { BASIC_CATALOG } from '../agent/a2ui-catalog';
+import type { A2UICatalog } from '../agent/a2ui-catalog';
+import {
+  formatErrorsForModel,
+  validateA2UIOutput,
+} from '../agent/a2ui-validator';
+import type { A2UIMessage } from '../agent/a2ui-validator';
+
+export interface ChatMessage {
+  role: 'user' | 'assistant' | 'system';
+  content: string;
+}
+
+export interface ChatOptions {
+  threadId?: string | undefined;
+  resourceId?: string | undefined;
+  apiKey?: string | undefined;
+  baseURL?: string | undefined;
+  model?: string | undefined;
+  catalog?: A2UICatalog | undefined;
+  maxRepairAttempts?: number | undefined;
+}
+
+export interface A2UIResponse {
+  ok: boolean;
+  text: string;
+  messages: A2UIMessage[];
+  errors: string[];
+  attempts: number;
+  usage?: unknown;
+  finishReason?: unknown;
+}
+
+interface ConversationMemory {
+  history: ChatMessage[];
+  surfaceIds: Set<string>;
+  dataModel: Record<string, unknown>;
+  lastSeenAt: number;
+}
+
+interface MastraResult {
+  text?: unknown;
+  usage?: unknown;
+  finishReason?: unknown;
+  response?: {
+    messages?: Array<{
+      content?: unknown;
+    }>;
+  };
+}
+
+interface MastraStreamResult extends MastraResult {
+  textStream?: ReadableStream<string> | AsyncIterable<string>;
+}
+
+function isReadableStream(
+  stream: ReadableStream<string> | AsyncIterable<string>,
+): stream is ReadableStream<string> {
+  return 'getReader' in stream && typeof stream.getReader === 'function';
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object';
+}
+
+function pickDefined<T extends Record<string, unknown>>(input: T): Partial<T> {
+  return Object.fromEntries(
+    Object.entries(input).filter(([, value]) => value !== undefined),
+  ) as Partial<T>;
+}
+
+function hashApiKey(apiKey: string | undefined): string {
+  if (!apiKey) return 'default';
+  return createHash('sha256').update(apiKey).digest('hex');
+}
+
+function parsePositiveInt(
+  raw: string | undefined,
+  fallback: number,
+): number {
+  if (!raw) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return fallback;
+  return Math.floor(n);
+}
+
+function buildDataModelSystemMessage(
+  dataModel: Record<string, unknown>,
+): ChatMessage {
+  return {
+    role: 'system',
+    content:
+      `Current A2UI data model state (most recent values from prior turns):\n${
+        JSON.stringify(dataModel)
+      }`,
+  };
+}
+
+export default class A2UIAgentService {
+  private agentCache = new Map<string, Promise<A2UIAgent>>();
+
+  private conversations = new Map<string, ConversationMemory>();
+
+  private readonly maxThreads: number = parsePositiveInt(
+    process.env['A2UI_MAX_THREADS'],
+    500,
+  );
+
+  private readonly threadTtlMs: number = parsePositiveInt(
+    process.env['A2UI_THREAD_TTL_MS'],
+    30 * 60_000,
+  );
+
+  private lastSweepAt = 0;
+
+  private sweepConversations(now: number): void {
+    if (now - this.lastSweepAt < 60_000) return;
+    this.lastSweepAt = now;
+
+    for (const [key, value] of this.conversations) {
+      if (now - value.lastSeenAt > this.threadTtlMs) {
+        this.conversations.delete(key);
+      }
+    }
+
+    if (this.conversations.size > this.maxThreads) {
+      const overflow = this.conversations.size - this.maxThreads;
+      const iter = this.conversations.keys();
+      for (let i = 0; i < overflow; i++) {
+        const oldest = iter.next();
+        if (oldest.done) break;
+        this.conversations.delete(oldest.value);
+      }
+    }
+  }
+
+  private touchConversation(threadId: string, conv: ConversationMemory): void {
+    conv.lastSeenAt = Date.now();
+    // Re-insert to update LRU order in Map insertion order semantics.
+    this.conversations.delete(threadId);
+    this.conversations.set(threadId, conv);
+  }
+
+  private getAgent(opts: ChatOptions): Promise<A2UIAgent> {
+    const cacheKey = `${opts.baseURL ?? 'default'}:${opts.model ?? 'default'}:${
+      hashApiKey(opts.apiKey)
+    }:${opts.catalog?.id ?? 'basic'}`;
+    let cached = this.agentCache.get(cacheKey);
+    if (cached) return cached;
+
+    cached = Promise.resolve(
+      createA2UIAgent(pickDefined({
+        apiKey: opts.apiKey,
+        baseURL: opts.baseURL,
+        model: opts.model,
+        catalog: opts.catalog,
+      })).agent,
+    );
+    this.agentCache.set(cacheKey, cached);
+    return cached;
+  }
+
+  private toModelMessages(messages: ChatMessage[]) {
+    return messages.map((m) => ({ role: m.role, content: m.content }));
+  }
+
+  public getConversation(threadId: string): ConversationMemory {
+    this.sweepConversations(Date.now());
+    const existing = this.conversations.get(threadId);
+    if (existing) {
+      this.touchConversation(threadId, existing);
+      return existing;
+    }
+    const conv: ConversationMemory = {
+      history: [],
+      surfaceIds: new Set<string>(),
+      dataModel: {},
+      lastSeenAt: Date.now(),
+    };
+    this.conversations.set(threadId, conv);
+    return conv;
+  }
+
+  public peekConversation(threadId: string): ConversationMemory | undefined {
+    const conv = this.conversations.get(threadId);
+    if (conv) this.touchConversation(threadId, conv);
+    return conv;
+  }
+
+  public resetConversation(threadId: string): void {
+    this.conversations.delete(threadId);
+  }
+
+  public async stream(
+    messages: ChatMessage[],
+    opts: ChatOptions = {},
+  ): Promise<MastraStreamResult> {
+    const agent = await this.getAgent(opts);
+    return agent.stream(
+      this.toModelMessages(messages),
+      pickDefined({
+        threadId: opts.threadId,
+        resourceId: opts.resourceId,
+      }),
+    ) as MastraStreamResult;
+  }
+
+  public async streamAsAsyncIterable(
+    messages: ChatMessage[],
+    opts: ChatOptions = {},
+  ): Promise<{
+    textStream: AsyncIterable<string>;
+    finalize: () => Promise<{
+      text: string | undefined;
+      usage: unknown;
+      finishReason: unknown;
+    }>;
+  }> {
+    const streamResult: MastraStreamResult = await this.stream(
+      messages,
+      opts,
+    );
+    const raw = streamResult.textStream;
+
+    const textStream: AsyncIterable<string> = {
+      [Symbol.asyncIterator]: async function*() {
+        if (!raw) return;
+        if (isReadableStream(raw)) {
+          const reader = raw.getReader();
+          try {
+            while (true) {
+              const { value, done } = await reader.read();
+              if (done) break;
+              if (value) yield value;
+            }
+          } finally {
+            reader.releaseLock();
+          }
+        } else {
+          for await (const chunk of raw) {
+            if (chunk) yield chunk;
+          }
+        }
+      },
+    };
+
+    const finalize = async () => {
+      const text = await Promise.resolve(streamResult.text).catch(
+        () => undefined,
+      );
+      const usage = await Promise.resolve(streamResult.usage).catch(
+        () => undefined,
+      );
+      const finishReason = await Promise.resolve(
+        streamResult.finishReason,
+      ).catch(() => undefined);
+      return {
+        text: typeof text === 'string' ? text : undefined,
+        usage,
+        finishReason,
+      };
+    };
+
+    return { textStream, finalize };
+  }
+
+  public async generate(
+    messages: ChatMessage[],
+    opts: ChatOptions = {},
+  ): Promise<unknown> {
+    const agent = await this.getAgent(opts);
+    return agent.generate(
+      this.toModelMessages(messages),
+      pickDefined({
+        threadId: opts.threadId,
+        resourceId: opts.resourceId,
+      }),
+    );
+  }
+
+  public async generateRaw(
+    messages: ChatMessage[],
+    opts: ChatOptions = {},
+  ): Promise<{ text: string; usage: unknown; finishReason: unknown }> {
+    const result = await this.generate(messages, opts) as MastraResult;
+    const text = await extractText(result);
+    const usage = (await Promise.resolve(result?.usage).catch(() => undefined))
+      ?? result?.usage;
+    const finishReason =
+      (await Promise.resolve(result?.finishReason).catch(() => undefined))
+        ?? result?.finishReason;
+    return { text, usage, finishReason };
+  }
+
+  public async generateValidated(
+    messages: ChatMessage[],
+    opts: ChatOptions = {},
+  ): Promise<A2UIResponse> {
+    const catalog = opts.catalog ?? BASIC_CATALOG;
+    const maxAttempts = Math.max(1, opts.maxRepairAttempts ?? 2) + 1;
+    const agent = await this.getAgent({ ...opts, catalog });
+
+    const threadId = opts.threadId;
+    const conv = threadId ? this.getConversation(threadId) : null;
+
+    const convo: ChatMessage[] = [
+      ...(conv ? conv.history : []),
+      ...(conv && Object.keys(conv.dataModel).length > 0
+        ? [buildDataModelSystemMessage(conv.dataModel)]
+        : []),
+      ...messages,
+    ];
+
+    let lastText = '';
+    let lastErrors: string[] = [];
+    let lastUsage: unknown;
+    let lastFinishReason: unknown;
+
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      const result = await agent.generate(
+        this.toModelMessages(convo),
+        pickDefined({
+          threadId,
+          resourceId: opts.resourceId,
+        }),
+      ) as MastraResult;
+
+      const text = await extractText(result);
+      lastText = text;
+      lastUsage = (await Promise.resolve(result?.usage).catch(() => undefined))
+        ?? result?.usage;
+      lastFinishReason =
+        (await Promise.resolve(result?.finishReason).catch(() => undefined))
+          ?? result?.finishReason;
+
+      const validation = validateA2UIOutput(text, catalog);
+      if (validation.ok) {
+        if (conv) {
+          mergeIntoConversation(conv, messages, text, validation.messages);
+        }
+        return {
+          ok: true,
+          text,
+          messages: validation.messages,
+          errors: [],
+          attempts: attempt,
+          usage: lastUsage,
+          finishReason: lastFinishReason,
+        };
+      }
+      lastErrors = validation.errors;
+
+      if (attempt < maxAttempts) {
+        convo.push({ role: 'assistant', content: text });
+        convo.push({
+          role: 'user',
+          content: formatErrorsForModel(validation.errors),
+        });
+      }
+    }
+
+    return {
+      ok: false,
+      text: lastText,
+      messages: [],
+      errors: lastErrors,
+      attempts: maxAttempts,
+      usage: lastUsage,
+      finishReason: lastFinishReason,
+    };
+  }
+}
+
+async function extractText(result: MastraResult): Promise<string> {
+  const direct = typeof result.text === 'string' ? result.text : undefined;
+  if (direct) return direct;
+  const resolved = await Promise.resolve(result.text).catch(() => undefined);
+  if (typeof resolved === 'string' && resolved) return resolved;
+  const messageContents = result.response?.messages ?? [];
+  const textParts = messageContents
+    .flatMap((m): unknown[] => (Array.isArray(m.content) ? m.content : []))
+    .filter((c): c is { type: 'text'; text: string } => {
+      if (!isRecord(c)) return false;
+      const candidate = c as { text?: unknown; type?: unknown };
+      return candidate.type === 'text' && typeof candidate.text === 'string';
+    })
+    .map((c) => c.text);
+  return textParts.join('');
+}
+
+function mergeIntoConversation(
+  conv: ConversationMemory,
+  incoming: ChatMessage[],
+  assistantText: string,
+  messages: A2UIMessage[],
+): void {
+  conv.history.push(...incoming);
+  conv.history.push({ role: 'assistant', content: assistantText });
+  for (const msg of messages) {
+    if ('createSurface' in msg && msg.createSurface) {
+      conv.surfaceIds.add(msg.createSurface.surfaceId);
+    } else if ('deleteSurface' in msg && msg.deleteSurface) {
+      conv.surfaceIds.delete(msg.deleteSurface.surfaceId);
+    } else if ('updateDataModel' in msg && msg.updateDataModel) {
+      const updateDataModel = msg.updateDataModel as
+        & typeof msg.updateDataModel
+        & { value?: unknown };
+      applyDataModel(
+        conv.dataModel,
+        updateDataModel.path ?? '/',
+        updateDataModel.value,
+      );
+    }
+  }
+  const MAX_HISTORY = 20;
+  if (conv.history.length > MAX_HISTORY) {
+    conv.history.splice(0, conv.history.length - MAX_HISTORY);
+  }
+}
+
+function applyDataModel(
+  model: Record<string, unknown>,
+  path: string,
+  value: unknown,
+): void {
+  if (!path || path === '/' || path === '') {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+      Object.assign(model, value as Record<string, unknown>);
+    }
+    return;
+  }
+  const parts = path.replace(/^\//, '').split('/').filter(Boolean);
+  let cursor = model;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const key = parts[i];
+    if (!key) continue;
+    if (typeof cursor[key] !== 'object' || cursor[key] === null) {
+      cursor[key] = {};
+    }
+    cursor = cursor[key] as Record<string, unknown>;
+  }
+  const last = parts[parts.length - 1];
+  if (!last) return;
+  if (value === undefined) {
+    delete cursor[last];
+  } else {
+    cursor[last] = value;
+  }
+}
+
+const SERVICE_KEY = '__A2UI_AGENT_SERVICE__';
+type GlobalWithService = typeof globalThis & {
+  [SERVICE_KEY]?: A2UIAgentService;
+};
+
+export function getA2UIAgentService(): A2UIAgentService {
+  const g = globalThis as GlobalWithService;
+  g[SERVICE_KEY] ??= new A2UIAgentService();
+  return g[SERVICE_KEY];
+}
diff --git a/packages/genui/server/tsconfig.json b/packages/genui/server/tsconfig.json
new file mode 100644
index 0000000000..813bde05d6
--- /dev/null
+++ b/packages/genui/server/tsconfig.json
@@ -0,0 +1,37 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "composite": false,
+    "isolatedModules": true,
+    "isolatedDeclarations": false,
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next",
+      },
+    ],
+    "paths": {
+      "@/*": ["./*"],
+    },
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts",
+  ],
+  "exclude": ["node_modules"],
+  "references": [],
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2f1c24d975..086de78bfa 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -707,6 +707,40 @@ importers:
         specifier: ^18.3.28
         version: 18.3.28
 
+  packages/genui/server:
+    dependencies:
+      '@ai-sdk/openai':
+        specifier: ^3.0.63
+        version: 3.0.63(zod@3.25.76)
+      '@mastra/core':
+        specifier: 1.13.2
+        version: 1.13.2(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76))(@types/json-schema@7.0.15)(openapi-types@12.1.3)(zod@3.25.76)
+      next:
+        specifier: 16.2.6
+        version: 16.2.6(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(sass@1.97.3)
+      react:
+        specifier: 19.2.4
+        version: 19.2.4
+      react-dom:
+        specifier: 19.2.4
+        version: 19.2.4(react@19.2.4)
+      zod:
+        specifier: ^3.25.76
+        version: 3.25.76
+    devDependencies:
+      '@types/node':
+        specifier: ^24.10.13
+        version: 24.10.13
+      '@types/react':
+        specifier: ^18.3.28
+        version: 18.3.28
+      '@types/react-dom':
+        specifier: ^19.2.3
+        version: 19.2.3(@types/react@18.3.28)
+      typescript:
+        specifier: ^5.9.3
+        version: 5.9.3
+
   packages/i18n/i18next-translation-dedupe:
     devDependencies:
       '@lynx-js/react':
@@ -832,7 +866,7 @@ importers:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: ^1.25.2
-        version: 1.25.2(hono@4.12.12)(zod@3.25.76)
+        version: 1.25.2(hono@4.12.12)(zod@4.4.3)
       commander:
         specifier: ^13.1.0
         version: 13.1.0
@@ -1495,7 +1529,7 @@ importers:
         version: 8.18.1
       ws:
         specifier: ^8.19.0
-        version: 8.19.0
+        version: 8.20.0
 
   packages/tailwind-preset:
     devDependencies:
@@ -1906,7 +1940,7 @@ importers:
         version: 1.58.2
       '@rspack/cli':
         specifier: catalog:rspack
-        version: 1.7.9(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.21)(tslib@2.8.1)(webpack@5.105.2)
+        version: 1.7.9(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.25)(tslib@2.8.1)(webpack@5.105.2)
       '@rspack/core':
         specifier: catalog:rspack
         version: 1.7.9(@swc/helpers@0.5.21)
@@ -2351,6 +2385,10 @@ importers:
 
 packages:
 
+  '@a2a-js/sdk@0.2.5':
+    resolution: {integrity: sha512-VTDuRS5V0ATbJ/LkaQlisMnTAeYKXAK6scMguVBstf+KIBQ7HIuKhiXLv+G/hvejkV+THoXzoNifInAkU81P1g==}
+    engines: {node: '>=18'}
+
   '@a2ui/web_core@0.9.1':
     resolution: {integrity: sha512-qKFKOgdtPqe0TdiEreTlyqw3TuGjxb7NzVuYejWFUVqy1NQNwe7Hcd4zz8EP+MzWXHSo2sjWsGjuvWBWlVcuOQ==}
 
@@ -2360,6 +2398,62 @@ packages:
   '@adobe/css-tools@4.4.2':
     resolution: {integrity: sha512-baYZExFpsdkBNuvGKTKWCwKH57HRZLVtycZS05WTQNVOiXVSeAki3nU35zlRbToeMW8aHlJfyS+1C4BOv27q0A==}
 
+  '@ai-sdk/openai@3.0.63':
+    resolution: {integrity: sha512-4yY/m8a57MNNVoJCsXuNblKf6BO4yuAuLKRX4tzSNffBEBSp1FlcWdPE0Z4FkqUeS0AJhYSSqp0GIiA/cIcDNA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider-utils@2.2.8':
+    resolution: {integrity: sha512-fqhG+4sCVv8x7nFzYnFo19ryhAa3w096Kmc3hWxMQfW/TubPOmt3A6tYZhl4mUfQWWQMsuSkLrtjlWuXBVSGQA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.23.8
+
+  '@ai-sdk/provider-utils@3.0.20':
+    resolution: {integrity: sha512-iXHVe0apM2zUEzauqJwqmpC37A5rihrStAih5Ks+JE32iTe4LZ58y17UGBjpQQTCRw9YxMeo2UFLxLpBluyvLQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider-utils@4.0.0':
+    resolution: {integrity: sha512-HyCyOls9I3a3e38+gtvOJOEjuw9KRcvbBnCL5GBuSmJvS9Jh9v3fz7pRC6ha1EUo/ZH1zwvLWYXBMtic8MTguA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider-utils@4.0.27':
+    resolution: {integrity: sha512-ubkAJ+xODouwtmN1tYlvTPphH1hPOBfZaEQe8U7skGvFAnIRs9PPpsq57bC2+Ky/MB4yzhd6YOsxTAx9sGpazw==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.25.76 || ^4.1.8
+
+  '@ai-sdk/provider@1.1.3':
+    resolution: {integrity: sha512-qZMxYJ0qqX/RfnuIaab+zp8UAeJn/ygXXAffR5I4N0n1IrvA6qBsjc8hXLmBiMV2zoXlifkacF7sEFnYnjBcqg==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/provider@2.0.1':
+    resolution: {integrity: sha512-KCUwswvsC5VsW2PWFqF8eJgSCu5Ysj7m1TxiHTVA6g7k360bk0RNQENT8KTMAYEs+8fWPD3Uu4dEmzGHc+jGng==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/provider@3.0.0':
+    resolution: {integrity: sha512-m9ka3ptkPQbaHHZHqDXDF9C9B5/Mav0KTdky1k2HZ3/nrW2t1AgObxIVPyGDWQNS9FXT/FS6PIoSjpcP/No8rQ==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/provider@3.0.10':
+    resolution: {integrity: sha512-Q3BZ27qfpYqnCYGvE3vt+Qi6LGOF9R5Nmzn+9JoM1lCRsD9mYaIhfJLkSunN48nfGXJ6n+XNV0J/XVpqGQl7Dw==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/provider@3.0.5':
+    resolution: {integrity: sha512-2Xmoq6DBJqmSl80U6V9z5jJSJP7ehaJJQMy2iFUqTay06wdCqTnPVBBQbtEL8RCChenL+q5DC5H5WzU3vV3v8w==}
+    engines: {node: '>=18'}
+
+  '@ai-sdk/ui-utils@1.2.11':
+    resolution: {integrity: sha512-3zcwCc8ezzFlwp3ZD15wAPjf2Au4s3vAbKsXQVyhxODHcmu0iyPO2Eua6D/vicq/AUm/BAo60r97O6HU+EI0+w==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      zod: ^3.23.8
+
   '@alloc/quick-lru@5.2.0':
     resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
     engines: {node: '>=10'}
@@ -3400,6 +3494,159 @@ packages:
     resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
 
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.34.5':
+    resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linux-arm64@0.34.5':
+    resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-arm@0.34.5':
+    resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-s390x@0.34.5':
+    resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-x64@0.34.5':
+    resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-wasm32@0.34.5':
+    resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.34.5':
+    resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.34.5':
+    resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.34.5':
+    resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [win32]
+
   '@inquirer/ansi@2.0.5':
     resolution: {integrity: sha512-doc2sWgJpbFQ64UflSVd17ibMGDuxO1yKgOgLMwavzESnXjFWJqUeG8saYosqKpHp4kWiM5x1nXvEjbpx90gzw==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^21.7.0 || ^20.12.0'}
@@ -3551,6 +3798,10 @@ packages:
     resolution: {integrity: sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==}
     engines: {node: '>=18'}
 
+  '@isaacs/ttlcache@2.1.4':
+    resolution: {integrity: sha512-7kMz0BJpMvgAMkyglums7B2vtrn5g0a0am77JY0GjkZZNetOBCFn7AG7gKCwT0QPiXyxW7YIQSgtARknUEOcxQ==}
+    engines: {node: '>=12'}
+
   '@istanbuljs/load-nyc-config@1.1.0':
     resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
     engines: {node: '>=8'}
@@ -3733,6 +3984,14 @@ packages:
   '@lezer/lr@1.4.10':
     resolution: {integrity: sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==}
 
+  '@lukeed/csprng@1.1.0':
+    resolution: {integrity: sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA==}
+    engines: {node: '>=8'}
+
+  '@lukeed/uuid@2.0.1':
+    resolution: {integrity: sha512-qC72D4+CDdjGqJvkFMMEAtancHUQ7/d/tAiHf64z8MopFDmcrtbcJuerDtFceuAfQJ2pDSfCKCtbqoGBNnwg0w==}
+    engines: {node: '>=8'}
+
   '@lynx-js/gesture-runtime@2.1.1':
     resolution: {integrity: sha512-zBDOHakuePjw5wPCButExNgcllyFPGqYzqP2CWCWcQaX4gqJmCmYeRKguihyxH6ma6ExxlH/J2x5CHD91ed3bQ==}
     peerDependencies:
@@ -3950,6 +4209,18 @@ packages:
   '@marijn/find-cluster-break@1.0.2':
     resolution: {integrity: sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==}
 
+  '@mastra/core@1.13.2':
+    resolution: {integrity: sha512-IZOLcHxag2H43XTm2qUEXtkUyZw/R9OUyQfRDYGmqpwOY2T4lap0HvS/yclTFmK6gC1zUhPTlrsKLBq/Ilqe+Q==}
+    engines: {node: '>=22.13.0'}
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+
+  '@mastra/schema-compat@1.2.4':
+    resolution: {integrity: sha512-MVZ0NGBdUuF0u1EE0lMPPLH+le4Roy2cOW0w6rd4BakW0MUfswSkvrKlxAotBEpMAxVjkd1aT5zEf8lzFnEqEQ==}
+    engines: {node: '>=22.13.0'}
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+
   '@mdn/browser-compat-data@5.7.6':
     resolution: {integrity: sha512-7xdrMX0Wk7grrTZQwAoy1GkvPMFoizStUoL+VmtUkAxegbCCec+3FKwOM6yc/uGU5+BEczQHXAlWiqvM8JeENg==}
 
@@ -4027,6 +4298,61 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
+  '@next/env@16.2.6':
+    resolution: {integrity: sha512-gd8HoHN4ufj73WmR3JmVolrpJR47ILK6LouP5xElPglaVxir6e1a7VzvTvDWkOoPXT9rkkTzyCxBu4yeZfZwcw==}
+
+  '@next/swc-darwin-arm64@16.2.6':
+    resolution: {integrity: sha512-ZJGkkcNfYgrrMkqOdZ7zoLa1TOy0qpcMfk/z4Mh/FKUz40gVO+HNQWqmLxf67Z5WB64DRp0dhEbyHfel+6sJUg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@next/swc-darwin-x64@16.2.6':
+    resolution: {integrity: sha512-v/YLBHIY132Ced3puBJ7YJKw1lqsCrgcNo2aRJlCEyQrrCeRJlvGlnmxhPxNQI3KE3N1DN5r9TPNPvka3nq5RQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@next/swc-linux-arm64-gnu@16.2.6':
+    resolution: {integrity: sha512-RPOvqlYBbcQjkz9VQQDZ2T2bARIjXZV1KFlt+V2Mr6SW/e4I9fcKsaA0hdyf2FHoTlsV2xnBd5Y912rP/1Ce6w==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@next/swc-linux-arm64-musl@16.2.6':
+    resolution: {integrity: sha512-URUTu1+dMkxJsPFgm+OeEvq9wf5sujw0EvgYy80TDGHTSLTnIHeqb0Eu8A3sC95IRgjejQL+kC4mw+4yPxiAXA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@next/swc-linux-x64-gnu@16.2.6':
+    resolution: {integrity: sha512-DOj182mPV8G3UkrayLoREM5YEYI+Dk5wv7Ox9xl1fFibAELEsFD0lDPfHIeILlutMMfdyhlzYPELG3peuKaurw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@next/swc-linux-x64-musl@16.2.6':
+    resolution: {integrity: sha512-HKQ5SP/V/ub73UvF7n/zeJlxk2kLmtL7Wzrg4WfmkjmNos5onJ2tKu7yZOPdL18A6Svfn3max29ym+ry7NkK4g==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@next/swc-win32-arm64-msvc@16.2.6':
+    resolution: {integrity: sha512-LZXpTlPyS5v7HhSmnvsLGP3iIYgYOBnc8r8ArlT55sGHV89bR2HlDdBjWQ+PY6SJMmk8TuVGFuxalnP3k/0Dwg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@next/swc-win32-x64-msvc@16.2.6':
+    resolution: {integrity: sha512-F0+4i0h9J6C4eE3EAPWsoCk7UW/dbzOjyzxY0qnDUOYFu6FFmdZ6l97/XdV3/Nz3VYyO7UWjyEJUXkGqcoXfMA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -5031,11 +5357,80 @@ packages:
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
 
+  '@sindresorhus/slugify@2.2.1':
+    resolution: {integrity: sha512-MkngSCRZ8JdSOCHRaYd+D01XhvU3Hjy6MGl06zhOk614hp9EOAp5gIkBeQg7wtmxpitU6eAL4kdiRMcJa2dlrw==}
+    engines: {node: '>=12'}
+
+  '@sindresorhus/transliterate@1.6.0':
+    resolution: {integrity: sha512-doH1gimEu3A46VX6aVxpHTeHrytJAG6HgdxntYnCFiIFHEM/ZGpG8KiZGBChchjQmG0XFIBL552kBTjVcMZXwQ==}
+    engines: {node: '>=12'}
+
   '@socket.io/component-emitter@3.1.2':
     resolution: {integrity: sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==}
 
-  '@standard-schema/spec@1.0.0':
-    resolution: {integrity: sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA==}
+  '@standard-community/standard-json@0.3.5':
+    resolution: {integrity: sha512-4+ZPorwDRt47i+O7RjyuaxHRK/37QY/LmgxlGrRrSTLYoFatEOzvqIc85GTlM18SFZ5E91C+v0o/M37wZPpUHA==}
+    peerDependencies:
+      '@standard-schema/spec': ^1.0.0
+      '@types/json-schema': ^7.0.15
+      '@valibot/to-json-schema': ^1.3.0
+      arktype: ^2.1.20
+      effect: ^3.16.8
+      quansync: ^0.2.11
+      sury: ^10.0.0
+      typebox: ^1.0.17
+      valibot: ^1.1.0
+      zod: ^3.25.0 || ^4.0.0
+      zod-to-json-schema: ^3.24.5
+    peerDependenciesMeta:
+      '@valibot/to-json-schema':
+        optional: true
+      arktype:
+        optional: true
+      effect:
+        optional: true
+      sury:
+        optional: true
+      typebox:
+        optional: true
+      valibot:
+        optional: true
+      zod:
+        optional: true
+      zod-to-json-schema:
+        optional: true
+
+  '@standard-community/standard-openapi@0.2.9':
+    resolution: {integrity: sha512-htj+yldvN1XncyZi4rehbf9kLbu8os2Ke/rfqoZHCMHuw34kiF3LP/yQPdA0tQ940y8nDq3Iou8R3wG+AGGyvg==}
+    peerDependencies:
+      '@standard-community/standard-json': ^0.3.5
+      '@standard-schema/spec': ^1.0.0
+      arktype: ^2.1.20
+      effect: ^3.17.14
+      openapi-types: ^12.1.3
+      sury: ^10.0.0
+      typebox: ^1.0.0
+      valibot: ^1.1.0
+      zod: ^3.25.0 || ^4.0.0
+      zod-openapi: ^4
+    peerDependenciesMeta:
+      arktype:
+        optional: true
+      effect:
+        optional: true
+      sury:
+        optional: true
+      typebox:
+        optional: true
+      valibot:
+        optional: true
+      zod:
+        optional: true
+      zod-openapi:
+        optional: true
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
   '@svitejs/changesets-changelog-github-compact@1.2.0':
     resolution: {integrity: sha512-08eKiDAjj4zLug1taXSIJ0kGL5cawjVCyJkBb6EWSg5fEPX6L+Wtr0CH2If4j5KYylz85iaZiFlUItvgJvll5g==}
@@ -5131,6 +5526,9 @@ packages:
   '@swc/counter@0.1.3':
     resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
 
+  '@swc/helpers@0.5.15':
+    resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
+
   '@swc/helpers@0.5.21':
     resolution: {integrity: sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==}
 
@@ -5348,8 +5746,8 @@ packages:
   '@types/express-serve-static-core@4.19.5':
     resolution: {integrity: sha512-y6W03tvrACO72aijJ5uF02FRq5cgDR9lUxddQ8vyF+GvmjJQqbzDcJngEjURc+ZsG31VI3hODNZJ2URj86pzmg==}
 
-  '@types/express@4.17.21':
-    resolution: {integrity: sha512-ejlPM315qwLpaQlQDTjPdsUFSc6ZsP4AN6AlWnogPjQ7CVi7PYF3YVz+CY3jE2pwYf7E/7HlDAN0rV2GxTG0HQ==}
+  '@types/express@4.17.25':
+    resolution: {integrity: sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==}
 
   '@types/fs-extra@11.0.4':
     resolution: {integrity: sha512-yTbItCNreRooED33qjunPthRcSjERP1r4MqCZc7wv0u2sUkzTFp45tgUfS5+r7FrZPdmCCNflLhVSP/o+SemsQ==}
@@ -6026,6 +6424,10 @@ packages:
   aria-query@5.3.0:
     resolution: {integrity: sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==}
 
+  aria-query@5.3.2:
+    resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
+    engines: {node: '>= 0.4'}
+
   array-buffer-byte-length@1.0.2:
     resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
     engines: {node: '>= 0.4'}
@@ -6117,8 +6519,9 @@ packages:
     resolution: {integrity: sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog==}
     engines: {node: ^4.5.0 || >= 5.9}
 
-  baseline-browser-mapping@2.9.11:
-    resolution: {integrity: sha512-Sg0xJUNDU1sJNGdfGWhVHX0kkZ+HWcvmVymJbj6NSgZZmW/8S9Y2HQ5euytnIgakgxN6papOAWiwDo1ctFDcoQ==}
+  baseline-browser-mapping@2.10.29:
+    resolution: {integrity: sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==}
+    engines: {node: '>=6.0.0'}
     hasBin: true
 
   batch@0.6.1:
@@ -6225,8 +6628,8 @@ packages:
     resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
     engines: {node: '>= 0.4'}
 
-  call-bind@1.0.8:
-    resolution: {integrity: sha512-oKlSFMcMwpUg2ednkhQ454wfWiU/ul3CkJe/PEHcTKuiX6RpbehUiFMXu13HalGZxfUwCQzZG747YXBn1im9ww==}
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
     engines: {node: '>= 0.4'}
 
   call-bound@1.0.4:
@@ -6354,6 +6757,9 @@ packages:
     resolution: {integrity: sha512-ouuZd4/dm2Sw5Gmqy6bGyNNNe1qt9RpmxveLSO7KcgsTnU7RXfsw+/bukWGo1abgBiMAic068rclZsO4IWmmxQ==}
     engines: {node: '>= 12'}
 
+  client-only@0.0.1:
+    resolution: {integrity: sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==}
+
   cliui@6.0.0:
     resolution: {integrity: sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
 
@@ -6860,6 +7266,10 @@ packages:
     resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
     engines: {node: '>=12'}
 
+  dotenv@17.4.2:
+    resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
+    engines: {node: '>=12'}
+
   dprint@0.51.1:
     resolution: {integrity: sha512-CEx+wYARxLAe9o7RCZ77GKae6DF7qjn5Rd98xbWdA3hB4PFBr+kHwLANmNHscNumBAIrCg5ZJj/Kz+OYbJ+GBA==}
     hasBin: true
@@ -6944,8 +7354,8 @@ packages:
   errorstacks@2.4.1:
     resolution: {integrity: sha512-jE4i0SMYevwu/xxAuzhly/KTwtj0xDhbzB6m1xPImxTkw8wcCbgarOQPfCVMi5JKVyW7in29pNJCCJrry3Ynnw==}
 
-  es-abstract@1.24.0:
-    resolution: {integrity: sha512-WSzPgsdLtTcQwm4CROfS5ju2Wa1QQcVeT37jFjYzdFz1r9ahadC8B8/a4qxJxM+09F18iumCdRmlr96ZYkQvEg==}
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
     engines: {node: '>= 0.4'}
 
   es-define-property@1.0.1:
@@ -7238,8 +7648,8 @@ packages:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
 
-  eventsource-parser@3.0.6:
-    resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
+  eventsource-parser@3.0.8:
+    resolution: {integrity: sha512-70QWGkr4snxr0OXLRWsFLeRBIRPuQOvt4s8QYjmUlmlkyTZkRqS7EDVRZtzU3TiyDbXSzaOeF0XUKy8PchzukQ==}
     engines: {node: '>=18.0.0'}
 
   eventsource@3.0.7:
@@ -7731,6 +8141,21 @@ packages:
   hastscript@9.0.1:
     resolution: {integrity: sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w==}
 
+  hono-openapi@1.3.0:
+    resolution: {integrity: sha512-xDvCWpWEIv0weEmnl3EjRQzqbHIO8LnfzMuYOCmbuyE5aes6aXxLg4vM3ybnoZD5TiTUkA6PuRQPJs3R7WRBig==}
+    peerDependencies:
+      '@hono/standard-validator': ^0.2.0
+      '@standard-community/standard-json': ^0.3.5
+      '@standard-community/standard-openapi': ^0.2.9
+      '@types/json-schema': ^7.0.15
+      hono: ^4.8.3
+      openapi-types: ^12.1.3
+    peerDependenciesMeta:
+      '@hono/standard-validator':
+        optional: true
+      hono:
+        optional: true
+
   hono@4.12.12:
     resolution: {integrity: sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==}
     engines: {node: '>=16.9.0'}
@@ -8272,6 +8697,9 @@ packages:
   js-cookie@2.2.1:
     resolution: {integrity: sha512-HvdH2LzI/EAZcUwA8+0nKNtWHqS+ZmijLA30RwZA0bo7ToCckjK5MkGhjED9KoRcXO6BaGI3I9UIzSA1FKFPOQ==}
 
+  js-tiktoken@1.0.21:
+    resolution: {integrity: sha512-biOj/6M5qdgx5TKjDnFT1ymSpM5tbd3ylwDtrQvFQSu0Z7bBYko2dF+W/aUkXUPuk6IVpRxk/3Q2sHOzGlS36g==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -8324,6 +8752,10 @@ packages:
   json-parse-even-better-errors@2.3.1:
     resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
 
+  json-schema-to-zod@2.8.1:
+    resolution: {integrity: sha512-fRr1mHgZ7hboLKBUdR428gd9dIHUFGivUqOeiDcSmyXkNZCtB1uGaZLvsjZ4GaN5pwBIs+TGIOf6s+Rp5/R/zA==}
+    hasBin: true
+
   json-schema-traverse@0.4.1:
     resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
 
@@ -8333,6 +8765,9 @@ packages:
   json-schema-typed@8.0.2:
     resolution: {integrity: sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==}
 
+  json-schema@0.4.0:
+    resolution: {integrity: sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==}
+
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
@@ -8534,8 +8969,8 @@ packages:
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
-  lru-cache@11.2.4:
-    resolution: {integrity: sha512-B5Y16Jr9LB9dHVkh6ZevG+vAbOsNOYCX+sXvFWFu7B3Iz5mijW3zdbMyhsh8ANd2mSWBYdJgnqi+mL7/LrOPYg==}
+  lru-cache@11.3.6:
+    resolution: {integrity: sha512-Gf/KoL3C/MlI7Bt0PGI9I+TeTC/I6r/csU58N4BSNc4lppLBeKsOdFYkK+dX0ABDUMJNfCHTyPpzwwO21Awd3A==}
     engines: {node: 20 || >=22}
 
   lru-cache@5.1.1:
@@ -8919,8 +9354,8 @@ packages:
     resolution: {integrity: sha512-tacvGzUY5o2D8CBh2rrwxyNojUsZNU2zjNTzKQrkgGJQTbGAfArVWXSKMBokBeeg6C7OLRGUEyoFlYbfeWQIqw==}
     engines: {node: '>=20.17'}
 
-  nanoid@3.3.11:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -8943,6 +9378,27 @@ packages:
   neo-async@2.6.2:
     resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
 
+  next@16.2.6:
+    resolution: {integrity: sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==}
+    engines: {node: '>=20.9.0'}
+    hasBin: true
+    peerDependencies:
+      '@opentelemetry/api': ^1.1.0
+      '@playwright/test': ^1.51.1
+      babel-plugin-react-compiler: '*'
+      react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      react-dom: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
+      sass: ^1.3.0
+    peerDependenciesMeta:
+      '@opentelemetry/api':
+        optional: true
+      '@playwright/test':
+        optional: true
+      babel-plugin-react-compiler:
+        optional: true
+      sass:
+        optional: true
+
   node-addon-api@7.1.1:
     resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
 
@@ -9063,6 +9519,9 @@ packages:
     resolution: {integrity: sha512-cxN6aIDPz6rm8hbebcP7vrQNhvRcveZoJU72Y7vskh4oIm+BZwBECnx5nTmrlres1Qapvx27Qo1Auukpf8PKXw==}
     engines: {node: '>=18'}
 
+  openapi-types@12.1.3:
+    resolution: {integrity: sha512-N4YtSYJqghVu4iek2ZUvcN/0aqH1kRDuNqzcycDxhOUpg7GdvLa2F3DgS6yBNhInhv2r/6I0Flkn7CqL8+nIcw==}
+
   opener@1.5.2:
     resolution: {integrity: sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==}
     hasBin: true
@@ -9126,10 +9585,18 @@ packages:
     resolution: {integrity: sha512-d3qXVTF/s+W+CdJ5A29wywV2n8CQQYahlgz2bFiA+4eVNJbHJodPZ+/gXwPGh0bOqA+j8S+6+ckmvLGPk1QpxQ==}
     engines: {node: '>=8'}
 
+  p-map@7.0.4:
+    resolution: {integrity: sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==}
+    engines: {node: '>=18'}
+
   p-retry@6.2.0:
     resolution: {integrity: sha512-JA6nkq6hKyWLLasXQXUrO4z8BUZGUt/LjlJxx8Gb2+2ntodU/SS63YZ8b0LUTbQ8ZB9iwOfhEPhg4ykKnn2KsA==}
     engines: {node: '>=16.17'}
 
+  p-retry@7.1.1:
+    resolution: {integrity: sha512-J5ApzjyRkkf601HpEeykoiCvzHQjWxPAHhyjFcEUP2SWq0+35NKh8TLhpLw+Dkq5TZBFvUM6UigdE9hIVYTl5w==}
+    engines: {node: '>=20'}
+
   p-try@2.2.0:
     resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
     engines: {node: '>=6'}
@@ -9511,6 +9978,10 @@ packages:
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
 
+  postcss@8.4.31:
+    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
   postcss@8.5.6:
     resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -9596,6 +10067,10 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  radash@12.1.1:
+    resolution: {integrity: sha512-h36JMxKRqrAxVD8201FrCpyeNuUY9Y5zZwujr20fFO77tpUtGa6EZzfKw/3WaiBX95fq7+MpsuMLNdSnORAwSA==}
+    engines: {node: '>=14.18.0'}
+
   randexp@0.5.3:
     resolution: {integrity: sha512-U+5l2KrcMNOUPYvazA3h5ekF80FHTUG+87SEAmHZmolh1M+i/WyTCxVzmi+tidIa1tM4BSe8g2Y/D3loWDjj+w==}
     engines: {node: '>=4'}
@@ -10196,6 +10671,9 @@ packages:
     resolution: {integrity: sha512-vfD3pmTzGpufjScBh50YHKzEu2lxBWhVEHsNGoEXmCmn2hKGfeNLYMzCJpe8cD7gqX7TJluOVpBkAequ6dgMmA==}
     engines: {node: '>=4'}
 
+  secure-json-parse@2.7.0:
+    resolution: {integrity: sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==}
+
   select-hose@2.0.0:
     resolution: {integrity: sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==}
 
@@ -10272,6 +10750,10 @@ packages:
     resolution: {integrity: sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==}
     engines: {node: '>=8'}
 
+  sharp@0.34.5:
+    resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+
   shebang-command@2.0.0:
     resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
     engines: {node: '>=8'}
@@ -10544,6 +11026,19 @@ packages:
   style-to-object@1.0.8:
     resolution: {integrity: sha512-xT47I/Eo0rwJmaXC4oilDGDWLohVhR6o/xAQcPQN8q6QBuZVL8qMYL85kLmST5cPjAorwvqIA4qXTRQoYHaL6g==}
 
+  styled-jsx@5.1.6:
+    resolution: {integrity: sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA==}
+    engines: {node: '>= 12.0.0'}
+    peerDependencies:
+      '@babel/core': '*'
+      babel-plugin-macros: '*'
+      react: '>= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0'
+    peerDependenciesMeta:
+      '@babel/core':
+        optional: true
+      babel-plugin-macros:
+        optional: true
+
   stylehacks@7.0.7:
     resolution: {integrity: sha512-bJkD0JkEtbRrMFtwgpJyBbFIwfDDONQ1Ov3sDLZQP8HuJ73kBOyx66H4bOcAbVWmnfLdvQ0AJwXxOMkpujcO6g==}
     engines: {node: ^18.12.0 || ^20.9.0 || >=22.0}
@@ -11026,6 +11521,10 @@ packages:
     resolution: {integrity: sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==}
     engines: {node: '>= 0.4.0'}
 
+  uuid@11.1.1:
+    resolution: {integrity: sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==}
+    hasBin: true
+
   uuid@8.3.2:
     resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
     deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
@@ -11345,8 +11844,8 @@ packages:
       utf-8-validate:
         optional: true
 
-  ws@8.19.0:
-    resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==}
+  ws@8.20.0:
+    resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -11368,6 +11867,9 @@ packages:
   xmlchars@2.2.0:
     resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
 
+  xxhash-wasm@1.1.0:
+    resolution: {integrity: sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA==}
+
   y18n@4.0.3:
     resolution: {integrity: sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
 
@@ -11402,14 +11904,23 @@ packages:
     resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
     engines: {node: '>=18'}
 
-  zod-to-json-schema@3.25.1:
-    resolution: {integrity: sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA==}
+  zod-from-json-schema@0.0.5:
+    resolution: {integrity: sha512-zYEoo86M1qpA1Pq6329oSyHLS785z/mTwfr9V1Xf/ZLhuuBGaMlDGu/pDVGVUe4H4oa1EFgWZT53DP0U3oT9CQ==}
+
+  zod-from-json-schema@0.5.2:
+    resolution: {integrity: sha512-/dNaicfdhJTOuUd4RImbLUE2g5yrSzzDjI/S6C2vO2ecAGZzn9UcRVgtyLSnENSmAOBRiSpUdzDS6fDWX3Z35g==}
+
+  zod-to-json-schema@3.25.2:
+    resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
     peerDependencies:
-      zod: ^3.25 || ^4
+      zod: ^3.25.28 || ^4
 
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+
   zwitch@2.0.4:
     resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
 
@@ -11420,17 +11931,89 @@ packages:
 
 snapshots:
 
+  '@a2a-js/sdk@0.2.5':
+    dependencies:
+      '@types/cors': 2.8.17
+      '@types/express': 4.17.25
+      body-parser: 2.2.2
+      cors: 2.8.6
+      express: 4.22.1
+      uuid: 11.1.1
+    transitivePeerDependencies:
+      - supports-color
+
   '@a2ui/web_core@0.9.1':
     dependencies:
       '@preact/signals-core': 1.14.1
       date-fns: 4.1.0
       zod: 3.25.76
-      zod-to-json-schema: 3.25.1(zod@3.25.76)
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
 
   '@acemir/cssom@0.9.30': {}
 
   '@adobe/css-tools@4.4.2': {}
 
+  '@ai-sdk/openai@3.0.63(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.10
+      '@ai-sdk/provider-utils': 4.0.27(zod@3.25.76)
+      zod: 3.25.76
+
+  '@ai-sdk/provider-utils@2.2.8(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 1.1.3
+      nanoid: 3.3.12
+      secure-json-parse: 2.7.0
+      zod: 3.25.76
+
+  '@ai-sdk/provider-utils@3.0.20(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 2.0.1
+      '@standard-schema/spec': 1.1.0
+      eventsource-parser: 3.0.8
+      zod: 3.25.76
+
+  '@ai-sdk/provider-utils@4.0.0(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.0
+      '@standard-schema/spec': 1.1.0
+      eventsource-parser: 3.0.8
+      zod: 3.25.76
+
+  '@ai-sdk/provider-utils@4.0.27(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 3.0.10
+      '@standard-schema/spec': 1.1.0
+      eventsource-parser: 3.0.8
+      zod: 3.25.76
+
+  '@ai-sdk/provider@1.1.3':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/provider@2.0.1':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/provider@3.0.0':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/provider@3.0.10':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/provider@3.0.5':
+    dependencies:
+      json-schema: 0.4.0
+
+  '@ai-sdk/ui-utils@1.2.11(zod@3.25.76)':
+    dependencies:
+      '@ai-sdk/provider': 1.1.3
+      '@ai-sdk/provider-utils': 2.2.8(zod@3.25.76)
+      zod: 3.25.76
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+
   '@alloc/quick-lru@5.2.0': {}
 
   '@ampproject/remapping@2.3.0':
@@ -11452,7 +12035,7 @@ snapshots:
       '@csstools/css-color-parser': 3.1.0(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)
       '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
       '@csstools/css-tokenizer': 3.0.4
-      lru-cache: 11.2.4
+      lru-cache: 11.3.6
 
   '@asamuzakjp/dom-selector@6.7.6':
     dependencies:
@@ -11460,7 +12043,7 @@ snapshots:
       bidi-js: 1.0.3
       css-tree: 3.1.0
       is-potential-custom-element-name: 1.0.1
-      lru-cache: 11.2.4
+      lru-cache: 11.3.6
 
   '@asamuzakjp/nwsapi@2.3.9': {}
 
@@ -12479,6 +13062,103 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
+  '@img/colour@1.1.0':
+    optional: true
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-darwin-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-arm@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-s390x@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-wasm32@0.34.5':
+    dependencies:
+      '@emnapi/runtime': 1.9.2
+    optional: true
+
+  '@img/sharp-win32-arm64@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-x64@0.34.5':
+    optional: true
+
   '@inquirer/ansi@2.0.5': {}
 
   '@inquirer/checkbox@5.1.4(@types/node@24.10.13)':
@@ -12616,6 +13296,8 @@ snapshots:
 
   '@isaacs/cliui@9.0.0': {}
 
+  '@isaacs/ttlcache@2.1.4': {}
+
   '@istanbuljs/load-nyc-config@1.1.0':
     dependencies:
       camelcase: 5.3.1
@@ -12834,6 +13516,12 @@ snapshots:
     dependencies:
       '@lezer/common': 1.5.2
 
+  '@lukeed/csprng@1.1.0': {}
+
+  '@lukeed/uuid@2.0.1':
+    dependencies:
+      '@lukeed/csprng': 1.1.0
+
   '@lynx-js/gesture-runtime@2.1.1(@lynx-js/react@packages+react)(@lynx-js/types@3.7.0)':
     dependencies:
       '@lynx-js/react': link:packages/react
@@ -13180,6 +13868,56 @@ snapshots:
 
   '@marijn/find-cluster-break@1.0.2': {}
 
+  '@mastra/core@1.13.2(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76))(@types/json-schema@7.0.15)(openapi-types@12.1.3)(zod@3.25.76)':
+    dependencies:
+      '@a2a-js/sdk': 0.2.5
+      '@ai-sdk/provider-utils-v5': '@ai-sdk/provider-utils@3.0.20(zod@3.25.76)'
+      '@ai-sdk/provider-utils-v6': '@ai-sdk/provider-utils@4.0.0(zod@3.25.76)'
+      '@ai-sdk/provider-v5': '@ai-sdk/provider@2.0.1'
+      '@ai-sdk/provider-v6': '@ai-sdk/provider@3.0.5'
+      '@ai-sdk/ui-utils-v5': '@ai-sdk/ui-utils@1.2.11(zod@3.25.76)'
+      '@isaacs/ttlcache': 2.1.4
+      '@lukeed/uuid': 2.0.1
+      '@mastra/schema-compat': 1.2.4(zod@3.25.76)
+      '@modelcontextprotocol/sdk': 1.25.2(hono@4.12.12)(zod@3.25.76)
+      '@sindresorhus/slugify': 2.2.1
+      '@standard-schema/spec': 1.1.0
+      ajv: 8.18.0
+      dotenv: 17.4.2
+      execa: 9.6.1
+      gray-matter: 4.0.3
+      hono: 4.12.12
+      hono-openapi: 1.3.0(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76))(@types/json-schema@7.0.15)(hono@4.12.12)(openapi-types@12.1.3)
+      ignore: 7.0.5
+      js-tiktoken: 1.0.21
+      json-schema: 0.4.0
+      lru-cache: 11.3.6
+      p-map: 7.0.4
+      p-retry: 7.1.1
+      picomatch: 4.0.3
+      radash: 12.1.1
+      ws: 8.20.0
+      xxhash-wasm: 1.1.0
+      zod: 3.25.76
+    transitivePeerDependencies:
+      - '@cfworker/json-schema'
+      - '@hono/standard-validator'
+      - '@standard-community/standard-json'
+      - '@standard-community/standard-openapi'
+      - '@types/json-schema'
+      - bufferutil
+      - openapi-types
+      - supports-color
+      - utf-8-validate
+
+  '@mastra/schema-compat@1.2.4(zod@3.25.76)':
+    dependencies:
+      json-schema-to-zod: 2.8.1
+      zod: 3.25.76
+      zod-from-json-schema: 0.5.2
+      zod-from-json-schema-v3: zod-from-json-schema@0.0.5
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+
   '@mdn/browser-compat-data@5.7.6': {}
 
   '@mdn/browser-compat-data@6.1.5': {}
@@ -13277,7 +14015,7 @@ snapshots:
       cors: 2.8.6
       cross-spawn: 7.0.6
       eventsource: 3.0.7
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.0.8
       express: 5.2.1
       express-rate-limit: 7.5.1(express@5.2.1)
       jose: 6.1.3
@@ -13285,7 +14023,29 @@ snapshots:
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
       zod: 3.25.76
-      zod-to-json-schema: 3.25.1(zod@3.25.76)
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+    transitivePeerDependencies:
+      - hono
+      - supports-color
+
+  '@modelcontextprotocol/sdk@1.25.2(hono@4.12.12)(zod@4.4.3)':
+    dependencies:
+      '@hono/node-server': 1.19.9(hono@4.12.12)
+      ajv: 8.18.0
+      ajv-formats: 3.0.1(ajv@8.18.0)
+      content-type: 1.0.5
+      cors: 2.8.6
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      eventsource-parser: 3.0.8
+      express: 5.2.1
+      express-rate-limit: 7.5.1(express@5.2.1)
+      jose: 6.1.3
+      json-schema-typed: 8.0.2
+      pkce-challenge: 5.0.1
+      raw-body: 3.0.2
+      zod: 4.4.3
+      zod-to-json-schema: 3.25.2(zod@4.4.3)
     transitivePeerDependencies:
       - hono
       - supports-color
@@ -13338,6 +14098,32 @@ snapshots:
       '@tybys/wasm-util': 0.10.1
     optional: true
 
+  '@next/env@16.2.6': {}
+
+  '@next/swc-darwin-arm64@16.2.6':
+    optional: true
+
+  '@next/swc-darwin-x64@16.2.6':
+    optional: true
+
+  '@next/swc-linux-arm64-gnu@16.2.6':
+    optional: true
+
+  '@next/swc-linux-arm64-musl@16.2.6':
+    optional: true
+
+  '@next/swc-linux-x64-gnu@16.2.6':
+    optional: true
+
+  '@next/swc-linux-x64-musl@16.2.6':
+    optional: true
+
+  '@next/swc-win32-arm64-msvc@16.2.6':
+    optional: true
+
+  '@next/swc-win32-x64-msvc@16.2.6':
+    optional: true
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -14077,11 +14863,11 @@ snapshots:
       '@rspack/binding-win32-ia32-msvc': 2.0.0-beta.0
       '@rspack/binding-win32-x64-msvc': 2.0.0-beta.0
 
-  '@rspack/cli@1.7.9(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.21)(tslib@2.8.1)(webpack@5.105.2)':
+  '@rspack/cli@1.7.9(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.25)(tslib@2.8.1)(webpack@5.105.2)':
     dependencies:
       '@discoveryjs/json-ext': 0.5.7
       '@rspack/core': 1.7.9(@swc/helpers@0.5.21)
-      '@rspack/dev-server': 1.1.5(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.21)(tslib@2.8.1)(webpack@5.105.2)
+      '@rspack/dev-server': 1.1.5(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.25)(tslib@2.8.1)(webpack@5.105.2)
       exit-hook: 4.0.0
       webpack-bundle-analyzer: 4.10.2
     transitivePeerDependencies:
@@ -14110,14 +14896,14 @@ snapshots:
       '@module-federation/runtime-tools': 0.22.0
       '@swc/helpers': 0.5.21
 
-  '@rspack/dev-server@1.1.5(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.21)(tslib@2.8.1)(webpack@5.105.2)':
+  '@rspack/dev-server@1.1.5(@rspack/core@1.7.9(@swc/helpers@0.5.21))(@types/express@4.17.25)(tslib@2.8.1)(webpack@5.105.2)':
     dependencies:
       '@rspack/core': 1.7.9(@swc/helpers@0.5.21)
       chokidar: 3.6.0
-      http-proxy-middleware: 2.0.9(@types/express@4.17.21)
+      http-proxy-middleware: 2.0.9(@types/express@4.17.25)
       p-retry: 6.2.0
       webpack-dev-server: 5.2.2(tslib@2.8.1)(webpack@5.105.2)
-      ws: 8.19.0
+      ws: 8.20.0
     transitivePeerDependencies:
       - '@types/express'
       - bufferutil
@@ -14440,9 +15226,35 @@ snapshots:
 
   '@sindresorhus/merge-streams@4.0.0': {}
 
+  '@sindresorhus/slugify@2.2.1':
+    dependencies:
+      '@sindresorhus/transliterate': 1.6.0
+      escape-string-regexp: 5.0.0
+
+  '@sindresorhus/transliterate@1.6.0':
+    dependencies:
+      escape-string-regexp: 5.0.0
+
   '@socket.io/component-emitter@3.1.2': {}
 
-  '@standard-schema/spec@1.0.0': {}
+  '@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76)':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/json-schema': 7.0.15
+      quansync: 0.2.10
+    optionalDependencies:
+      zod: 3.25.76
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
+
+  '@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76)':
+    dependencies:
+      '@standard-community/standard-json': 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76)
+      '@standard-schema/spec': 1.1.0
+      openapi-types: 12.1.3
+    optionalDependencies:
+      zod: 3.25.76
+
+  '@standard-schema/spec@1.1.0': {}
 
   '@svitejs/changesets-changelog-github-compact@1.2.0':
     dependencies:
@@ -14508,6 +15320,10 @@ snapshots:
 
   '@swc/counter@0.1.3': {}
 
+  '@swc/helpers@0.5.15':
+    dependencies:
+      tslib: 2.8.1
+
   '@swc/helpers@0.5.21':
     dependencies:
       tslib: 2.8.1
@@ -14599,7 +15415,7 @@ snapshots:
   '@testing-library/jest-dom@6.9.1':
     dependencies:
       '@adobe/css-tools': 4.4.2
-      aria-query: 5.3.0
+      aria-query: 5.3.2
       css.escape: 1.5.1
       dom-accessibility-api: 0.6.3
       picocolors: 1.1.1
@@ -14726,7 +15542,7 @@ snapshots:
       '@types/range-parser': 1.2.7
       '@types/send': 0.17.4
 
-  '@types/express@4.17.21':
+  '@types/express@4.17.25':
     dependencies:
       '@types/body-parser': 1.19.5
       '@types/express-serve-static-core': 4.19.5
@@ -14826,6 +15642,10 @@ snapshots:
 
   '@types/range-parser@1.2.7': {}
 
+  '@types/react-dom@19.2.3(@types/react@18.3.28)':
+    dependencies:
+      '@types/react': 18.3.28
+
   '@types/react-dom@19.2.3(@types/react@19.2.14)':
     dependencies:
       '@types/react': 19.2.14
@@ -14850,7 +15670,7 @@ snapshots:
 
   '@types/serve-index@1.9.4':
     dependencies:
-      '@types/express': 4.17.21
+      '@types/express': 4.17.25
 
   '@types/serve-static@1.15.7':
     dependencies:
@@ -15455,6 +16275,8 @@ snapshots:
     dependencies:
       dequal: 2.0.3
 
+  aria-query@5.3.2: {}
+
   array-buffer-byte-length@1.0.2:
     dependencies:
       call-bound: 1.0.4
@@ -15464,10 +16286,10 @@ snapshots:
 
   array-includes@3.1.9:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-object-atoms: 1.1.1
       get-intrinsic: 1.3.0
       is-string: 1.1.1
@@ -15479,34 +16301,34 @@ snapshots:
 
   array.prototype.findlastindex@1.2.6:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-errors: 1.3.0
       es-object-atoms: 1.1.1
       es-shim-unscopables: 1.1.0
 
   array.prototype.flat@1.3.3:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-shim-unscopables: 1.1.0
 
   array.prototype.flatmap@1.3.3:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-shim-unscopables: 1.1.0
 
   arraybuffer.prototype.slice@1.0.4:
     dependencies:
       array-buffer-byte-length: 1.0.2
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       is-array-buffer: 3.0.5
@@ -15586,7 +16408,7 @@ snapshots:
 
   base64id@2.0.0: {}
 
-  baseline-browser-mapping@2.9.11: {}
+  baseline-browser-mapping@2.10.29: {}
 
   batch@0.6.1: {}
 
@@ -15675,7 +16497,7 @@ snapshots:
 
   browserslist@4.28.1:
     dependencies:
-      baseline-browser-mapping: 2.9.11
+      baseline-browser-mapping: 2.10.29
       caniuse-lite: 1.0.30001761
       electron-to-chromium: 1.5.267
       node-releases: 2.0.27
@@ -15716,7 +16538,7 @@ snapshots:
       es-errors: 1.3.0
       function-bind: 1.1.2
 
-  call-bind@1.0.8:
+  call-bind@1.0.9:
     dependencies:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
@@ -15833,6 +16655,8 @@ snapshots:
 
   cli-width@4.1.0: {}
 
+  client-only@0.0.1: {}
+
   cliui@6.0.0:
     dependencies:
       string-width: 4.2.3
@@ -16303,6 +17127,8 @@ snapshots:
 
   dotenv@16.4.7: {}
 
+  dotenv@17.4.2: {}
+
   dprint@0.51.1:
     optionalDependencies:
       '@dprint/darwin-arm64': 0.51.1
@@ -16388,12 +17214,12 @@ snapshots:
 
   errorstacks@2.4.1: {}
 
-  es-abstract@1.24.0:
+  es-abstract@1.24.2:
     dependencies:
       array-buffer-byte-length: 1.0.2
       arraybuffer.prototype.slice: 1.0.4
       available-typed-arrays: 1.0.7
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       data-view-buffer: 1.0.2
       data-view-byte-length: 1.0.2
@@ -16847,11 +17673,11 @@ snapshots:
 
   events@3.3.0: {}
 
-  eventsource-parser@3.0.6: {}
+  eventsource-parser@3.0.8: {}
 
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.0.8
 
   execa@9.6.1:
     dependencies:
@@ -17195,7 +18021,7 @@ snapshots:
 
   function.prototype.name@1.1.8:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
@@ -17496,6 +18322,15 @@ snapshots:
       property-information: 7.0.0
       space-separated-tokens: 2.0.2
 
+  hono-openapi@1.3.0(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-community/standard-openapi@0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76))(@types/json-schema@7.0.15)(hono@4.12.12)(openapi-types@12.1.3):
+    dependencies:
+      '@standard-community/standard-json': 0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76)
+      '@standard-community/standard-openapi': 0.2.9(@standard-community/standard-json@0.3.5(@standard-schema/spec@1.1.0)(@types/json-schema@7.0.15)(quansync@0.2.10)(zod-to-json-schema@3.25.2(zod@3.25.76))(zod@3.25.76))(@standard-schema/spec@1.1.0)(openapi-types@12.1.3)(zod@3.25.76)
+      '@types/json-schema': 7.0.15
+      openapi-types: 12.1.3
+    optionalDependencies:
+      hono: 4.12.12
+
   hono@4.12.12: {}
 
   hookable@6.0.1: {}
@@ -17562,7 +18397,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  http-proxy-middleware@2.0.9(@types/express@4.17.21):
+  http-proxy-middleware@2.0.9(@types/express@4.17.25):
     dependencies:
       '@types/http-proxy': 1.17.15
       http-proxy: 1.18.1
@@ -17570,7 +18405,7 @@ snapshots:
       is-plain-obj: 3.0.0
       micromatch: 4.0.8
     optionalDependencies:
-      '@types/express': 4.17.21
+      '@types/express': 4.17.25
     transitivePeerDependencies:
       - debug
 
@@ -17747,7 +18582,7 @@ snapshots:
 
   is-array-buffer@3.0.5:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       get-intrinsic: 1.3.0
 
@@ -18109,6 +18944,10 @@ snapshots:
 
   js-cookie@2.2.1: {}
 
+  js-tiktoken@1.0.21:
+    dependencies:
+      base64-js: 1.5.1
+
   js-tokens@4.0.0: {}
 
   js-tokens@9.0.1: {}
@@ -18144,7 +18983,7 @@ snapshots:
       whatwg-encoding: 3.1.1
       whatwg-mimetype: 4.0.0
       whatwg-url: 14.2.0
-      ws: 8.19.0
+      ws: 8.20.0
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - bufferutil
@@ -18171,7 +19010,7 @@ snapshots:
       webidl-conversions: 8.0.0
       whatwg-mimetype: 4.0.0
       whatwg-url: 15.1.0
-      ws: 8.19.0
+      ws: 8.20.0
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - '@exodus/crypto'
@@ -18187,12 +19026,16 @@ snapshots:
 
   json-parse-even-better-errors@2.3.1: {}
 
+  json-schema-to-zod@2.8.1: {}
+
   json-schema-traverse@0.4.1: {}
 
   json-schema-traverse@1.0.0: {}
 
   json-schema-typed@8.0.2: {}
 
+  json-schema@0.4.0: {}
+
   json-stable-stringify-without-jsonify@1.0.1: {}
 
   json-stream-stringify@3.0.1: {}
@@ -18369,7 +19212,7 @@ snapshots:
 
   lru-cache@10.4.3: {}
 
-  lru-cache@11.2.4: {}
+  lru-cache@11.3.6: {}
 
   lru-cache@5.1.1:
     dependencies:
@@ -19024,7 +19867,7 @@ snapshots:
 
   nano-spawn@2.0.0: {}
 
-  nanoid@3.3.11: {}
+  nanoid@3.3.12: {}
 
   napi-postinstall@0.3.3: {}
 
@@ -19036,6 +19879,32 @@ snapshots:
 
   neo-async@2.6.2: {}
 
+  next@16.2.6(@playwright/test@1.58.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(sass@1.97.3):
+    dependencies:
+      '@next/env': 16.2.6
+      '@swc/helpers': 0.5.15
+      baseline-browser-mapping: 2.10.29
+      caniuse-lite: 1.0.30001761
+      postcss: 8.4.31
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      styled-jsx: 5.1.6(react@19.2.4)
+    optionalDependencies:
+      '@next/swc-darwin-arm64': 16.2.6
+      '@next/swc-darwin-x64': 16.2.6
+      '@next/swc-linux-arm64-gnu': 16.2.6
+      '@next/swc-linux-arm64-musl': 16.2.6
+      '@next/swc-linux-x64-gnu': 16.2.6
+      '@next/swc-linux-x64-musl': 16.2.6
+      '@next/swc-win32-arm64-msvc': 16.2.6
+      '@next/swc-win32-x64-msvc': 16.2.6
+      '@playwright/test': 1.58.2
+      sass: 1.97.3
+      sharp: 0.34.5
+    transitivePeerDependencies:
+      - '@babel/core'
+      - babel-plugin-macros
+
   node-addon-api@7.1.1:
     optional: true
 
@@ -19112,7 +19981,7 @@ snapshots:
 
   object.assign@4.1.7:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
@@ -19121,16 +19990,16 @@ snapshots:
 
   object.fromentries@2.0.8:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-object-atoms: 1.1.1
 
   object.groupby@1.0.3:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
 
   object.pick@1.3.0:
     dependencies:
@@ -19138,7 +20007,7 @@ snapshots:
 
   object.values@1.2.1:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
@@ -19178,6 +20047,8 @@ snapshots:
       is-inside-container: 1.0.0
       is-wsl: 3.1.0
 
+  openapi-types@12.1.3: {}
+
   opener@1.5.2: {}
 
   optionator@0.9.4:
@@ -19256,12 +20127,18 @@ snapshots:
     dependencies:
       aggregate-error: 3.1.0
 
+  p-map@7.0.4: {}
+
   p-retry@6.2.0:
     dependencies:
       '@types/retry': 0.12.2
       is-network-error: 1.1.0
       retry: 0.13.1
 
+  p-retry@7.1.1:
+    dependencies:
+      is-network-error: 1.1.0
+
   p-try@2.2.0: {}
 
   package-hash@4.0.0:
@@ -19326,7 +20203,7 @@ snapshots:
 
   path-scurry@2.0.2:
     dependencies:
-      lru-cache: 11.2.4
+      lru-cache: 11.3.6
       minipass: 7.1.3
 
   path-serializer@0.5.1: {}
@@ -19587,9 +20464,15 @@ snapshots:
 
   postcss-value-parser@4.2.0: {}
 
+  postcss@8.4.31:
+    dependencies:
+      nanoid: 3.3.12
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
   postcss@8.5.6:
     dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.12
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -19665,6 +20548,8 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
+  radash@12.1.1: {}
+
   randexp@0.5.3:
     dependencies:
       drange: 1.1.1
@@ -19879,9 +20764,9 @@ snapshots:
 
   reflect.getprototypeof@1.0.10:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-errors: 1.3.0
       es-object-atoms: 1.1.1
       get-intrinsic: 1.3.0
@@ -19907,7 +20792,7 @@ snapshots:
 
   regexp.prototype.flags@1.5.4:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
       es-errors: 1.3.0
       get-proto: 1.0.1
@@ -20154,7 +21039,7 @@ snapshots:
 
   safe-array-concat@1.1.3:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       get-intrinsic: 1.3.0
       has-symbols: 1.1.0
@@ -20314,6 +21199,8 @@ snapshots:
       extend-shallow: 2.0.1
       kind-of: 6.0.3
 
+  secure-json-parse@2.7.0: {}
+
   select-hose@2.0.0: {}
 
   selfsigned@2.4.1:
@@ -20433,6 +21320,38 @@ snapshots:
     dependencies:
       kind-of: 6.0.3
 
+  sharp@0.34.5:
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.7.4
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.34.5
+      '@img/sharp-darwin-x64': 0.34.5
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+      '@img/sharp-libvips-linux-arm': 1.2.4
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+      '@img/sharp-libvips-linux-x64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+      '@img/sharp-linux-arm': 0.34.5
+      '@img/sharp-linux-arm64': 0.34.5
+      '@img/sharp-linux-ppc64': 0.34.5
+      '@img/sharp-linux-riscv64': 0.34.5
+      '@img/sharp-linux-s390x': 0.34.5
+      '@img/sharp-linux-x64': 0.34.5
+      '@img/sharp-linuxmusl-arm64': 0.34.5
+      '@img/sharp-linuxmusl-x64': 0.34.5
+      '@img/sharp-wasm32': 0.34.5
+      '@img/sharp-win32-arm64': 0.34.5
+      '@img/sharp-win32-ia32': 0.34.5
+      '@img/sharp-win32-x64': 0.34.5
+    optional: true
+
   shebang-command@2.0.0:
     dependencies:
       shebang-regex: 3.0.0
@@ -20680,24 +21599,24 @@ snapshots:
 
   string.prototype.trim@1.2.10:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-data-property: 1.1.4
       define-properties: 1.2.1
-      es-abstract: 1.24.0
+      es-abstract: 1.24.2
       es-object-atoms: 1.1.1
       has-property-descriptors: 1.0.2
 
   string.prototype.trimend@1.0.9:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
 
   string.prototype.trimstart@1.0.8:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       define-properties: 1.2.1
       es-object-atoms: 1.1.1
 
@@ -20762,6 +21681,11 @@ snapshots:
     dependencies:
       inline-style-parser: 0.2.4
 
+  styled-jsx@5.1.6(react@19.2.4):
+    dependencies:
+      client-only: 0.0.1
+      react: 19.2.4
+
   stylehacks@7.0.7(postcss@8.5.6):
     dependencies:
       browserslist: 4.28.1
@@ -21102,7 +22026,7 @@ snapshots:
 
   typed-array-byte-length@1.0.3:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       for-each: 0.3.5
       gopd: 1.2.0
       has-proto: 1.2.0
@@ -21111,7 +22035,7 @@ snapshots:
   typed-array-byte-offset@1.0.4:
     dependencies:
       available-typed-arrays: 1.0.7
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       for-each: 0.3.5
       gopd: 1.2.0
       has-proto: 1.2.0
@@ -21120,7 +22044,7 @@ snapshots:
 
   typed-array-length@1.0.7:
     dependencies:
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       for-each: 0.3.5
       gopd: 1.2.0
       is-typed-array: 1.1.15
@@ -21162,7 +22086,7 @@ snapshots:
   typia@10.1.0(typescript@5.9.3):
     dependencies:
       '@samchon/openapi': 5.1.0
-      '@standard-schema/spec': 1.0.0
+      '@standard-schema/spec': 1.1.0
       commander: 10.0.1
       comment-json: 4.2.5
       inquirer: 8.2.6
@@ -21315,6 +22239,8 @@ snapshots:
 
   utils-merge@1.0.1: {}
 
+  uuid@11.1.1: {}
+
   uuid@8.3.2: {}
 
   v8-to-istanbul@9.3.0:
@@ -21495,7 +22421,7 @@ snapshots:
     dependencies:
       '@types/bonjour': 3.5.13
       '@types/connect-history-api-fallback': 1.5.4
-      '@types/express': 4.17.21
+      '@types/express': 4.17.25
       '@types/express-serve-static-core': 4.19.5
       '@types/serve-index': 1.9.4
       '@types/serve-static': 1.15.7
@@ -21509,7 +22435,7 @@ snapshots:
       connect-history-api-fallback: 2.0.0
       express: 4.22.1
       graceful-fs: 4.2.11
-      http-proxy-middleware: 2.0.9(@types/express@4.17.21)
+      http-proxy-middleware: 2.0.9(@types/express@4.17.25)
       ipaddr.js: 2.3.0
       launch-editor: 2.13.2
       open: 10.1.2
@@ -21520,7 +22446,7 @@ snapshots:
       sockjs: 0.3.24
       spdy: 4.0.2
       webpack-dev-middleware: 7.4.5(tslib@2.8.1)(webpack@5.105.2)
-      ws: 8.19.0
+      ws: 8.20.0
     optionalDependencies:
       webpack: 5.105.2
     transitivePeerDependencies:
@@ -21700,7 +22626,7 @@ snapshots:
   which-typed-array@1.1.19:
     dependencies:
       available-typed-arrays: 1.0.7
-      call-bind: 1.0.8
+      call-bind: 1.0.9
       call-bound: 1.0.4
       for-each: 0.3.5
       get-proto: 1.0.1
@@ -21766,7 +22692,7 @@ snapshots:
 
   ws@8.17.1: {}
 
-  ws@8.19.0: {}
+  ws@8.20.0: {}
 
   xml-name-validator@5.0.0: {}
 
@@ -21774,6 +22700,8 @@ snapshots:
 
   xmlchars@2.2.0: {}
 
+  xxhash-wasm@1.1.0: {}
+
   y18n@4.0.3: {}
 
   yallist@3.1.1: {}
@@ -21807,12 +22735,26 @@ snapshots:
 
   yoctocolors@2.1.2: {}
 
-  zod-to-json-schema@3.25.1(zod@3.25.76):
+  zod-from-json-schema@0.0.5:
     dependencies:
       zod: 3.25.76
 
+  zod-from-json-schema@0.5.2:
+    dependencies:
+      zod: 4.4.3
+
+  zod-to-json-schema@3.25.2(zod@3.25.76):
+    dependencies:
+      zod: 3.25.76
+
+  zod-to-json-schema@3.25.2(zod@4.4.3):
+    dependencies:
+      zod: 4.4.3
+
   zod@3.25.76: {}
 
+  zod@4.4.3: {}
+
   zwitch@2.0.4: {}
 
   zx@8.8.5: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5b35a5b40e..90bf08f1a4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -88,4 +88,5 @@ allowBuilds:
   core-js: false
   dprint: true
   esbuild: true
+  sharp: true
   unrs-resolver: false