Seven ways into one toolkit

The smallest interactive host: authorize the principal, opt into writes, and give streamText() the registry projection plus the toolkit-owned system contract.

1/**
2 * The whole AI SDK integration — a Next.js route handler.
3 *
4 * `auth0` is the zero-config singleton: it reads AUTH0_* env vars (live mode)
5 * or falls back to an in-memory mock tenant with auto-approve (mock mode) so
6 * this route works before a tenant exists. For explicit config — BYO stores,
7 * custom tools, a signing key — swap in createAuth0Toolkit(config) from the
8 * same subpath.
9 */
10import { auth0 } from '@auth0/agent-toolkit/ai-sdk';
11import { convertToModelMessages, stepCountIs, streamText } from 'ai';
12
13export const maxDuration = 300; // approvals block inside the tool call while CIBA polls
14
15export async function POST(req: Request) {
16  const { messages } = await req.json();
17
18  const result = streamText({
19    model: 'anthropic/claude-sonnet-5',
20    // The lifecycle contract (plan first, never skip approval, report honestly)
21    // is toolkit-owned — apps never hand-write it.
22    system: auth0.systemPrompt(),
23    // writes: true opts into the write tools; the user is who approvals route
24    // to when APPROVER_MODE=session (the signed-in human's own phone).
25    tools: auth0.tools({
26      principal: {
27        type: 'tenant-admin',
28        user: { sub: 'auth0|the-host-authorized-admin' },
29      },
30      writes: true,
31    }),
32    stopWhen: stepCountIs(8),
33    messages: await convertToModelMessages(messages),
34  });
35
36  return result.toUIMessageStreamResponse();
37}