@axiorank/ai-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AxioRank
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,142 @@
+# @axiorank/ai-sdk
+
+AxioRank guardrail middleware for the [Vercel AI SDK](https://ai-sdk.dev). One
+`wrapLanguageModel` call governs every `generateText`, `streamText`, and
+`generateObject` through a model: the prompt is inspected before it is sent, the
+completion is inspected and optionally redacted before your app sees it, and the
+tool calls the model proposes are inspected before the SDK executes them.
+
+It catches leaked secrets, prompt injection, PII, and destructive tool calls,
+using the same detectors and risk scoring as the rest of AxioRank, the security
+gateway for AI agents.
+
+## Install
+
+```bash
+npm install @axiorank/ai-sdk ai
+```
+
+`ai` (v7 or later) is a peer dependency.
+
+## Quickstart
+
+```ts
+import { wrapLanguageModel } from "ai";
+import { openai } from "@ai-sdk/openai";
+import { createAxioRankMiddleware } from "@axiorank/ai-sdk";
+
+const model = wrapLanguageModel({
+  model: openai("gpt-4o"),
+  middleware: createAxioRankMiddleware({ apiKey: process.env.AXIORANK_KEY }),
+});
+
+// governed: prompt, completion, and proposed tool calls are all inspected
+const { text } = await generateText({ model, prompt: "..." });
+```
+
+Streaming works the same way:
+
+```ts
+const { textStream } = await streamText({ model, prompt: "..." });
+```
+
+## Try it with no key
+
+Leave the API key off and the middleware runs the detectors in-process (no
+signup, no network) as an advisory guard:
+
+```ts
+const model = wrapLanguageModel({
+  model: openai("gpt-4o"),
+  middleware: createAxioRankMiddleware(), // local mode
+});
+```
+
+## What it inspects
+
+| Surface | When | Default action on a block |
+| --- | --- | --- |
+| Prompt | Before the model is called | Return a refusal (the model is never called) |
+| Completion | After the model responds | Redact (hosted policy) or replace with a refusal |
+| Tool calls | On the calls the model proposes | Strip the denied call so the SDK never runs it |
+
+A denied call is handled gracefully by default (`onDeny: "block"`): the surface
+is refused, redacted, or stripped, and generation continues. Set
+`onDeny: "throw"` to raise `AxioRankDeniedError` instead.
+
+## Hosted vs local
+
+* **Hosted** (an API key is present): calls the AxioRank gateway, so your
+  workspace's real policy applies, every call lands in the audit log, and the
+  gateway can return a redacted completion. Enable model I/O enforcement in your
+  workspace settings so prompt and completion governance is active; otherwise the
+  gateway inspects but does not block them.
+* **Local** (no API key): runs the bundled detectors in-process against the
+  default posture. Advisory and block-on-deny only (no policy, no redaction).
+
+## Streaming
+
+`streamText` forwards tokens as they arrive, so a secret that appears mid-stream
+would reach the client before it could be caught. The `stream` option controls
+the trade-off:
+
+* `"buffer"` (default): accumulate the streamed text, inspect it, then release
+  it. Redaction and blocking are correct, at the cost of some first-token
+  latency.
+* `"passthrough"`: stream tokens live and inspect at the end for audit only. It
+  cannot retract text that has already been sent, so it never redacts.
+
+## Options
+
+```ts
+createAxioRankMiddleware({
+  apiKey,            // else AXIORANK_API_KEY, then AXIORANK_KEY
+  baseUrl,           // else AXIORANK_BASE_URL, then https://app.axiorank.com
+  mode,              // "hosted" | "local" (auto: hosted when a key is present)
+  onDeny,            // "block" (default) | "throw"
+  failOpen,          // default true: an AxioRank outage never breaks your app
+  inspectPrompts,    // default true
+  inspectCompletions,// default true
+  inspectToolCalls,  // default true
+  stream,            // "buffer" (default) | "passthrough"
+  refusal,           // text substituted for a blocked prompt or completion
+  onDecision,        // (phase, verdict) => void, for logging and metrics
+  timeoutMs,         // default 10000
+  model,             // model label sent to the gateway (defaults to the call's id)
+});
+```
+
+## Relationship to `@axiorank/sdk`
+
+This middleware guards the **model**: its prompts, its completions, and the tool
+calls it proposes. To guard tool **execution** (the code your tools actually
+run), use `guardTools` from `@axiorank/sdk/vercel`. The two are complementary and
+compose:
+
+```ts
+import { AxioRank } from "@axiorank/sdk";
+import { guardTools } from "@axiorank/sdk/vercel";
+import { createAxioRankMiddleware } from "@axiorank/ai-sdk";
+
+const axio = new AxioRank({ apiKey: process.env.AXIORANK_KEY });
+
+const model = wrapLanguageModel({
+  model: openai("gpt-4o"),
+  middleware: createAxioRankMiddleware({ apiKey: process.env.AXIORANK_KEY }),
+});
+
+await generateText({
+  model,
+  tools: guardTools(myTools, axio),
+  prompt: "...",
+});
+```
+
+`AxioRankDeniedError` is re-exported here and is the same class `@axiorank/sdk`
+throws, so a single `catch` handles both.
+
+## Links
+
+* [axiorank.com](https://axiorank.com)
+* [Documentation](https://axiorank.com/docs)
+* [Issues](https://github.com/frostyhand/AxioRank/issues)