@evalguard/vercel-ai 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a
+      fee for, acceptance of support, warranty, indemnity, or other
+      liability obligations and/or rights consistent with this License.
+      However, in accepting such obligations, You may act only on Your
+      own behalf and on Your sole responsibility, not on behalf of any
+      other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024-2026 EvalGuard, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,248 @@
+# @evalguard/vercel-ai
+
+Drop-in [Vercel AI SDK](https://sdk.vercel.ai) middleware that adds [EvalGuard](https://evalguard.ai)
+guardrails (firewall input checks) and observability (trace logging, cost
+tracking) to any language model from `@ai-sdk/openai`, `@ai-sdk/anthropic`,
+`@ai-sdk/google`, `@ai-sdk/groq`, or any other provider that follows the AI SDK
+model interface.
+
+Verified against **`ai@5`, `ai@6` and `ai@7`** (model spec v2 / v3 / v4) — by a
+check that runs before this package is published, not by assertion. For each
+major, `scripts/verify-vercel-ai-peer-matrix.mjs` installs the packed tarball
+into a clean consumer alongside that version of `ai` and its matching
+`@ai-sdk/openai`, **type-checks the quickstart below verbatim** against it, and
+**executes** `withEvalguard` end to end through that version's own
+`generateText` / `streamText` (against a stub model, no network), asserting the
+emitted trace carries numeric token counts.
+
+The exact versions covered are in `peer-matrix.json`, which ships in this
+tarball. Two steps in `.github/workflows/publish-wrappers.yml` run **before**
+this package is published — `pnpm gate:publish-readiness` and
+`pnpm gate:vercel-ai-peers` — and the first fails the release if the paragraph
+above and `peer-matrix.json` disagree in *either* direction, or if no workflow
+runs the second. So the sentence above cannot outlive the thing that makes it
+true. (Naming both commands is deliberate: until 2026-08-03 this paragraph said
+"a CI gate" and `gate:publish-readiness` appeared in no workflow at all, which
+made the sentence describing the gate the very kind of unbacked claim the gate
+exists to catch.)
+
+The wrapper is a **Proxy** over the underlying model that intercepts only
+`doGenerate` / `doStream`; every other property read is forwarded to the real
+instance. That matters because real provider models are class instances whose
+`supportedUrls` / `provider` / `modelId` are prototype getters — an object
+spread (`{ ...model }`) copies own enumerable properties only and would drop
+all of them. Capability fields therefore pass through untouched and URL/file
+inputs the model handles natively are not stripped or re-downloaded.
+
+Output text is read from the `content` array. Token counts are read from usage
+in whichever shape the peer uses: a flat `inputTokens` number on `ai@5`, the
+`{ total, … }` breakdown object on `ai@6` / `ai@7`, and the legacy v1
+`promptTokens` / `completionTokens` as a back-compat fallback.
+
+## Install
+
+```bash
+npm install @evalguard/vercel-ai ai @ai-sdk/openai
+```
+
+`ai` is a peer dependency (npm installs it for you, but naming it pins the
+major you want). `@ai-sdk/openai` is the provider used by the quickstart below
+— swap it for `@ai-sdk/anthropic`, `@ai-sdk/google`, or whichever provider you
+actually use.
+
+> ### ⚠️ ESM-only — requires `"type": "module"`
+>
+> `@evalguard/vercel-ai` ships **ES modules only** (`"type": "module"`, no CJS build). The
+> quickstart below **will not type-check or run** in a default CommonJS
+> TypeScript project — you get `TS1479` ("the referenced file is an ECMAScript
+> module and cannot be imported with `require`") and, because the peer SDK's
+> types then resolve under a different module mode, a confusing
+> `TS2345 … Property '#private' … refers to a different member` on the very
+> first call.
+>
+> **To use this package, your consuming project must be ESM:**
+>
+> ```jsonc
+> // package.json
+> { "type": "module" }
+> ```
+> ```jsonc
+> // tsconfig.json
+> { "compilerOptions": { "module": "node16", "moduleResolution": "node16" } }
+> ```
+>
+> **Staying on CommonJS?** Load it with a dynamic `import()`. Unlike the
+> SDK-shaped wrappers (`@evalguard/openai`, `@evalguard/anthropic`,
+> `@evalguard/gemini`), `ai` and the `@ai-sdk/*` providers are dual-published,
+> so those imports can stay static. Verified against `ai@5` +
+> `@ai-sdk/openai@2`.
+>
+> The `await` must sit **inside an async function**: top-level `await` is an
+> ESM-only feature, so a bare `await import(...)` at file scope in a CJS module
+> is `TS1309: The current file is a CommonJS module and cannot use 'await' at
+> the top level`.
+>
+> ```typescript
+> // ✅ compiles under module/moduleResolution "node16", no "type": "module"
+> import { openai } from "@ai-sdk/openai";
+>
+> async function main() {
+>   const { withEvalguard } = await import("@evalguard/vercel-ai");
+>   const model = withEvalguard(openai("gpt-4o-mini"), {
+>     apiKey: process.env.EVALGUARD_API_KEY!,
+>     projectId: "proj-123",
+>   });
+>
+>   // …then pass `model` to generateText / streamText as the quickstart does.
+>   return model;
+> }
+>
+> void main();
+> ```
+>
+> The export is `withEvalguard` — lower-case `g`. This block said
+> `withEvalGuard` until 2026-08-01, which does not exist and fails with
+> `TS2339: Property 'withEvalGuard' does not exist`.
+>
+> If you swap in a provider package that is itself ESM-only, that import has to
+> become dynamic as well — the rule is that **no ESM-only specifier may be
+> imported statically from a CJS file**, not just this one.
+>
+> Node.js ≥ 22.12 can also `require()` an ESM module directly
+> (`require(esm)`), but TypeScript still type-checks the import under CJS
+> rules, so the dynamic-import form above is the supported path.
+
+Peer requires `ai >= 5.0.0` (`ai@5`, `ai@6` and `ai@7` are all verified).
+
+## Use
+
+<!-- peer-matrix:quickstart -->
+
+```ts
+import { openai } from "@ai-sdk/openai";
+import { generateText } from "ai";
+import { withEvalguard } from "@evalguard/vercel-ai";
+
+const model = withEvalguard(openai("gpt-4o-mini"), {
+  apiKey: process.env.EVALGUARD_API_KEY!,
+  projectId: "proj-123",
+});
+
+const { text } = await generateText({ model, prompt: "Say hi." });
+```
+
+<!-- /peer-matrix:quickstart -->
+
+<sub>The two comments above are load-bearing:
+`scripts/verify-vercel-ai-peer-matrix.mjs` extracts exactly what is between
+them and type-checks that text against every peer major, so this block cannot
+drift from what is actually verified. Removing them fails the gate.</sub>
+
+That's it — every call now:
+
+1. Runs your prompt through EvalGuard's 5-layer firewall (pattern, token,
+   semantic, output validation, allow-list precedence) before reaching
+   the LLM. Blocks on violation by default — set `blockOnViolation: false`
+   to log-only.
+2. Records a trace with model, provider, input, output, latency, token
+   usage, and estimated cost to your EvalGuard project.
+
+## Options
+
+```ts
+withEvalguard(model, {
+  apiKey: "...",
+  projectId: "proj-...",        // optional — required to scope traces
+  baseUrl: "https://...",        // optional — self-hosted EvalGuard
+  blockOnViolation: true,        // default: true
+  disableGuardrails: false,      // default: false
+  disableLogging: false,         // default: false
+  metadata: { feature: "support-bot", env: "prod" },
+});
+```
+
+## Streaming works too
+
+Stream parts pass through verbatim. The trace is logged once on `finish`
+with the assembled text and token totals.
+
+```ts
+import { streamText } from "ai";
+
+const { textStream } = await streamText({ model, prompt: "..." });
+for await (const chunk of textStream) {
+  process.stdout.write(chunk);
+}
+```
+
+## Outage semantics — fail-CLOSED by default
+
+> Corrected 2026-07-29. This section previously promised a fail-**open**
+> "guarantee" ("falls back to allow + don't log"). The wrappers went
+> fail-closed on 2026-05-28; the docs were never updated.
+
+If EvalGuard's API is unreachable, slow, or returns an error:
+
+- `blockOnViolation: true` (**default**) — the wrapper **throws**
+  `EvalguardBlockedError` with a `guardrail_unavailable` violation. The
+  provider call is not made.
+- `blockOnViolation: false` — the call proceeds and the outage is recorded.
+
+Trace-log errors are silently swallowed in both modes.
+
+`EvalguardBlockedError` is also what a real firewall block raises, and it
+is catchable distinctly:
+
+```ts
+import { EvalguardBlockedError } from "@evalguard/vercel-ai";
+
+try {
+  const { text } = await generateText({ model, prompt: userInput });
+} catch (err) {
+  if (err instanceof EvalguardBlockedError) {
+    return { error: "blocked", violations: err.violations };
+  }
+  throw err;
+}
+```
+
+## Cost estimates: unpriced models are reported as unpriced
+
+`estimateCost()` used to invent a price for any model outside a ~60-row table:
+`estimateCost("gpt-5", 1000, 500)` and `estimateCost("totally-unknown-model",
+1000, 500)` both returned `0.0105` from a blended $0.003/$0.015-per-1k
+fallback — with no flag and no warning. A FinOps figure you cannot tell apart
+from a real vendor price is worse than no figure at all.
+
+Two things changed:
+
+- **Coverage** — 2,200+ model ids now resolve to a real, sourced rate
+  (generated from EvalGuard's own pricing database, which is synced from the
+  LiteLLM catalogue). `gpt-5` is priced correctly.
+- **Honesty** — a genuinely unknown model is now *visibly* unknown.
+
+```typescript
+import { estimateCostDetailed, isModelPriced } from "@evalguard/vercel-ai";
+
+estimateCostDetailed("gpt-5", 1000, 500);
+// { model: "gpt-5", costUsd: 0.00625, priced: true, pricingSource: "catalog" }
+
+estimateCostDetailed("totally-unknown-model", 1000, 500);
+// { model: "totally-unknown-model",
+//   costUsd: null,              // <- never a fabricated number
+//   priced: false,
+//   pricingSource: "unpriced",
+//   blendedFallbackUsd: 0.0105 } // <- opt-in rough figure, clearly labelled
+
+isModelPriced("totally-unknown-model"); // false
+```
+
+`estimateCost()` still returns a `number` for backwards compatibility, but it
+now emits a one-time `console.warn` naming the unpriced model. Traces carry
+`costPricingSource` alongside `cost`, and `cost` is `null` for an unpriced
+model rather than a guess, so your EvalGuard dashboard shows "unpriced" instead
+of a fake dollar amount.
+
+## License
+
+Apache-2.0

package/dist/cost.d.ts

@@ -0,0 +1,4 @@
+export { estimateCost } from "@evalguard/wrapper-core";
+export { estimateCostDetailed, isModelPriced } from "@evalguard/wrapper-core";
+export type { CostEstimate, PricingSource } from "@evalguard/wrapper-core";
+//# sourceMappingURL=cost.d.ts.map

package/dist/cost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAMvD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC9E,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/cost.js

@@ -0,0 +1,18 @@
+// Cost estimation is shared across all EvalGuard wrappers — re-exported from
+// @evalguard/wrapper-core so the model pricing table has a single source of
+// truth (as anthropic-wrapper/src/cost.ts and openai-wrapper/src/cost.ts
+// already do).
+//
+// This file used to carry its OWN partial price table that returned 0 for any
+// model it didn't list. That silently contradicts wrapper-core's explicit
+// policy — an unknown model falls back to a conservative $0.003/$0.015 per 1k
+// because reporting 0 is worse than slightly-off: it MASKS the bill. A customer
+// on a model missing from the local table (claude-sonnet-4-5, gpt-5, any new
+// release) saw $0.00 spend in every trace while burning real provider budget.
+export { estimateCost } from "@evalguard/wrapper-core";
+// 2026-07-30 (audit finding 5): `estimateCostDetailed` is re-exported alongside
+// it. The blended fallback above is no longer SILENT — an unpriced model now
+// reports `{ costUsd: null, priced: false }` instead of a number a customer
+// cannot tell apart from a real vendor price.
+export { estimateCostDetailed, isModelPriced } from "@evalguard/wrapper-core";
+//# sourceMappingURL=cost.js.map

package/dist/cost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.js","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,eAAe;AACf,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,8CAA8C;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,254 @@
+/**
+ * EvalGuard middleware for the Vercel AI SDK.
+ *
+ * Drop-in usage: wrap any language model from @ai-sdk/{openai,anthropic,
+ * google,...} — model spec v2 (`ai@5`), v3 (`ai@6`) or v4 (`ai@7`) —
+ * with `withEvalguard()` to get pre-call guardrails (firewall
+ * check) + post-call trace logging (latency, tokens, cost) sent to your
+ * EvalGuard project. Guardrail semantics are fail-CLOSED when
+ * blockOnViolation is on (the default): if the firewall is unreachable the
+ * call is BLOCKED with an EvalguardBlockedError, matching the langchain /
+ * llamaindex wrappers. In monitor-only mode (blockOnViolation:false) a
+ * guardrail outage is swallowed and the call proceeds. Trace logging always
+ * fails open — a logging error never breaks or delays the user's call.
+ *
+ * Usage:
+ *
+ *   import { openai } from "@ai-sdk/openai";
+ *   import { generateText } from "ai";
+ *   import { withEvalguard } from "@evalguard/vercel-ai";
+ *
+ *   const model = withEvalguard(openai("gpt-4o-mini"), {
+ *     apiKey: process.env.EVALGUARD_API_KEY!,
+ *     projectId: "proj-123",
+ *   });
+ *
+ *   const { text } = await generateText({ model, prompt: "hi" });
+ *
+ * The Vercel AI SDK's `wrapLanguageModel` is the documented composition hook
+ * for exactly this use case. We deliberately do NOT import it (nor `ai` itself)
+ * at RUNTIME: the only `dependencies` entry is `@evalguard/wrapper-core`, and
+ * `ai` is a PEER, so the version the customer already chose is the one that
+ * runs — we never resolve a second copy into their tree, and there is no
+ * import of `ai` to break if they are on a major we did not anticipate.
+ *
+ * That is NOT the same as "installing this package pulls nothing in".
+ * npm 7+ installs peerDependencies automatically, and it was measured doing
+ * exactly that on 2026-08-02:
+ *
+ *   $ npm install ./evalguard-vercel-ai-1.0.0.tgz   # clean `npm init -y`
+ *   added 12 packages
+ *   $ npm ls --all
+ *   └─┬ @evalguard/vercel-ai@1.0.0
+ *     └── ai@7.0.48
+ *
+ * The comment here previously claimed the opposite ("never pulls the AI SDK in
+ * as a transitive dependency", and before that "a tiny, zero-runtime-dependency
+ * install"), which also contradicted the README two paragraphs below it
+ * ("`ai` is a peer dependency (npm installs it for you…)"). This JSDoc block
+ * ships to consumers inside `dist/index.d.ts`, so it was a wrong claim in the
+ * published artifact, not just an internal note.
+ *
+ * Instead of importing `wrapLanguageModel` we re-implement the same "delegate
+ * to the model, override doGenerate/doStream" shape directly, as a PROXY over
+ * the original model. Everything except the two call methods is forwarded to the
+ * real instance, so capability fields — most importantly `supportedUrls` —
+ * pass through untouched. Two earlier versions got this wrong:
+ *   1. hand-copying a fixed list of V1 props (`supportsUrl`,
+ *      `supportsImageUrls`, …) that no longer exist on a V2 model, which
+ *      silently STRIPPED `supportedUrls` (audit MEDIUM 2026-07-14);
+ *   2. `{ ...model }` — an object spread copies OWN ENUMERABLE properties
+ *      only. Every real provider model (`openai(...)`, `anthropic(...)`) is a
+ *      CLASS INSTANCE whose `supportedUrls` / `provider` / `modelId` are
+ *      prototype GETTERS, so the spread produced `{ doGenerate, doStream }`
+ *      and nothing else — reintroducing exactly the `supportedUrls` loss the
+ *      spread was introduced to fix, and dropping every provider method the
+ *      SDK or downstream middleware might call (audit 2026-07-25).
+ * A Proxy is also the pattern the openai / anthropic / gemini wrappers in this
+ * monorepo already use.
+ *
+ * Spec reference: https://sdk.vercel.ai/docs/ai-sdk-core/middleware
+ */
+import { type GuardrailCheckResult } from "@evalguard/wrapper-core";
+/**
+ * A single token count as the AI SDK has spelled it over time.
+ *
+ * - `number` — model spec v2 (`ai@5`): `usage.inputTokens` is the count itself.
+ * - `{ total, … }` — model spec v3 (`ai@6`) and v4 (`ai@7`): the flat count
+ *   became a breakdown object (`{ total, noCache, cacheRead, cacheWrite }` on
+ *   input, `{ total, text, reasoning }` on output).
+ *
+ * Reading `usage.inputTokens` directly on a v3/v4 model yields an OBJECT, which
+ * is why {@link readTokenCount} exists. Before 2026-08-02 that object flowed
+ * straight into `tokenUsage.input` and into the cost estimator, so every trace
+ * from an `ai@6` or `ai@7` consumer carried a non-numeric token field and a NaN
+ * cost — two of the three majors this package declares support for, including
+ * the one pinned as its own devDependency.
+ */
+type LanguageModelTokenCount = number | {
+    total?: number | undefined;
+    [k: string]: unknown;
+} | undefined;
+interface LanguageModelV2Usage {
+    inputTokens?: LanguageModelTokenCount;
+    outputTokens?: LanguageModelTokenCount;
+    promptTokens?: number;
+    completionTokens?: number;
+}
+interface LanguageModelV2TextContentPart {
+    type: "text";
+    text: string;
+    [k: string]: unknown;
+}
+type LanguageModelV2ContentPart = LanguageModelV2TextContentPart | {
+    type: string;
+    [k: string]: unknown;
+};
+interface LanguageModelV2CallOptions {
+    prompt: unknown;
+    [k: string]: unknown;
+}
+interface LanguageModelV2GenerateResult {
+    content?: LanguageModelV2ContentPart[];
+    text?: string;
+    toolCalls?: unknown;
+    usage?: LanguageModelV2Usage;
+    [k: string]: unknown;
+}
+/**
+ * `stream` is `ReadableStream<unknown>`, NOT
+ * `ReadableStream<LanguageModelV2StreamPart>`, on purpose.
+ *
+ * `ReadableStream<T>` is invariant in `T` (its reader's `read()` puts `T` in
+ * both an input and an output position), so a real provider's
+ * `ReadableStream<@ai-sdk/provider.LanguageModelV2StreamPart>` is NOT
+ * assignable to a stream of our locally-shimmed part union even though the
+ * part types themselves are structurally compatible. The consequence was that
+ * the README's own headline example —
+ * `withEvalguard(openai("gpt-4o-mini"), { … })` — did not type-check against
+ * `@ai-sdk/openai@2` / `ai@5` at all:
+ *
+ *   error TS2345: Argument of type 'LanguageModelV2' is not assignable to
+ *     parameter of type 'LanguageModelV2'. The types returned by
+ *     'doStream(...)' are incompatible … Types of property 'stream' are
+ *     incompatible.
+ *
+ * It failed identically in ESM and CJS, so it was not the ESM-only hazard the
+ * README warns about — it was this shim. `unknown` removes the variance
+ * conflict; the `pull()` handler in `withEvalguard`'s `doStream` narrows each
+ * chunk back to {@link LanguageModelV2StreamPart} at the single read boundary,
+ * and it already tolerates an unrecognised `type` by passing the chunk through.
+ *
+ * 2026-08-02 correction: this comment used to end "Verified 2026-08-01",
+ * which read as "the README example now compiles". It did not. Fixing the
+ * ARGUMENT position left the RETURN position broken — `withEvalguard` still
+ * returned this file's shim, which is not assignable to `ai`'s `LanguageModel`,
+ * so `generateText({ model })` was TS2322 on ai@5/6/7 (and TS2345 again on
+ * ai@6/7 from the hard-coded `specificationVersion: "v2"`). Both are fixed;
+ * see {@link withEvalguard} and `src/__tests__/ai-sdk-assignability.test.ts`,
+ * which type-checks the wrapper against the real `ai` types so a future
+ * regression fails CI instead of only failing consumers.
+ */
+interface LanguageModelV2StreamResult {
+    stream: ReadableStream<unknown>;
+    [k: string]: unknown;
+}
+/**
+ * Structural shim for "a model the AI SDK will accept".
+ *
+ * This type is used ONLY as the constraint on {@link withEvalguard}'s `model`
+ * parameter — it is deliberately lenient (optional fields, index signatures)
+ * so a real provider model assigns cleanly. It is NOT assignable back to
+ * `ai`'s `LanguageModel`, which is why `withEvalguard` is generic and returns
+ * the caller's own model type rather than this shim (see the note on
+ * `withEvalguard`).
+ */
+export interface LanguageModelV2 {
+    /**
+     * `string`, not a `"v2"` literal. The peer range admits `ai@5` (model spec
+     * v2), `ai@6` (v3) and `ai@7` (v4), and the wrapper is spec-version agnostic:
+     * it is a Proxy that forwards everything and only intercepts
+     * `doGenerate` / `doStream`, both of which exist in every spec version.
+     * Pinning the literal to `"v2"` made `withEvalguard(openai("gpt-4o-mini"))`
+     * fail with `TS2345: Type '"v3"' is not assignable to type '"v2"'` on ai@6
+     * and ai@7 — a hard-coded literal that ages out with every AI SDK major.
+     */
+    specificationVersion: string;
+    provider: string;
+    modelId: string;
+    /**
+     * V2 capability map — supported URL patterns by media type. Forwarded
+     * unchanged by the wrapper's Proxy (see `withEvalguard`) so URL and file
+     * inputs the model handles natively are NOT downloaded/dropped — including
+     * when the provider exposes it as a prototype getter on a class instance.
+     */
+    supportedUrls?: Record<string, RegExp[]> | PromiseLike<Record<string, RegExp[]>>;
+    doGenerate(options: LanguageModelV2CallOptions): PromiseLike<LanguageModelV2GenerateResult>;
+    doStream(options: LanguageModelV2CallOptions): PromiseLike<LanguageModelV2StreamResult>;
+}
+/**
+ * @deprecated The Vercel AI SDK moved to LanguageModelV2 in v5+. Kept as an
+ * alias so pre-existing imports keep compiling; new code should use
+ * {@link LanguageModelV2}.
+ */
+export type LanguageModelV1 = LanguageModelV2;
+export interface WithEvalguardConfig {
+    /** EvalGuard API key (https://evalguard.ai/dashboard/api-keys). */
+    apiKey: string;
+    /** Project ID — traces appear under this project. Optional in dev. */
+    projectId?: string;
+    /** Override the EvalGuard API base URL. Default: https://evalguard.ai/api/v1 */
+    baseUrl?: string;
+    /**
+     * Block calls that fail the guardrail check. Default: true.
+     * If false, violations are still logged but the call proceeds.
+     */
+    blockOnViolation?: boolean;
+    /** Disable trace logging (still runs guardrails). Default: false. */
+    disableLogging?: boolean;
+    /** Disable guardrail input check (still logs). Default: false. */
+    disableGuardrails?: boolean;
+    /** Free-form metadata attached to every trace. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Error thrown when blockOnViolation=true and the input is rejected by
+ * EvalGuard's firewall. Customers can catch this distinctly from provider
+ * errors.
+ */
+export declare class EvalguardBlockedError extends Error {
+    readonly violations: GuardrailCheckResult["violations"];
+    constructor(message: string, violations: GuardrailCheckResult["violations"]);
+}
+/**
+ * Wrap a Vercel AI SDK language model with EvalGuard middleware.
+ *
+ * Returns a Proxy over the original model, typed as **the caller's own model
+ * type** (`TModel`) rather than as our shim. That genericity is load-bearing,
+ * not stylistic: `ai`'s `LanguageModel` is a union of the REAL
+ * `@ai-sdk/provider` model specs, and {@link LanguageModelV2} above is a
+ * deliberately lenient structural shim that is not a member of that union
+ * (`supportedUrls` optional here vs required there; every `doGenerate` result
+ * field optional here vs required there). Returning the shim made the README's
+ * own headline example fail on every supported peer:
+ *
+ *   error TS2322: Type 'LanguageModelV2' is not assignable to type
+ *     'LanguageModel'.
+ *
+ * at `generateText({ model, prompt })` — reproduced on ai@5, ai@6 and ai@7.
+ * Returning `TModel` hands `generateText` back exactly what `openai(...)` gave
+ * us, so it assigns by construction. Verified against ai@5 + @ai-sdk/openai@2,
+ * ai@6 + @ai-sdk/openai@3 and ai@7 + @ai-sdk/openai@4 from packed tarballs on
+ * 2026-08-02, and pinned by `src/__tests__/ai-sdk-assignability.test.ts`.
+ *
+ * Only `doGenerate` / `doStream` are intercepted; every other property read
+ * (including prototype getters such as `supportedUrls` on a class-based
+ * provider model) is forwarded to the real instance, so capability fields
+ * compose with other middleware (caching, logging) the customer may already
+ * have.
+ */
+export declare function withEvalguard<TModel extends LanguageModelV2>(model: TModel, config: WithEvalguardConfig): TModel;
+export type { GuardrailCheckResult, GuardrailViolation, TraceLogData } from "@evalguard/wrapper-core";
+export { estimateCost, estimateCostDetailed, isModelPriced } from "./cost.js";
+export type { CostEstimate, PricingSource } from "./cost.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAAuC,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAqBzG;;;;;;;;;;;;;;GAcG;AACH,KAAK,uBAAuB,GACxB,MAAM,GACN;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACpD,SAAS,CAAC;AAEd,UAAU,oBAAoB;IAE5B,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAGvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,UAAU,8BAA8B;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,KAAK,0BAA0B,GAC3B,8BAA8B,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAoB3C,UAAU,0BAA0B;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,UAAU,6BAA6B;IAErC,OAAO,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAEvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,UAAU,2BAA2B;IACnC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EACV,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACxB,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC5F,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,WAAW,CAAC,2BAA2B,CAAC,CAAC;CASzF;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,qEAAqE;IACrE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;gBAC5C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC;CAK5E;AA0CD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,aAAa,CAAC,MAAM,SAAS,eAAe,EAC1D,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAkPR;AA0BD,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAStG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC9E,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,395 @@
+/**
+ * EvalGuard middleware for the Vercel AI SDK.
+ *
+ * Drop-in usage: wrap any language model from @ai-sdk/{openai,anthropic,
+ * google,...} — model spec v2 (`ai@5`), v3 (`ai@6`) or v4 (`ai@7`) —
+ * with `withEvalguard()` to get pre-call guardrails (firewall
+ * check) + post-call trace logging (latency, tokens, cost) sent to your
+ * EvalGuard project. Guardrail semantics are fail-CLOSED when
+ * blockOnViolation is on (the default): if the firewall is unreachable the
+ * call is BLOCKED with an EvalguardBlockedError, matching the langchain /
+ * llamaindex wrappers. In monitor-only mode (blockOnViolation:false) a
+ * guardrail outage is swallowed and the call proceeds. Trace logging always
+ * fails open — a logging error never breaks or delays the user's call.
+ *
+ * Usage:
+ *
+ *   import { openai } from "@ai-sdk/openai";
+ *   import { generateText } from "ai";
+ *   import { withEvalguard } from "@evalguard/vercel-ai";
+ *
+ *   const model = withEvalguard(openai("gpt-4o-mini"), {
+ *     apiKey: process.env.EVALGUARD_API_KEY!,
+ *     projectId: "proj-123",
+ *   });
+ *
+ *   const { text } = await generateText({ model, prompt: "hi" });
+ *
+ * The Vercel AI SDK's `wrapLanguageModel` is the documented composition hook
+ * for exactly this use case. We deliberately do NOT import it (nor `ai` itself)
+ * at RUNTIME: the only `dependencies` entry is `@evalguard/wrapper-core`, and
+ * `ai` is a PEER, so the version the customer already chose is the one that
+ * runs — we never resolve a second copy into their tree, and there is no
+ * import of `ai` to break if they are on a major we did not anticipate.
+ *
+ * That is NOT the same as "installing this package pulls nothing in".
+ * npm 7+ installs peerDependencies automatically, and it was measured doing
+ * exactly that on 2026-08-02:
+ *
+ *   $ npm install ./evalguard-vercel-ai-1.0.0.tgz   # clean `npm init -y`
+ *   added 12 packages
+ *   $ npm ls --all
+ *   └─┬ @evalguard/vercel-ai@1.0.0
+ *     └── ai@7.0.48
+ *
+ * The comment here previously claimed the opposite ("never pulls the AI SDK in
+ * as a transitive dependency", and before that "a tiny, zero-runtime-dependency
+ * install"), which also contradicted the README two paragraphs below it
+ * ("`ai` is a peer dependency (npm installs it for you…)"). This JSDoc block
+ * ships to consumers inside `dist/index.d.ts`, so it was a wrong claim in the
+ * published artifact, not just an internal note.
+ *
+ * Instead of importing `wrapLanguageModel` we re-implement the same "delegate
+ * to the model, override doGenerate/doStream" shape directly, as a PROXY over
+ * the original model. Everything except the two call methods is forwarded to the
+ * real instance, so capability fields — most importantly `supportedUrls` —
+ * pass through untouched. Two earlier versions got this wrong:
+ *   1. hand-copying a fixed list of V1 props (`supportsUrl`,
+ *      `supportsImageUrls`, …) that no longer exist on a V2 model, which
+ *      silently STRIPPED `supportedUrls` (audit MEDIUM 2026-07-14);
+ *   2. `{ ...model }` — an object spread copies OWN ENUMERABLE properties
+ *      only. Every real provider model (`openai(...)`, `anthropic(...)`) is a
+ *      CLASS INSTANCE whose `supportedUrls` / `provider` / `modelId` are
+ *      prototype GETTERS, so the spread produced `{ doGenerate, doStream }`
+ *      and nothing else — reintroducing exactly the `supportedUrls` loss the
+ *      spread was introduced to fix, and dropping every provider method the
+ *      SDK or downstream middleware might call (audit 2026-07-25).
+ * A Proxy is also the pattern the openai / anthropic / gemini wrappers in this
+ * monorepo already use.
+ *
+ * Spec reference: https://sdk.vercel.ai/docs/ai-sdk-core/middleware
+ */
+import { GuardrailClient, collapsePromptText } from "@evalguard/wrapper-core";
+import { estimateCostDetailed } from "./cost.js";
+/**
+ * Error thrown when blockOnViolation=true and the input is rejected by
+ * EvalGuard's firewall. Customers can catch this distinctly from provider
+ * errors.
+ */
+export class EvalguardBlockedError extends Error {
+    violations;
+    constructor(message, violations) {
+        super(message);
+        this.name = "EvalguardBlockedError";
+        this.violations = violations;
+    }
+}
+/**
+ * Normalise one token count to a `number`, whatever spec version produced it.
+ * Returns `undefined` (not 0) when the count is absent or non-numeric, so the
+ * caller can fall through to the legacy v1 field names.
+ */
+function readTokenCount(count) {
+    if (typeof count === "number")
+        return Number.isFinite(count) ? count : undefined;
+    if (count && typeof count === "object" && typeof count.total === "number") {
+        return Number.isFinite(count.total) ? count.total : undefined;
+    }
+    return undefined;
+}
+/** Pull token counts off a v2/v3/v4 (or legacy v1) usage object. */
+function readTokens(usage) {
+    return {
+        input: readTokenCount(usage?.inputTokens) ?? usage?.promptTokens ?? 0,
+        output: readTokenCount(usage?.outputTokens) ?? usage?.completionTokens ?? 0,
+    };
+}
+/**
+ * Extract the assistant's text from a v2 doGenerate result. V2 returns an
+ * ordered `content` array (text lives in `{ type: "text", text }` parts);
+ * we concatenate them. Falls back to a legacy top-level `text` so a v1-shaped
+ * result still logs its output instead of `null`.
+ */
+function extractOutputText(result) {
+    if (Array.isArray(result.content)) {
+        return result.content
+            .filter((p) => !!p && p.type === "text" && typeof p.text === "string")
+            .map((p) => p.text)
+            .join("");
+    }
+    return typeof result.text === "string" ? result.text : "";
+}
+/**
+ * Wrap a Vercel AI SDK language model with EvalGuard middleware.
+ *
+ * Returns a Proxy over the original model, typed as **the caller's own model
+ * type** (`TModel`) rather than as our shim. That genericity is load-bearing,
+ * not stylistic: `ai`'s `LanguageModel` is a union of the REAL
+ * `@ai-sdk/provider` model specs, and {@link LanguageModelV2} above is a
+ * deliberately lenient structural shim that is not a member of that union
+ * (`supportedUrls` optional here vs required there; every `doGenerate` result
+ * field optional here vs required there). Returning the shim made the README's
+ * own headline example fail on every supported peer:
+ *
+ *   error TS2322: Type 'LanguageModelV2' is not assignable to type
+ *     'LanguageModel'.
+ *
+ * at `generateText({ model, prompt })` — reproduced on ai@5, ai@6 and ai@7.
+ * Returning `TModel` hands `generateText` back exactly what `openai(...)` gave
+ * us, so it assigns by construction. Verified against ai@5 + @ai-sdk/openai@2,
+ * ai@6 + @ai-sdk/openai@3 and ai@7 + @ai-sdk/openai@4 from packed tarballs on
+ * 2026-08-02, and pinned by `src/__tests__/ai-sdk-assignability.test.ts`.
+ *
+ * Only `doGenerate` / `doStream` are intercepted; every other property read
+ * (including prototype getters such as `supportedUrls` on a class-based
+ * provider model) is forwarded to the real instance, so capability fields
+ * compose with other middleware (caching, logging) the customer may already
+ * have.
+ */
+export function withEvalguard(model, config) {
+    const guardrail = new GuardrailClient({ apiKey: config.apiKey, baseUrl: config.baseUrl });
+    const blockOnViolation = config.blockOnViolation ?? true;
+    const enableLogging = !config.disableLogging;
+    const enableGuardrails = !config.disableGuardrails;
+    const overrides = {
+        async doGenerate(params) {
+            const t0 = performance.now();
+            let guardrailResult;
+            // Pre-call: extract a single text representation of the prompt for
+            // the firewall. Vercel's prompt shape is varied (chat / completion),
+            // so we collapse to a string the firewall can scan.
+            if (enableGuardrails) {
+                const promptText = collapsePrompt(params);
+                if (promptText) {
+                    try {
+                        guardrailResult = await guardrail.checkInput(promptText, {
+                            provider: model.provider,
+                            model: model.modelId,
+                            ...config.metadata,
+                        });
+                        if (!guardrailResult.allowed && blockOnViolation) {
+                            throw new EvalguardBlockedError(`Request blocked by EvalGuard guardrails: ${guardrailResult.violations.map((v) => v.type).join(", ")}`, guardrailResult.violations);
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof EvalguardBlockedError)
+                            throw err;
+                        // wrapper-core.checkInput fails CLOSED on a guardrail outage
+                        // (throws once retries/circuit give up). Honor blockOnViolation:
+                        // an unreachable guardrail BLOCKS the call when it's on, and is
+                        // swallowed (the call proceeds, monitor-only) when it's off.
+                        // Mirrors the langchain / llamaindex wrappers.
+                        if (blockOnViolation) {
+                            throw new EvalguardBlockedError(`Request blocked: guardrail unavailable (${err instanceof Error ? err.message : "unknown"})`, [{
+                                    type: "guardrail_unavailable",
+                                    severity: "high",
+                                    message: err instanceof Error ? err.message : "guardrail check failed",
+                                }]);
+                        }
+                    }
+                }
+            }
+            const result = await model.doGenerate(params);
+            const latencyMs = Math.round(performance.now() - t0);
+            // Post-call: log trace fire-and-forget so we never delay the user's
+            // response on a slow log POST.
+            if (enableLogging) {
+                const { input: inputTokens, output: outputTokens } = readTokens(result.usage);
+                const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model.modelId, inputTokens, outputTokens);
+                void guardrail.logTrace({
+                    model: model.modelId,
+                    provider: model.provider,
+                    input: params.prompt,
+                    // v2: text lives in the `content` array, not a top-level `text`.
+                    output: extractOutputText(result) || result.toolCalls || null,
+                    latencyMs,
+                    tokenUsage: { input: inputTokens, output: outputTokens },
+                    cost,
+                    costPricingSource,
+                    projectId: config.projectId,
+                    metadata: config.metadata,
+                    guardrailResult,
+                });
+            }
+            return result;
+        },
+        async doStream(params) {
+            const t0 = performance.now();
+            let guardrailResult;
+            if (enableGuardrails) {
+                const promptText = collapsePrompt(params);
+                if (promptText) {
+                    try {
+                        guardrailResult = await guardrail.checkInput(promptText, {
+                            provider: model.provider,
+                            model: model.modelId,
+                            ...config.metadata,
+                        });
+                        if (!guardrailResult.allowed && blockOnViolation) {
+                            throw new EvalguardBlockedError(`Request blocked by EvalGuard guardrails: ${guardrailResult.violations.map((v) => v.type).join(", ")}`, guardrailResult.violations);
+                        }
+                    }
+                    catch (err) {
+                        if (err instanceof EvalguardBlockedError)
+                            throw err;
+                        // wrapper-core.checkInput fails CLOSED on a guardrail outage
+                        // (throws once retries/circuit give up). Honor blockOnViolation:
+                        // an unreachable guardrail BLOCKS the call when it's on, and is
+                        // swallowed (the call proceeds, monitor-only) when it's off.
+                        // Mirrors the langchain / llamaindex wrappers.
+                        if (blockOnViolation) {
+                            throw new EvalguardBlockedError(`Request blocked: guardrail unavailable (${err instanceof Error ? err.message : "unknown"})`, [{
+                                    type: "guardrail_unavailable",
+                                    severity: "high",
+                                    message: err instanceof Error ? err.message : "guardrail check failed",
+                                }]);
+                        }
+                    }
+                }
+            }
+            const result = await model.doStream(params);
+            // Tee the stream — assemble the final text + token totals as parts
+            // arrive, then log a trace once `finish` lands. Pass-through preserves
+            // streaming semantics for the caller.
+            let assembledText = "";
+            let promptTokens = 0;
+            let completionTokens = 0;
+            let traceLogged = false;
+            const reader = result.stream.getReader();
+            /**
+             * 2026-07-29 (audit A284): emit the trace exactly once, whether the
+             * stream ran to completion, errored, or was CANCELLED by the client.
+             * Previously the trace was logged only on the clean-close path, so
+             * every aborted generation vanished from the dashboard — the exact
+             * calls a customer most wants to see (cost already incurred upstream).
+             */
+            const finalizeTrace = (status) => {
+                if (traceLogged || !enableLogging)
+                    return;
+                traceLogged = true;
+                const latencyMs = Math.round(performance.now() - t0);
+                const { costUsd: cost, pricingSource: costPricingSource } = estimateCostDetailed(model.modelId, promptTokens, completionTokens);
+                void guardrail.logTrace({
+                    model: model.modelId,
+                    provider: model.provider,
+                    input: params.prompt,
+                    output: assembledText,
+                    latencyMs,
+                    tokenUsage: { input: promptTokens, output: completionTokens },
+                    cost,
+                    costPricingSource,
+                    projectId: config.projectId,
+                    metadata: status ? { ...config.metadata, streamStatus: status } : config.metadata,
+                    guardrailResult,
+                });
+            };
+            const wrappedStream = new ReadableStream({
+                // `pull` (not a fire-and-forget loop inside `start`) is what gives
+                // this stream backpressure: the runtime calls it only when the
+                // consumer has capacity, so a slow client no longer causes us to
+                // drain the whole upstream generation into memory.
+                async pull(controller) {
+                    try {
+                        const { done, value: raw } = await reader.read();
+                        if (done) {
+                            controller.close();
+                            finalizeTrace();
+                            return;
+                        }
+                        // The upstream stream is typed `unknown` (see
+                        // LanguageModelV2StreamResult for why). This is the ONE read
+                        // boundary, so narrow here and nowhere else. A chunk that is not
+                        // an object, or carries an unrecognised `type`, falls through
+                        // every branch and is enqueued verbatim — the wrapper must never
+                        // drop or mangle a part it does not understand.
+                        const value = raw;
+                        const partType = raw !== null && typeof raw === "object" ? raw.type : undefined;
+                        if (partType === "text-delta") {
+                            const part = value;
+                            // v2 emits `delta`; older v1 models emit `textDelta`.
+                            assembledText += part.delta ?? part.textDelta ?? "";
+                        }
+                        if (partType === "finish") {
+                            const finishPart = value;
+                            const tokens = readTokens(finishPart.usage);
+                            promptTokens = tokens.input;
+                            completionTokens = tokens.output;
+                        }
+                        controller.enqueue(value);
+                    }
+                    catch (err) {
+                        finalizeTrace("error");
+                        controller.error(err);
+                    }
+                },
+                // A284: without this, a consumer abort (user navigates away, the
+                // Next.js route's AbortSignal fires) never propagated upstream —
+                // the provider connection stayed open and kept billing, and the
+                // partial trace was dropped on the floor.
+                async cancel(reason) {
+                    finalizeTrace("cancelled");
+                    try {
+                        await reader.cancel(reason);
+                    }
+                    catch {
+                        /* upstream already torn down */
+                    }
+                },
+            });
+            return { ...result, stream: wrappedStream };
+        },
+    };
+    return new Proxy(model, {
+        get(target, prop) {
+            if (prop === "doGenerate")
+                return overrides.doGenerate;
+            if (prop === "doStream")
+                return overrides.doStream;
+            // Proxy invariant: a non-configurable, non-writable own data property
+            // MUST be reported verbatim (returning a bound copy would throw).
+            const own = Object.getOwnPropertyDescriptor(target, prop);
+            if (own && own.configurable === false && own.writable === false) {
+                return own.value;
+            }
+            // Read with the TARGET as receiver, not the proxy, so a prototype getter
+            // that touches private state resolves against the real instance.
+            const value = Reflect.get(target, prop, target);
+            // Bind provider methods to the real model for the same reason — an
+            // unbound prototype method invoked as `wrapped.foo()` would get the
+            // Proxy as `this`.
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+    });
+}
+/**
+ * Collapse Vercel's varied prompt shapes into a single string for the
+ * firewall scan.
+ *
+ * 2026-07-29 (audit A287). The previous implementation filtered to
+ * `role === "user"` on the rationale that "system messages + assistant
+ * replies are mostly app-controlled". That reasoning omits the two message
+ * kinds an attacker actually controls in an agent app:
+ *   - `role: "tool"` messages carrying tool *results* (a poisoned or
+ *     compromised tool returns injection text), and
+ *   - retrieved RAG documents, which the AI SDK conventionally splices in
+ *     as system/assistant context.
+ * Both reached the model without ever being scanned. It also silently
+ * `.slice(0, 8000)`'d the JSON fallback — a scanner that trims its own
+ * input reports clean on bytes it never examined.
+ *
+ * Now delegates to wrapper-core's `collapsePromptText`: every role, no
+ * truncation, and shared with the langchain / llamaindex wrappers so the
+ * three copies cannot drift apart again.
+ */
+function collapsePrompt(params) {
+    return collapsePromptText(params.prompt);
+}
+// ── Cost estimation (public surface) ────────────────────────────────────────
+// The README's "Cost estimates" section tells the customer to
+// `import { estimateCostDetailed, isModelPriced } from "@evalguard/vercel-ai"`.
+// Until 2026-08-01 these lived only in `./cost.ts`, which is NOT an `exports`
+// subpath, so that documented import resolved to nothing from the published
+// tarball. The three SDK-shaped wrappers (openai / anthropic / gemini) already
+// re-exported them; the three framework-shaped ones did not.
+export { estimateCost, estimateCostDetailed, isModelPriced } from "./cost.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAA6B,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AA2MjD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,UAAU,CAAqC;IACxD,YAAY,OAAe,EAAE,UAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,KAAuC;IACzD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,YAAY,IAAI,CAAC;QACrE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,gBAAgB,IAAI,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAqC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO;aAClB,MAAM,CACL,CAAC,CAAC,EAAuC,EAAE,CACzC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,CAAoC,CAAC,IAAI,KAAK,QAAQ,CAC7F;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,MAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;IAC7C,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAEnD,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,UAAU,CAAC,MAAkC;YACjD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,eAAiD,CAAC;YAEtD,mEAAmE;YACnE,qEAAqE;YACrE,oDAAoD;YACpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,eAAe,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE;4BACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,KAAK,EAAE,KAAK,CAAC,OAAO;4BACpB,GAAG,MAAM,CAAC,QAAQ;yBACnB,CAAC,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;4BACjD,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtG,eAAe,CAAC,UAAU,CAC3B,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,qBAAqB;4BAAE,MAAM,GAAG,CAAC;wBACpD,6DAA6D;wBAC7D,iEAAiE;wBACjE,gEAAgE;wBAChE,6DAA6D;wBAC7D,+CAA+C;wBAC/C,IAAI,gBAAgB,EAAE,CAAC;4BACrB,MAAM,IAAI,qBAAqB,CAC7B,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAC5F,CAAC;oCACC,IAAI,EAAE,uBAAuB;oCAC7B,QAAQ,EAAE,MAAM;oCAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;iCACvE,CAAC,CACH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAErD,oEAAoE;YACpE,+BAA+B;YAC/B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9E,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,WAAW,EACX,YAAY,CACb,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,iEAAiE;oBACjE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;oBAC7D,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE;oBACxD,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAkC;YAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,eAAiD,CAAC;YAEtD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,eAAe,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE;4BACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,KAAK,EAAE,KAAK,CAAC,OAAO;4BACpB,GAAG,MAAM,CAAC,QAAQ;yBACnB,CAAC,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;4BACjD,MAAM,IAAI,qBAAqB,CAC7B,4CAA4C,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtG,eAAe,CAAC,UAAU,CAC3B,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,YAAY,qBAAqB;4BAAE,MAAM,GAAG,CAAC;wBACpD,6DAA6D;wBAC7D,iEAAiE;wBACjE,gEAAgE;wBAChE,6DAA6D;wBAC7D,+CAA+C;wBAC/C,IAAI,gBAAgB,EAAE,CAAC;4BACrB,MAAM,IAAI,qBAAqB,CAC7B,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,EAC5F,CAAC;oCACC,IAAI,EAAE,uBAAuB;oCAC7B,QAAQ,EAAE,MAAM;oCAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;iCACvE,CAAC,CACH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE5C,mEAAmE;YACnE,uEAAuE;YACvE,sCAAsC;YACtC,IAAI,aAAa,GAAG,EAAE,CAAC;YACvB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,IAAI,WAAW,GAAG,KAAK,CAAC;YAExB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAEzC;;;;;;eAMG;YACH,MAAM,aAAa,GAAG,CAAC,MAAe,EAAE,EAAE;gBACxC,IAAI,WAAW,IAAI,CAAC,aAAa;oBAAE,OAAO;gBAC1C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAC9E,KAAK,CAAC,OAAO,EACb,YAAY,EACZ,gBAAgB,CACjB,CAAC;gBACF,KAAK,SAAS,CAAC,QAAQ,CAAC;oBACtB,KAAK,EAAE,KAAK,CAAC,OAAO;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,SAAS;oBACT,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE;oBAC7D,IAAI;oBACJ,iBAAiB;oBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;oBACjF,eAAe;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,aAAa,GAAG,IAAI,cAAc,CAA4B;gBAClE,mEAAmE;gBACnE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mDAAmD;gBACnD,KAAK,CAAC,IAAI,CAAC,UAAU;oBACnB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjD,IAAI,IAAI,EAAE,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAC;4BACnB,aAAa,EAAE,CAAC;4BAChB,OAAO;wBACT,CAAC;wBACD,8CAA8C;wBAC9C,6DAA6D;wBAC7D,iEAAiE;wBACjE,8DAA8D;wBAC9D,iEAAiE;wBACjE,gDAAgD;wBAChD,MAAM,KAAK,GAAG,GAAgC,CAAC;wBAC/C,MAAM,QAAQ,GACZ,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;wBACzF,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;4BAC9B,MAAM,IAAI,GAAG,KAA2C,CAAC;4BACzD,sDAAsD;4BACtD,aAAa,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;wBACtD,CAAC;wBACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BAC1B,MAAM,UAAU,GAAG,KAAwC,CAAC;4BAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;4BAC5C,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;4BAC5B,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;wBACnC,CAAC;wBACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,aAAa,CAAC,OAAO,CAAC,CAAC;wBACvB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC;gBACD,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,0CAA0C;gBAC1C,KAAK,CAAC,MAAM,CAAC,MAAM;oBACjB,aAAa,CAAC,WAAW,CAAC,CAAC;oBAC3B,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE;QACtB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,SAAS,CAAC,UAAU,CAAC;YACvD,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;YAEnD,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAChE,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC;YAED,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAChD,mEAAmE;YACnE,oEAAoE;YACpE,mBAAmB;YACnB,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpG,CAAC;KACF,CAAW,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,cAAc,CAAC,MAAkC;IACxD,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAC;AACtD,CAAC;AAID,+EAA+E;AAC/E,8DAA8D;AAC9D,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const VERSION = "1.0.0";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/version.js

@@ -0,0 +1,5 @@
+// Single source of the wrapper version WITHIN src (so the User-Agent header
+// can't drift between call sites). Kept in lockstep with package.json#version;
+// a unit test (version.test.ts) fails CI if the two ever diverge. (#120)
+export const VERSION = "1.0.0";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@evalguard/vercel-ai",
+  "version": "1.0.0",
+  "description": "Drop-in Vercel AI SDK middleware with EvalGuard guardrails, trace logging & cost tracking",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "peer-matrix.json"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "type-check": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "test": "vitest run",
+    "lint": "eslint src --quiet",
+    "clean": "rm -rf dist .turbo",
+    "prepublishOnly": "pnpm run build"
+  },
+  "keywords": [
+    "vercel",
+    "ai-sdk",
+    "llm",
+    "guardrails",
+    "evalguard",
+    "evalguardai",
+    "ai",
+    "tracing",
+    "observability",
+    "middleware",
+    "language-model"
+  ],
+  "author": "EvalGuard <support@evalguard.ai>",
+  "license": "Apache-2.0",
+  "homepage": "https://evalguard.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/EvalGuardAi/evalguard"
+  },
+  "peerDependencies": {
+    "ai": ">=5.0.0"
+  },
+  "dependencies": {
+    "@evalguard/wrapper-core": "workspace:^"
+  },
+  "devDependencies": {
+    "@evalguard/config": "workspace:*",
+    "@types/node": "^26.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.61.1",
+    "@typescript-eslint/parser": "^8.61.1",
+    "ai": "^6.0.208",
+    "eslint": "^10.5.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.9"
+  },
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/peer-matrix.json

@@ -0,0 +1,50 @@
+{
+  "$comment": [
+    "The AI SDK majors @evalguard/vercel-ai is verified against, and the SINGLE",
+    "source of truth for that claim. Three things read this file and they must",
+    "agree, which is the whole point:",
+    "",
+    "  1. scripts/verify-vercel-ai-peer-matrix.mjs — installs each entry into a",
+    "     clean consumer, TYPE-CHECKS the README quickstart verbatim against it,",
+    "     and EXECUTES the wrapper end-to-end through that major's own",
+    "     generateText/streamText.",
+    "  2. .github/workflows/publish-wrappers.yml — runs that script before",
+    "     @evalguard/vercel-ai is published, so 'on every release' is literal.",
+    "  3. scripts/publish-readiness-check.mjs — fails if README.md claims a peer",
+    "     version this file does not list, if this file lists one the README does",
+    "     not claim, or if no workflow actually runs the verifier.",
+    "",
+    "WHY: on 2026-08-02 the README said the quickstart was 'type-checked and",
+    "executed against ai@5, ai@6 and ai@7 on every release'. Nothing in the repo",
+    "did that — package.json had exactly one AI SDK devDependency (ai@^6) and the",
+    "publish workflow's only runtime step was `await import('@evalguard/vercel-ai')`.",
+    "A README claim with no executable behind it is the defect this file closes.",
+    "",
+    "ADDING A MAJOR: add the entry here, run `pnpm gate:vercel-ai-peers`, and only",
+    "then widen the README sentence. REMOVING one: narrow the README in the same",
+    "commit — the readiness gate fails on either half alone."
+  ],
+  "peer": "ai",
+  "entries": [
+    {
+      "aiMajor": "5",
+      "specificationVersion": "v2",
+      "provider": "@ai-sdk/openai@2",
+      "mockExport": "MockLanguageModelV2",
+      "harnessDeps": ["msw", "vitest"],
+      "harnessDepsWhy": "ai@5's `ai/test` re-exports @ai-sdk/provider-utils/test, whose module graph imports `msw` and `vitest` at load time (ERR_MODULE_NOT_FOUND without them). ai@6/ai@7 dropped those imports. These are dependencies of the TEST HARNESS only — never installed by, or required for, @evalguard/vercel-ai itself."
+    },
+    {
+      "aiMajor": "6",
+      "specificationVersion": "v3",
+      "provider": "@ai-sdk/openai@3",
+      "mockExport": "MockLanguageModelV3"
+    },
+    {
+      "aiMajor": "7",
+      "specificationVersion": "v4",
+      "provider": "@ai-sdk/openai@4",
+      "mockExport": "MockLanguageModelV4"
+    }
+  ]
+}