@evalguard/vercel-ai 1.0.1 → 1.0.2

package/dist/surface.d.ts

@@ -0,0 +1,126 @@
+import { type SurfacePolicy } from "@evalguard/wrapper-core";
+/**
+ * Real API RESOURCES exempted by decision.
+ *
+ * Empty, deliberately. A model has no management endpoints — every method on
+ * every `@ai-sdk/provider` specification issues a provider request carrying
+ * caller-supplied content. Nothing has earned an exemption. An entry added here
+ * must carry its reason inline.
+ */
+export declare const EXEMPT_RESOURCES: ReadonlySet<string>;
+/**
+ * Capability / identity fields on a model instance that must be handed back
+ * unproxied.
+ *
+ * ⚠ THIS LIST IS A DENYLIST WEARING AN ALLOWLIST'S CLOTHES. Anything named here
+ * bypasses the guard entirely, so an entry that DOES reach the model is a silent
+ * leak. Every name below was read out of the installed `@ai-sdk/provider@3.0.10`
+ * specifications and each was driven through the real `ai` entry point with the
+ * firewall blocking: the firewall-check count stays 0 because NO REQUEST IS
+ * ISSUED, not because the guard was skipped.
+ *
+ * Why these specifically cannot be left to the generic gate:
+ *
+ *   `supportedUrls` is `Record<string, RegExp[]> | PromiseLike<…>`. Default-deny
+ *   proxies a non-function object, so `Object.entries(await model.supportedUrls)`
+ *   would yield proxied `RegExp[]` arrays whose `.test` is a FUNCTION — gated,
+ *   returning a Promise where the SDK expects a boolean. The capability map
+ *   would break, and `supportedUrls` being silently dropped is already a
+ *   MEDIUM this package fixed once (audit 2026-07-14).
+ *
+ *   `maxImagesPerCall` / `maxVideosPerCall` are
+ *   `number | undefined | GetMaxXPerCallFunction`. The FUNCTION form, gated,
+ *   returns a Promise where `generateImage` reads a number.
+ *
+ *   `maxEmbeddingsPerCall` / `supportsParallelCalls` are
+ *   `PromiseLike<…> | value`. A proxied thenable is a different object identity
+ *   than the SDK's own and buys nothing — neither carries caller text.
+ *
+ * `specificationVersion` / `provider` / `modelId` are strings and are passed
+ * through by the primitive rule without needing a name here; they are listed
+ * anyway so this file is a complete statement of the model spec's non-method
+ * surface rather than a partial one a reader has to cross-check.
+ */
+export declare const TRANSPORT_PASSTHROUGH: ReadonlySet<string>;
+/** Union, for callers/tests asking "is this name exempt at all". */
+export declare const KNOWN_SAFE_PASSTHROUGH: ReadonlySet<string>;
+/**
+ * Methods with a DEDICATED proxy in index.ts — the rich paths that also do
+ * stream teeing, token accounting, cost estimation and trace logging.
+ *
+ * These are NOT passthrough: `assertSurfacePolicy` fails at wrap time if the
+ * wrapper does not supply a handler for every name here, and it fails if a name
+ * appears here AND on a passthrough set.
+ *
+ * `doGenerate` is deliberately dedicated for EVERY model kind, not just language
+ * models. Image, speech, transcription and video specifications all spell their
+ * call method `doGenerate`, so routing it anywhere else would mean sniffing the
+ * model's shape to decide how hard to guard it — which is a denylist with extra
+ * steps. The rich override is shape-tolerant (`readTokens` and
+ * `extractOutputText` both degrade to 0 / "" on a non-language result), and its
+ * input rail now walks the whole call-options body, so a speech call is gated on
+ * `options.text` exactly like a language call is gated on `options.prompt`.
+ */
+export declare const DEDICATED_RESOURCES: ReadonlySet<string>;
+/**
+ * True for an `@ai-sdk/provider` model specification object.
+ *
+ * Verified against `@ai-sdk/provider@3.0.10`: every one of the seven
+ * specifications declares `specificationVersion` AND `modelId` (language v2:52,
+ * v3:12/22; embedding v2:24/34, v3:18/28; image v2:27/37, v3:28/38; speech
+ * v2:17/27, v3:17/27; transcription v2:17/27, v3:17/27; reranking v3:15/25;
+ * video v3:49/59).
+ *
+ * This is what stops a passthrough NAME from un-guarding a MODEL: a wrapper or
+ * middleware that exposes an inner model under a capability name (e.g. a
+ * `provider` field holding a delegate rather than a string) still gets guarded,
+ * because the passthrough allowlist only wins when the VALUE is not a model.
+ */
+export declare function isAiSdkModel(value: unknown): boolean;
+/**
+ * Call-option fields KNOWN to carry model-visible caller text on
+ * `@ai-sdk/provider@3.0.10`.
+ *
+ * The FLOOR, not the gate — the shared extractor unions a whole-body walk on
+ * top, so a field nobody enumerated is scanned anyway. REMOVING a name here
+ * narrows detection; ADDING one is redundant. Every entry is a real field on a
+ * real specification's call-options type:
+ *
+ *   prompt     LanguageModelV{2,3}CallOptions, ImageModelV3CallOptions:3,
+ *              VideoModelV3CallOptions:3
+ *   values     EmbeddingModelV3CallOptions:3
+ *   text       SpeechModelV3CallOptions:4
+ *   instructions SpeechModelV3CallOptions:7
+ *   audio      TranscriptionModelV3CallOptions:4
+ *   documents / query  RerankingModelV3CallOptions:4/8
+ *   messages / content / input  the shapes `collapsePromptText` renders
+ *
+ * ⚠ MEASURED LIMIT — TRANSCRIPTION AUDIO IS NOT SCANNED. Listing `audio` above
+ * does not make it readable. `ai@6.0.208`'s `transcribe` normalises whatever the
+ * caller passed (base64 string, data URL, ArrayBuffer) into a `Uint8Array`
+ * BEFORE the model boundary, and wrapper-core's walker excludes typed arrays by
+ * SHAPE — decoding an upload as UTF-8 produces megabytes of mojibake that would
+ * trip the size bound and refuse every legitimate audio call. Measured, with a
+ * canary in the audio and the firewall recording what it was shown:
+ *
+ *   transcribe(audio: Uint8Array)      firewall saw ["audio/wav"]
+ *   transcribe(audio: base64 string)   firewall saw ["audio/wav"]
+ *   generateSpeech(text)               firewall saw ["<canary>"]
+ *   embed(value)                       firewall saw ["<canary>"]
+ *   rerank(documents, query)           firewall saw ["<canary>", "<canary>"]
+ *
+ * So a transcription call IS gated — `mediaType` is model-visible text, the rail
+ * runs, and the firewall can refuse the call — but the gate is not looking at the
+ * audio. That is the same documented unscannable limit as an uploaded file body,
+ * stated here rather than left to be inferred from a green matrix.
+ */
+export declare const MODEL_INPUT_FIELDS: readonly string[];
+export declare const VERCEL_AI_SURFACE_POLICY: SurfacePolicy;
+/**
+ * The policy bound to one model instance, so traces carry the real model id.
+ *
+ * A function rather than a mutation: two wrapped models in the same process must
+ * not be able to overwrite each other's trace metadata.
+ */
+export declare function vercelAiSurfacePolicy(modelId: unknown): SurfacePolicy;
+//# sourceMappingURL=surface.d.ts.map

package/dist/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAqFA,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAuB,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAapD,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAGrD,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAGlD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAW/C,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,aAatC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAOrE"}

package/dist/surface.js

@@ -0,0 +1,264 @@
+// ── Default-deny classification of the AI SDK model surface ─────────────────
+//
+// AUDIT 2026-08-08 (vercel-ai residual). `withEvalguard` returned a Proxy whose
+// `get` trap branched on `doGenerate` / `doStream` and sent everything else to
+// `Reflect.get`. That is the same DENYLIST shape that made `@evalguard/anthropic`
+// and `@evalguard/gemini` bypassable, and it was left in place on the strength of
+// an argument that was never executed:
+//
+//   "`ai@6.0.208`'s type surface contains zero `doX` names and imports the model
+//    spec from `@ai-sdk/provider`, so it is a FIXED interface, not an open
+//    resource tree a provider can extend."
+//
+// Both halves are false. `@ai-sdk/provider@3.0.10` (the exact version `ai@6.0.208`
+// depends on) declares FOUR distinct `doX` method names across SEVEN model
+// specifications, and `withEvalguard` gated two of them:
+//
+//   spec                     method       file:line
+//   LanguageModelV2          doGenerate   language-model/v2/language-model-v2.ts:52     GATED
+//   LanguageModelV2          doStream     language-model/v2/language-model-v2.ts:114    GATED
+//   LanguageModelV3          doGenerate   language-model/v3/language-model-v3.ts:46     GATED
+//   LanguageModelV3          doStream     language-model/v3/language-model-v3.ts:58     GATED
+//   EmbeddingModelV2         doEmbed      embedding-model/v2/embedding-model-v2.ts:57   ungated
+//   EmbeddingModelV3         doEmbed      embedding-model/v3/embedding-model-v3.ts:51   ungated
+//   ImageModelV2             doGenerate   image-model/v2/image-model-v2.ts:50           gated by NAME COLLISION
+//   ImageModelV3             doGenerate   image-model/v3/image-model-v3.ts:51           gated by NAME COLLISION
+//   SpeechModelV2            doGenerate   speech-model/v2/speech-model-v2.ts:32         ungated IN EFFECT
+//   SpeechModelV3            doGenerate   speech-model/v3/speech-model-v3.ts:32         ungated IN EFFECT
+//   TranscriptionModelV2     doGenerate   transcription-model/v2/transcription-model-v2.ts:32  ungated IN EFFECT
+//   TranscriptionModelV3     doGenerate   transcription-model/v3/transcription-model-v3.ts:32  ungated IN EFFECT
+//   RerankingModelV3         doRerank     reranking-model/v3/reranking-model-v3.ts:31   ungated
+//   VideoModelV3             doGenerate   video-model/v3/video-model-v3.ts:75           gated by NAME COLLISION
+//
+// Measured by driving each model kind through the REAL `ai@6.0.208` entry point
+// (`embed`, `embedMany`, `generateImage`, `experimental_generateSpeech`,
+// `experimental_transcribe`, `rerank`, `experimental_generateVideo`) against the
+// pre-conversion `src/index.ts`, firewall configured to BLOCK ALL input:
+//
+//   model / entry point                          checks  leaked  outcome
+//   LanguageModelV3.doGenerate  (generateText)        1       0   BLOCKED
+//   LanguageModelV3.doStream    (streamText)          1       0   BLOCKED
+//   EmbeddingModelV3.doEmbed    (embed)               0       1   RETURNED
+//   EmbeddingModelV3.doEmbed    (embedMany)           0       1   RETURNED
+//   ImageModelV3.doGenerate     (generateImage)       1       0   BLOCKED
+//   SpeechModelV3.doGenerate    (generateSpeech)      0       1   RETURNED
+//   TranscriptionModelV3.doGenerate (transcribe)      0       1   RETURNED
+//   RerankingModelV3.doRerank   (rerank)              0       1   RETURNED
+//   VideoModelV3.doGenerate     (generateVideo)       1       0   BLOCKED
+//
+//   4 of 9 delivered the attack text; all 4 on ZERO firewall calls.
+//
+// TWO DISTINCT FAILURE MODES, and only one of them is the classic denylist:
+//
+//  1. UNGATED METHOD NAME — `doEmbed`, `doRerank`. `Reflect.get` handed the real
+//     method straight back. This is the anthropic/gemini bug verbatim, and it is
+//     what `createDefaultDenySurface` closes.
+//
+//  2. GATED METHOD, BLIND EXTRACTOR — speech and transcription. Their payload is
+//     `options.text` / `options.audio`; `collapsePrompt` read only
+//     `params.prompt`, produced "", and the caller's rule was
+//     `if (promptText) { …check… }` — so "the collapser surfaced nothing" meant
+//     SKIP THE RAIL and call the model anyway. checks=0 with the interception
+//     working perfectly. Default-deny alone does NOT close this; the extractor
+//     has to walk the WHOLE call-options body, which is what
+//     `makeBodyTextExtractor` does and why `collapsePrompt` now unions
+//     `collectRequestStrings` on top of `collapsePromptText`.
+//
+// Reachability, stated honestly: `tsc` REJECTS all five non-language model kinds
+// at the `withEvalguard` boundary (measured — TS2345 on MockEmbeddingModelV3,
+// MockImageModelV3, MockSpeechModelV3, MockTranscriptionModelV3,
+// MockRerankingModelV3), because the `LanguageModelV2` constraint requires
+// `doStream`. So a type-checked TypeScript consumer cannot reach the leaks. Plain
+// JavaScript, `as any`, and any config/registry-driven factory typed `unknown`
+// can, and always could. The type system is not the gate — that is the entire
+// lesson of 2026-08-08 — and a denylist that is correct only for one of seven
+// specifications becomes a bypass the day upstream adds the eighth.
+// FOLLOW-UP OWNED BY wrapper-core, not by this file:
+// `wrapper-core/src/__tests__/surface-conformance-registry.test.ts` still lists
+// `vercel-ai-wrapper` in `NON_PROXY_WRAPPERS`, with the reason quoted above. That
+// list only records "no conformance test is REQUIRED here", so the ratchet is
+// green either way and this package now carries one regardless
+// (`src/__tests__/surface-conformance.test.ts`). The entry should move into
+// `PROXY_WRAPPERS` with `conformanceTests: ["surface-conformance.test.ts"]` so
+// the registry can never let this wrapper silently lose it again.
+import { makeBodyTextExtractor, } from "@evalguard/wrapper-core";
+/**
+ * Real API RESOURCES exempted by decision.
+ *
+ * Empty, deliberately. A model has no management endpoints — every method on
+ * every `@ai-sdk/provider` specification issues a provider request carrying
+ * caller-supplied content. Nothing has earned an exemption. An entry added here
+ * must carry its reason inline.
+ */
+export const EXEMPT_RESOURCES = new Set([]);
+/**
+ * Capability / identity fields on a model instance that must be handed back
+ * unproxied.
+ *
+ * ⚠ THIS LIST IS A DENYLIST WEARING AN ALLOWLIST'S CLOTHES. Anything named here
+ * bypasses the guard entirely, so an entry that DOES reach the model is a silent
+ * leak. Every name below was read out of the installed `@ai-sdk/provider@3.0.10`
+ * specifications and each was driven through the real `ai` entry point with the
+ * firewall blocking: the firewall-check count stays 0 because NO REQUEST IS
+ * ISSUED, not because the guard was skipped.
+ *
+ * Why these specifically cannot be left to the generic gate:
+ *
+ *   `supportedUrls` is `Record<string, RegExp[]> | PromiseLike<…>`. Default-deny
+ *   proxies a non-function object, so `Object.entries(await model.supportedUrls)`
+ *   would yield proxied `RegExp[]` arrays whose `.test` is a FUNCTION — gated,
+ *   returning a Promise where the SDK expects a boolean. The capability map
+ *   would break, and `supportedUrls` being silently dropped is already a
+ *   MEDIUM this package fixed once (audit 2026-07-14).
+ *
+ *   `maxImagesPerCall` / `maxVideosPerCall` are
+ *   `number | undefined | GetMaxXPerCallFunction`. The FUNCTION form, gated,
+ *   returns a Promise where `generateImage` reads a number.
+ *
+ *   `maxEmbeddingsPerCall` / `supportsParallelCalls` are
+ *   `PromiseLike<…> | value`. A proxied thenable is a different object identity
+ *   than the SDK's own and buys nothing — neither carries caller text.
+ *
+ * `specificationVersion` / `provider` / `modelId` are strings and are passed
+ * through by the primitive rule without needing a name here; they are listed
+ * anyway so this file is a complete statement of the model spec's non-method
+ * surface rather than a partial one a reader has to cross-check.
+ */
+export const TRANSPORT_PASSTHROUGH = new Set([
+    // Identity — every specification, all `string`.
+    "specificationVersion",
+    "provider",
+    "modelId",
+    // LanguageModelV2 / V3 capability map.
+    "supportedUrls",
+    // EmbeddingModelV2 / V3 batching capability.
+    "maxEmbeddingsPerCall",
+    "supportsParallelCalls",
+    // ImageModelV2 / V3 and VideoModelV3 batching capability (may be a function).
+    "maxImagesPerCall",
+    "maxVideosPerCall",
+]);
+/** Union, for callers/tests asking "is this name exempt at all". */
+export const KNOWN_SAFE_PASSTHROUGH = new Set([
+    ...TRANSPORT_PASSTHROUGH,
+    ...EXEMPT_RESOURCES,
+]);
+/**
+ * Methods with a DEDICATED proxy in index.ts — the rich paths that also do
+ * stream teeing, token accounting, cost estimation and trace logging.
+ *
+ * These are NOT passthrough: `assertSurfacePolicy` fails at wrap time if the
+ * wrapper does not supply a handler for every name here, and it fails if a name
+ * appears here AND on a passthrough set.
+ *
+ * `doGenerate` is deliberately dedicated for EVERY model kind, not just language
+ * models. Image, speech, transcription and video specifications all spell their
+ * call method `doGenerate`, so routing it anywhere else would mean sniffing the
+ * model's shape to decide how hard to guard it — which is a denylist with extra
+ * steps. The rich override is shape-tolerant (`readTokens` and
+ * `extractOutputText` both degrade to 0 / "" on a non-language result), and its
+ * input rail now walks the whole call-options body, so a speech call is gated on
+ * `options.text` exactly like a language call is gated on `options.prompt`.
+ */
+export const DEDICATED_RESOURCES = new Set([
+    "doGenerate",
+    "doStream",
+]);
+/**
+ * True for an `@ai-sdk/provider` model specification object.
+ *
+ * Verified against `@ai-sdk/provider@3.0.10`: every one of the seven
+ * specifications declares `specificationVersion` AND `modelId` (language v2:52,
+ * v3:12/22; embedding v2:24/34, v3:18/28; image v2:27/37, v3:28/38; speech
+ * v2:17/27, v3:17/27; transcription v2:17/27, v3:17/27; reranking v3:15/25;
+ * video v3:49/59).
+ *
+ * This is what stops a passthrough NAME from un-guarding a MODEL: a wrapper or
+ * middleware that exposes an inner model under a capability name (e.g. a
+ * `provider` field holding a delegate rather than a string) still gets guarded,
+ * because the passthrough allowlist only wins when the VALUE is not a model.
+ */
+export function isAiSdkModel(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return "specificationVersion" in v && "modelId" in v;
+}
+/**
+ * Call-option fields KNOWN to carry model-visible caller text on
+ * `@ai-sdk/provider@3.0.10`.
+ *
+ * The FLOOR, not the gate — the shared extractor unions a whole-body walk on
+ * top, so a field nobody enumerated is scanned anyway. REMOVING a name here
+ * narrows detection; ADDING one is redundant. Every entry is a real field on a
+ * real specification's call-options type:
+ *
+ *   prompt     LanguageModelV{2,3}CallOptions, ImageModelV3CallOptions:3,
+ *              VideoModelV3CallOptions:3
+ *   values     EmbeddingModelV3CallOptions:3
+ *   text       SpeechModelV3CallOptions:4
+ *   instructions SpeechModelV3CallOptions:7
+ *   audio      TranscriptionModelV3CallOptions:4
+ *   documents / query  RerankingModelV3CallOptions:4/8
+ *   messages / content / input  the shapes `collapsePromptText` renders
+ *
+ * ⚠ MEASURED LIMIT — TRANSCRIPTION AUDIO IS NOT SCANNED. Listing `audio` above
+ * does not make it readable. `ai@6.0.208`'s `transcribe` normalises whatever the
+ * caller passed (base64 string, data URL, ArrayBuffer) into a `Uint8Array`
+ * BEFORE the model boundary, and wrapper-core's walker excludes typed arrays by
+ * SHAPE — decoding an upload as UTF-8 produces megabytes of mojibake that would
+ * trip the size bound and refuse every legitimate audio call. Measured, with a
+ * canary in the audio and the firewall recording what it was shown:
+ *
+ *   transcribe(audio: Uint8Array)      firewall saw ["audio/wav"]
+ *   transcribe(audio: base64 string)   firewall saw ["audio/wav"]
+ *   generateSpeech(text)               firewall saw ["<canary>"]
+ *   embed(value)                       firewall saw ["<canary>"]
+ *   rerank(documents, query)           firewall saw ["<canary>", "<canary>"]
+ *
+ * So a transcription call IS gated — `mediaType` is model-visible text, the rail
+ * runs, and the firewall can refuse the call — but the gate is not looking at the
+ * audio. That is the same documented unscannable limit as an uploaded file body,
+ * stated here rather than left to be inferred from a green matrix.
+ */
+export const MODEL_INPUT_FIELDS = [
+    "prompt",
+    "messages",
+    "content",
+    "input",
+    "values",
+    "text",
+    "instructions",
+    "audio",
+    "documents",
+    "query",
+];
+export const VERCEL_AI_SURFACE_POLICY = {
+    provider: "vercel-ai",
+    exemptResources: EXEMPT_RESOURCES,
+    transportPassthrough: TRANSPORT_PASSTHROUGH,
+    dedicatedResources: DEDICATED_RESOURCES,
+    isProviderResource: isAiSdkModel,
+    extractText: makeBodyTextExtractor(MODEL_INPUT_FIELDS),
+    // The model id lives on the MODEL, not in the call options — no
+    // `@ai-sdk/provider` call-options type carries a `model` field, so
+    // `extractModelIdFromArgs` would report "unknown" for every call. The wrapper
+    // binds the real `model.modelId` via {@link vercelAiSurfacePolicy}; this
+    // default is only what a caller gets who asks for the policy without a model.
+    extractModelId: () => "unknown",
+};
+/**
+ * The policy bound to one model instance, so traces carry the real model id.
+ *
+ * A function rather than a mutation: two wrapped models in the same process must
+ * not be able to overwrite each other's trace metadata.
+ */
+export function vercelAiSurfacePolicy(modelId) {
+    // `modelId` is `string` on every specification, but this runs on whatever the
+    // caller handed `withEvalguard` — including, in the conformance suite, an
+    // object that is not a model at all. A non-string here must degrade to the
+    // trace-metadata default, never propagate `undefined` into a trace field.
+    const id = typeof modelId === "string" && modelId ? modelId : "unknown";
+    return { ...VERCEL_AI_SURFACE_POLICY, extractModelId: () => id };
+}
+//# sourceMappingURL=surface.js.map

package/dist/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,kFAAkF;AAClF,uCAAuC;AACvC,EAAE;AACF,iFAAiF;AACjF,2EAA2E;AAC3E,2CAA2C;AAC3C,EAAE;AACF,mFAAmF;AACnF,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,oDAAoD;AACpD,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,8FAA8F;AAC9F,gGAAgG;AAChG,gGAAgG;AAChG,gHAAgH;AAChH,gHAAgH;AAChH,0GAA0G;AAC1G,0GAA0G;AAC1G,iHAAiH;AACjH,iHAAiH;AACjH,gGAAgG;AAChG,gHAAgH;AAChH,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8CAA8C;AAC9C,EAAE;AACF,iFAAiF;AACjF,mEAAmE;AACnE,8DAA8D;AAC9D,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,uEAAuE;AACvE,8DAA8D;AAC9D,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,iEAAiE;AACjE,2EAA2E;AAC3E,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AAEpE,qDAAqD;AACrD,gFAAgF;AAChF,kFAAkF;AAClF,8EAA8E;AAC9E,+DAA+D;AAC/D,4EAA4E;AAC5E,+EAA+E;AAC/E,kEAAkE;AAElE,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAS,EAAE,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,gDAAgD;IAChD,sBAAsB;IACtB,UAAU;IACV,SAAS;IACT,uCAAuC;IACvC,eAAe;IACf,6CAA6C;IAC7C,sBAAsB;IACtB,uBAAuB;IACvB,8EAA8E;IAC9E,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,GAAG,qBAAqB;IACxB,GAAG,gBAAgB;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,YAAY;IACZ,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,sBAAsB,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,QAAQ;IACR,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,cAAc;IACd,OAAO;IACP,WAAW;IACX,OAAO;CACR,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAkB;IACrD,QAAQ,EAAE,WAAW;IACrB,eAAe,EAAE,gBAAgB;IACjC,oBAAoB,EAAE,qBAAqB;IAC3C,kBAAkB,EAAE,mBAAmB;IACvC,kBAAkB,EAAE,YAAY;IAChC,WAAW,EAAE,qBAAqB,CAAC,kBAAkB,CAAC;IACtD,gEAAgE;IAChE,mEAAmE;IACnE,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,EAAE,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,OAAO,EAAE,GAAG,wBAAwB,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "1.0.0";
+export declare const VERSION = "1.0.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,5 +1,5 @@
 // Single source of the wrapper version WITHIN src (so the User-Agent header
 // can't drift between call sites). Kept in lockstep with package.json#version;
 // a unit test (version.test.ts) fails CI if the two ever diverge. (#120)
-export const VERSION = "1.0.0";
+export const VERSION = "1.0.2";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evalguard/vercel-ai",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Drop-in Vercel AI SDK middleware with EvalGuard guardrails, trace logging & cost tracking",
   "main": "./dist/index.js",
   "exports": {
@@ -13,6 +13,7 @@
   "files": [
     "dist",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "peer-matrix.json"
   ],
@@ -40,7 +41,7 @@
     "ai": ">=5.0.0"
   },
   "dependencies": {
-    "@evalguard/wrapper-core": "^1.2.0"
+    "@evalguard/wrapper-core": "^1.3.0"
   },
   "devDependencies": {
     "@types/node": "^26.0.0",