@ory/vercel-ai 0.10.0

package/README.md

@@ -0,0 +1,38 @@
+# @ory/vercel-ai
+
+Ory Agent Security for the [Vercel AI SDK](https://ai-sdk.dev).
+
+Wraps your tools so every call is authorized against Ory Permissions, traced, and tied to
+the user → agent identity — built on [`@ory/argus`](../core).
+
+```bash
+npm install @ory/vercel-ai
+```
+
+```ts
+import { generateText } from "ai";
+import { withOry } from "@ory/vercel-ai";
+
+const result = await generateText({
+  model,
+  tools: withOry({ search, sendEmail }), // gate every tool's execute()
+  prompt: "…",
+});
+```
+
+The Vercel AI SDK has no global before-tool hook — enforcement lives at the tool boundary, so
+`withOry` wraps each tool's `execute`. On the first call it runs the Ory session gates; on
+each call it authorizes the tool and records spans. In **enforce** mode
+(`ORY_PERMISSION_MODE=enforce`) a denied tool throws, surfacing to the model as a tool error;
+in **observe** mode (default) the tool runs and a `permission.observe_deny` span is recorded.
+Tools without an `execute` (provider-defined) pass through untouched.
+
+Derive the permission subject from per-call context with `subjectFromOptions`:
+
+```ts
+withOry(tools, { subjectFromOptions: (o) => o?.experimental_context?.userId });
+```
+
+This package depends only on `@ory/argus` — not the `ai` package; tools are duck-typed so any
+`ai` version works. Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.
+See [docs/sdk-integrations.md](../../docs/sdk-integrations.md).

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Ory Agent Security for the Vercel AI SDK.
+ *
+ * The Vercel AI SDK has no global before-tool hook — enforcement lives at the tool
+ * boundary. {@link withOry} wraps each tool's `execute` so every call is authorized against
+ * Ory Permissions, traced, and (on first call) preceded by the Ory session gates. A denied
+ * tool in enforce mode throws, surfacing to the model as a tool error; in observe mode the
+ * tool runs and a `permission.observe_deny` span is recorded.
+ *
+ * This package depends only on `@ory/argus` — the Vercel `ai` package is not a dependency;
+ * tools are duck-typed so any `ai` version works.
+ *
+ *   import { withOry } from "@ory/vercel-ai";
+ *   const result = await generateText({ model, tools: withOry({ search, sendEmail }) });
+ */
+import { OryAgentClient } from "@ory/argus";
+/** A Vercel AI SDK tool — duck-typed to avoid a dependency on the `ai` package. */
+export interface VercelTool {
+    execute?: (input: unknown, options?: unknown) => unknown;
+    [key: string]: unknown;
+}
+export type ToolSet = Record<string, VercelTool>;
+export interface WithOryOptions {
+    /** Client to use. Defaults to `OryAgentClient.fromEnv("vercel-ai")` (reads shared config). */
+    client?: OryAgentClient;
+    /** Override the Ory project URL for the session gates. */
+    projectUrl?: string;
+    /** Whether a denied tool is hard-blocked (throws). Default true. */
+    canBlock?: boolean;
+    /**
+     * Derive the permission subject from the AI SDK call options (e.g. read a thread/user id
+     * from `options.experimental_context`). Falls back to the client principal / env when the
+     * function returns undefined.
+     */
+    subjectFromOptions?: (options: unknown) => string | undefined;
+}
+/**
+ * Wrap every tool in `tools` so its `execute` is gated through Ory. Tools without an
+ * `execute` (client-side / provider-defined tools) are passed through untouched.
+ */
+export declare function withOry(tools: ToolSet, options?: WithOryOptions): ToolSet;
+export { OryAgentClient, OryDenialError } from "@ory/argus";

package/dist/index.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Ory Agent Security for the Vercel AI SDK.
+ *
+ * The Vercel AI SDK has no global before-tool hook — enforcement lives at the tool
+ * boundary. {@link withOry} wraps each tool's `execute` so every call is authorized against
+ * Ory Permissions, traced, and (on first call) preceded by the Ory session gates. A denied
+ * tool in enforce mode throws, surfacing to the model as a tool error; in observe mode the
+ * tool runs and a `permission.observe_deny` span is recorded.
+ *
+ * This package depends only on `@ory/argus` — the Vercel `ai` package is not a dependency;
+ * tools are duck-typed so any `ai` version works.
+ *
+ *   import { withOry } from "@ory/vercel-ai";
+ *   const result = await generateText({ model, tools: withOry({ search, sendEmail }) });
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OryDenialError = exports.OryAgentClient = void 0;
+exports.withOry = withOry;
+const argus_1 = require("@ory/argus");
+const HARNESS = "vercel-ai";
+/**
+ * Wrap every tool in `tools` so its `execute` is gated through Ory. Tools without an
+ * `execute` (client-side / provider-defined tools) are passed through untouched.
+ */
+function withOry(tools, options = {}) {
+    const client = options.client ?? argus_1.OryAgentClient.fromEnv(HARNESS);
+    const canBlock = options.canBlock ?? true;
+    let sessionStarted = false;
+    const ensureSession = async () => {
+        if (sessionStarted)
+            return;
+        sessionStarted = true;
+        try {
+            await (0, argus_1.sessionStart)(client, { harness: HARNESS, projectUrl: options.projectUrl });
+        }
+        catch (err) {
+            client.logger.warn("session_start.failed", {
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    };
+    const wrapped = {};
+    for (const [name, tool] of Object.entries(tools)) {
+        if (!tool || typeof tool.execute !== "function") {
+            wrapped[name] = tool;
+            continue;
+        }
+        const originalExecute = tool.execute.bind(tool);
+        wrapped[name] = {
+            ...tool,
+            execute: async (input, callOptions) => {
+                await ensureSession();
+                const subjectFallback = options.subjectFromOptions?.(callOptions);
+                const result = await (0, argus_1.gate)(client, {
+                    harness: HARNESS,
+                    toolName: name,
+                    toolArgs: input,
+                    subjectFallback,
+                    canBlock,
+                });
+                if (result.blocked) {
+                    throw new argus_1.OryDenialError({
+                        tool: name,
+                        subjectId: result.subject,
+                        namespace: result.namespace,
+                    });
+                }
+                const output = await originalExecute(input, callOptions);
+                (0, argus_1.complete)(client, { toolName: name, output });
+                return output;
+            },
+        };
+    }
+    return wrapped;
+}
+var argus_2 = require("@ory/argus");
+Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return argus_2.OryAgentClient; } });
+Object.defineProperty(exports, "OryDenialError", { enumerable: true, get: function () { return argus_2.OryDenialError; } });

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@ory/vercel-ai",
+  "version": "0.10.0",
+  "description": "Ory Agent Security for the Vercel AI SDK — per-tool authorization, tracing, and identity propagation by wrapping tool execute(). Built on @ory/argus.",
+  "license": "Apache-2.0",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.tsbuildinfo"
+  ],
+  "keywords": [
+    "ory",
+    "vercel",
+    "ai-sdk",
+    "authorization",
+    "agent",
+    "ai",
+    "permissions"
+  ],
+  "dependencies": {
+    "@ory/argus": "0.10.0"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.2",
+    "vitest": "4.1.4"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist *.tsbuildinfo",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}