Vercel AI SDK
Use an explicit server-side gate around a buffered AI SDK generation.
This is an integration recipe, not a claim that the Python interceptor covers JavaScript AI SDK internals. Complete the quickstart and save nyraxis-gate.mjs in your server application (adjust the import path below).
npm install ai @ai-sdk/openai @nyraxis/sdk@1.2.9Next.js route example
Configure a policy for docs-integration and set NYRAXIS_API_KEY, NYRAXIS_BASE_URL and OPENAI_API_KEY as server environment variables. This route expects JSON with an input string and returns buffered JSON, so it can check the final text before release.
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";
import { requireAllowed } from "./nyraxis-gate.mjs";
export async function POST(request: Request) {
let body;
try { body = await request.json(); }
catch { return Response.json({ error: "Invalid JSON" }, { status: 400 }); }
const input = body?.input;
if (typeof input !== "string" || !input.trim() || input.length > 4000) {
return Response.json({ error: "Provide 1–4000 characters" }, { status: 400 });
}
try {
await requireAllowed({ input });
const { text: output } = await generateText({ model: openai("gpt-4o-mini"), prompt: input });
await requireAllowed({ input, output });
return Response.json({ output });
} catch (error) {
const blocked = error instanceof Error && error.name === "PolicyBlocked";
return Response.json({ error: blocked ? "Policy blocked this request" : "Required check or model unavailable" }, { status: blocked ? 403 : 503 });
}
}Streaming and tools
This endpoint is a JSON API, not a useChat message-stream endpoint. When using streamText, an input gate can run before generation, but an output check after streaming cannot retract tokens. Buffer the answer or design a separate chunk/release boundary. Model tool calls need explicit pre-execution authorization.
Follow the AI SDK documentation for the version you pin. Add application auth, request-size/rate limits and provider timeouts before deploying a public route. Test safe, blocked, incomplete and transport-failure paths and verify actual provider call counts.