Vercel AI SDK

# The AI SDK is YOUR dependency, not part of @daloyjs/core.
# @daloyjs/core stays at zero runtime dependencies; you add the
# model provider you actually use.
pnpm add ai @ai-sdk/openai

// A streaming chat endpoint, compatible with the AI SDK's
// useChat() hook on the client. The AI SDK produces a web-standard
// Response, and a DaloyJS handler can return a raw Response directly:
// the framework still finalizes it (request id, secureHeaders, CORS,
// fingerprint stripping) like any other response.
import { z } from "zod";
import { App } from "@daloyjs/core";
import { streamText, convertToModelMessages } from "ai";
import { openai } from "@ai-sdk/openai";

export const app = new App();

app.route({
  method: "POST",
  path: "/api/chat",
  operationId: "chat",
  request: {
    // You still validate the request. A message count cap plus the
    // default 1 MiB body limit are your first abuse guard, even on a
    // streaming route. Tighten z.unknown() to a UIMessage schema if
    // you want a stricter contract.
    body: z
      .object({ messages: z.array(z.unknown()).min(1).max(50) })
      .strict(),
  },
  responses: {
    // Streaming routes do not carry a response-body schema; OpenAPI
    // documents them as a stream. That is the one honest trade-off.
    200: { description: "UI message stream (text/event-stream)" },
  },
  handler: async ({ body, request }) => {
    const result = streamText({
      model: openai("gpt-5.1"),
      messages: convertToModelMessages(body.messages as never),
      // Cancel the upstream model call if the client disconnects.
      abortSignal: request.signal,
    });

    // Return the Response as-is. No mapping, no adapter.
    return result.toUIMessageStreamResponse();
  },
});

// This is the pattern that is genuinely better on a contract-first
// framework: the SAME Zod schema is the model's output schema, the
// route's response schema, the OpenAPI shape, and the typed client.
// One source of truth, validated twice (once by the SDK, once at the
// HTTP boundary), so a drifting model can never leak a malformed body.
import { z } from "zod";
import { App } from "@daloyjs/core";
import { generateObject } from "ai";
import { openai } from "@ai-sdk/openai";

export const app = new App();

const Analysis = z
  .object({
    sentiment: z.enum(["positive", "neutral", "negative"]),
    summary: z.string().max(280),
    topics: z.array(z.string()).max(8),
  })
  .strict();

app.route({
  method: "POST",
  path: "/api/analyze",
  operationId: "analyzeText",
  request: {
    body: z.object({ text: z.string().min(1).max(10_000) }).strict(),
  },
  responses: {
    // Reuse the exact schema the model is constrained to.
    200: { description: "analysis", schema: Analysis },
  },
  handler: async ({ body }) => {
    const { object } = await generateObject({
      model: openai("gpt-5.1"),
      schema: Analysis,
      prompt: body.text,
    });

    // 'object' was validated by the AI SDK. DaloyJS validates it
    // AGAIN against the response schema before it leaves, so even an
    // SDK or schema mismatch becomes a controlled 500, never a leak.
    return { status: 200 as const, body: object };
  },
});

// Tool calls are where prompt injection turns into SSRF: the model
// asks your tool to fetch a URL, and a poisoned prompt points it at
// 169.254.169.254 (cloud metadata) or your internal network.
// Route every tool fetch through fetchGuard() and that whole class
// of attack is default-denied, including redirects.
import { z } from "zod";
import { App, fetchGuard } from "@daloyjs/core";
import { streamText, convertToModelMessages, tool, stepCountIs } from "ai";
import { openai } from "@ai-sdk/openai";

export const app = new App();

// A guarded fetch: loopback, RFC1918, link-local, and cloud-metadata
// IPs are refused; only the hosts you allow get through.
const safeFetch = fetchGuard({ allow: ["https://api.weather.example"] });

const getWeather = tool({
  description: "Get the current weather for a city.",
  inputSchema: z.object({ city: z.string().min(1).max(80) }),
  execute: async ({ city }) => {
    const r = await safeFetch(
      `https://api.weather.example/v1?city=${encodeURIComponent(city)}`,
    );
    return (await r.json()) as { tempC: number; summary: string };
  },
});

app.route({
  method: "POST",
  path: "/api/agent",
  operationId: "agent",
  request: {
    body: z.object({ messages: z.array(z.unknown()).min(1).max(50) }).strict(),
  },
  responses: { 200: { description: "UI message stream" } },
  handler: async ({ body, request }) => {
    const result = streamText({
      model: openai("gpt-5.1"),
      messages: convertToModelMessages(body.messages as never),
      tools: { getWeather },
      // AI SDK 7 multi-step tool loop, bounded so a runaway agent
      // cannot loop forever on your dime.
      stopWhen: stepCountIs(5),
      abortSignal: request.signal,
    });

    return result.toUIMessageStreamResponse();
  },
});

// The deployment-time layer the model never gets a vote in.
// All of this ships in @daloyjs/core with zero runtime dependencies.
import {
  App,
  secureHeaders,
  requestId,
  structuredLogger,
  rateLimit,
  loadShedding,
  bearerAuth,
} from "@daloyjs/core";

export const app = new App({
  // bodyLimitBytes: 1 << 20    // 1 MiB default: caps prompt size
  // requestTimeoutMs: 30_000   // default: a stuck model call cannot hang forever
  // production auto-detected   // prod-mode 5xx redaction by default
});

app.use(secureHeaders());
app.use(requestId());
app.use(structuredLogger()); // provider keys are redacted by default
app.use(rateLimit({ windowMs: 60_000, max: 60 }));
app.use(loadShedding({ maxQueueDepth: 100, maxEventLoopDelayMs: 50 }));

// Every AI endpoint authenticates. The model is a caller, not a user.
app.use("/api/*", bearerAuth({ verify: (token) => sessions.verify(token) }));