feat(sdk): TypeScript SDK — Vercel AI SDK adapter

[prashar32]

Govern a Vercel AI SDK agent with ~no code change — the JS analog of the Python LangChain / OpenAI-Agents adapters.

governMiddleware(run) (exposed as @riskkernel/sdk/vercel) is an AI SDK language-model middleware: its wrapGenerate / wrapStream hooks tick one governed run.step() per model call, so the run's loop/time budget is enforced and a halt surfaces as BudgetExceeded out of generateText / streamText — not swallowed. The daemon decides; the adapter carries no governance logic.

import { generateText, wrapLanguageModel } from "ai";
import { governMiddleware } from "@riskkernel/sdk/vercel";

await rt.governedRun({ budget: { loops: 20, dollars: 1 } }, async (run) => {
  const { baseUrl, headers } = run.proxyConfig();
  const openai = createOpenAI({ baseURL: baseUrl, headers });    // $ / tokens metered by the proxy
  const model = wrapLanguageModel({ model: openai("gpt-4o-mini"), middleware: governMiddleware(run) });
  await generateText({ model, prompt });                         // loops / time enforced by the middleware
});

Keeps the core dependency-free

The adapter is typed against @ai-sdk/provider via import type only, so it's erased at build — verified the built dist/vercel.js has no runtime import of it. @ai-sdk/provider is an optional peer (tiny, types-only), needed only when you import the adapter; the core client still pulls nothing. Ships as a second tsup entry behind the ./vercel subpath export.

Tests

• Unit tests against the in-process mock daemon (no daemon, no keys): the middleware ticks a step per call, surfaces BudgetExceeded when the loop budget is spent, and does not run the model once the step is rejected (no overspend).
• A runnable, key-free example (examples/vercel-ai-sdk) halts a looping agent on its loop budget. It typechecks against the real ai@5 package, proving governMiddleware(run) is assignable to wrapLanguageModel's middleware. Pinned + documented to AI SDK v5.

Closes #81.

---

Stacked on #104 (the dev-dep security bumps) so it inherits the vitest 3 / Node 20 baseline. Review base is chore/ts-sdk-dep-bumps; GitHub will retarget this to main once #104 merges.