integrate-arcjet-guard-tanstack-ai

Integrate Arcjet Guard into TanStack AI

@arcjet/guard's TanStack AI v0 namespace wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Two surfaces, one decision rule:

• Tool calls → guardMiddleware(). A chat({ middleware }) middleware whose onBeforeToolCall is the chat()-wide gate. Default DENY is { type: "skip", result: ArcjetDenialResult } so the tool never runs and the model sees the payload. Optional onDeny: "abort" returns { type: "abort", reason } and stops the run — the model does not get ArcjetDenialResult. Do not throw from the hook. Tools already branded by a sibling guardTool are skipped so Guard is not double-called. Inbound guard() before chat() does not brand tools and does not skip this gate.
• Correlation → tanstackAiContext() reads a caller-owned id from the helper options or chat({ context }). It never mints a new id. It never reads ctx.threadId (TanStack auto-generates it). It never reads traceId / requestId / streamId.

There is no guardTool. A throw from execute is swallowed into { error } and is not a usable deny envelope. There is no guardInbound, no guardApproval, and nothing named contentGuardMiddleware (TanStack already has that name).

This namespace is TanStack AI chat({ middleware }) + onBeforeToolCall. Not the Vercel AI SDK. Do not also wrap with @arcjet/guard/vercel-ai/v7 or @arcjet/guard/claude-managed-agents/v0. Client tools and provider-native tools with no local execute are out of scope.

Docs live at docs.arcjet.com/guards/tanstack-ai/. Do not overwrite any other /guards/... slug.

Put Arcjet first in the middleware array. onBeforeToolCall is first-win; if toolCacheMiddleware (or anything else) skips first, Guard never runs.

Screen inbound before chat() — there is no inbound hook.

There is no first-class inbound channel, so there is no guardInbound. Put prompt-injection (and other inbound rules) in the application before chat(). Call guard() directly. guard() fails open — callers must check hasFailedOpen(). TanStack's contentGuardMiddleware redacts the stream; it is not this policy gate.