Add github.com/wso2/api-platform/sdk/ai module

[Irash-Perera]

1. Purpose of Dependency

Please describe the core functionality of the requested dependency:

github.com/wso2/api-platform/sdk/ai is a WSO2 owned module published from the wso2/api-platform repository, alongside github.com/wso2/api-platform/sdk/core which is already registered. It is not a third party library. It provides the shared AI building blocks that gateway policies consume: llmusage, which reads token counts, model name and billing tier from an LLM response using the locations declared in the route's LlmProviderTemplate and merges server sent event streams into a single view; embeddings, which provides embedding provider clients; and vectordb, which provides vector store clients. Registration is requested so that policies in wso2/gateway-controllers can depend on it in the same way they already depend on sdk/core.

2. Technical Justification

Explain why this cannot be achieved without introducing a new third-party library:
(e.g., Why is standard library functionality, an existing approved dependency, or internal development insufficient?)

No third party library is being introduced. The module is our own code, factored out of the gateway policies so several policies share one implementation rather than each carrying a copy. llmusage is the clearest example: reading usage out of an LLM response involves provider specific field locations, fallback locations, per resource overrides and stream merging, and before it existed each cost policy reimplemented that in Go. Consolidating it into the SDK removed around 590 lines of duplicated parsing from the llm-cost policy alone, and means a provider change is a template edit rather than a code change in every policy. The alternative to registering it is to vendor or duplicate WSO2 code across repositories, which is what the SDK was created to stop.

3. Dependency Health & Security Validation

By checking the boxes below, you confirm that you have evaluated the dependency against WSO2 engineering standards:

• Active Maintenance: Maintained by WSO2 in wso2/api-platform, the same repository as the already registered sdk/core. Released regularly, with v0.1.7, v0.1.8, v0.2.0, v0.2.1, v0.2.2 and v0.2.3 published in sequence, and v0.2.3 current.
• License Compliance: Apache License 2.0, the license of the wso2/api-platform repository it is published from.
• Security Posture: No known unpatched CVEs. As first party code it is covered by the same review and scanning as the rest of wso2/api-platform, and its dependency tree is the same one already accepted for sdk/core.

Registry entry

  - module: github.com/wso2/api-platform/sdk/ai
    versions:
      - version: ">=v0.2.3"
        allowed_scopes:
          - "*"

Floor set at v0.2.3, following how sdk/core is handled: its floor of v0.2.4 sits above eleven published versions, so the bar is a minimum to upgrade to rather than the oldest version still in use. Scope *, matching sdk/core.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 10cfb2cc-92c8-437f-8392-663b58a82857

📥 Commits

Reviewing files that changed from the base of the PR and between fdc7bd5 and acd5564.

📒 Files selected for processing (1)

• dependency-registry/go.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary

• Registered github.com/wso2/api-platform/sdk/ai in dependency-registry/go.yaml.
• Allowed module versions >=v0.2.3 for all scopes.
• Enabled wso2/gateway-controllers policies to use the shared AI SDK module.

Walkthrough

The Go dependency registry now includes github.com/wso2/api-platform/sdk/ai. The registry requires version v0.2.3 or later and permits the dependency for all scopes.

Suggested reviewers: o-sura, brionmario, ddh13

Merge Risk: ⚪ Minimal · up to acd55

This change registers the WSO2-owned AI SDK module for dependency use; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding the github.com/wso2/api-platform/sdk/ai module to the registry.
Description check	✅ Passed	The description covers the dependency purpose, technical justification, maintenance, license, security validation, and proposed registry entry. All required sections are complete.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Thushani-Jayasekera]

/azp run Claude Code • Dependency Analysis / analyze-dependencies (pull_request_target)

[Irash-Perera]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[pubudu538]

@tharindu1st Did we do anything to resolve the modules within the repo?