@ai-sdk/anthropic 4.0.57 → 4.0.59

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @ai-sdk/anthropic
 
+## 4.0.59
+
+### Patch Changes
+
+- f7b7b2a: feat(provider/anthropic): add `safeguards` provider option and `safeguardResults` provider metadata (dangerous tool use classifier)
+
+## 4.0.58
+
+### Patch Changes
+
+- Updated dependencies [2973485]
+- Updated dependencies [a4db5ea]
+- Updated dependencies [2937ea2]
+  - @ai-sdk/provider-utils@5.0.45
+
 ## 4.0.57
 
 ### Patch Changes

package/dist/index.d.ts

@@ -3,6 +3,19 @@ import { z } from 'zod/v4';
 import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
 import { ToolExecuteFunction, Tool, Experimental_SandboxSession, ProviderDefinedTool, FetchFunction } from '@ai-sdk/provider-utils';
 
+declare const anthropicSafeguardResultSchema: z.ZodObject<{
+    type: z.ZodString;
+    status: z.ZodObject<{
+        type: z.ZodString;
+        tool_uses: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodObject<{
+            type: z.ZodString;
+            outcome: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            explanation: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type AnthropicSafeguardResult = z.infer<typeof anthropicSafeguardResultSchema>;
+
 /**
  * Represents a single iteration in the usage breakdown.
  *
@@ -57,6 +70,18 @@ interface AnthropicMessageMetadata {
         path: string;
         reason: string;
     }>;
+    /**
+     * Verdicts of the server-side safeguards requested with
+     * `providerOptions.anthropic.safeguards`, one entry per requested safeguard.
+     * For `dangerous_tool_use`, `status.type` is `'available'` when the
+     * classifier ran and `status.tool_uses` maps each tool call id to its
+     * verdict (`type: 'evaluated'` with an `outcome` of `'not_flagged'` or
+     * `'flagged'` plus an `explanation`, `'skipped'`, or `'unavailable'`).
+     *
+     * Kept in the API's wire shape (snake_case), since consumers such as Claude
+     * Code read the verdicts verbatim.
+     */
+    safeguardResults?: AnthropicSafeguardResult[];
     /**
      * Details about why the request stopped. Present only when the API returns
      * a `refusal` stop reason together with a `stop_details` object (a
@@ -219,9 +244,9 @@ type AnthropicSystemMessageProviderOptions = z.infer<typeof anthropicSystemMessa
 declare const anthropicLanguageModelOptions: z.ZodObject<{
     sendReasoning: z.ZodOptional<z.ZodBoolean>;
     structuredOutputMode: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
         outputFormat: "outputFormat";
         jsonTool: "jsonTool";
-        auto: "auto";
     }>>;
     thinking: z.ZodOptional<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"adaptive">;
@@ -316,6 +341,10 @@ declare const anthropicLanguageModelOptions: z.ZodObject<{
         }>>;
     }, z.core.$strip>>]>>;
     anthropicBeta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    safeguards: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodLiteral<"dangerous_tool_use">;
+        classifierContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
     contextManagement: z.ZodOptional<z.ZodObject<{
         edits: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             type: z.ZodLiteral<"clear_tool_uses_20250919">;

package/dist/index.js

@@ -156,6 +156,20 @@ var anthropicStopDetailsSchema = z3.object({
   explanation: z3.string().nullish(),
   recommended_model: z3.string().nullish()
 });
+var anthropicSafeguardResultSchema = z3.object({
+  type: z3.string(),
+  status: z3.object({
+    type: z3.string(),
+    tool_uses: z3.record(
+      z3.string(),
+      z3.object({
+        type: z3.string(),
+        outcome: z3.string().nullish(),
+        explanation: z3.string().nullish()
+      })
+    ).nullish()
+  })
+});
 var anthropicToolCallCallerSchema = z3.union([
   z3.object({
     type: z3.literal("code_execution_20250825"),
@@ -489,6 +503,7 @@ var anthropicResponseSchema = lazySchema3(
       stop_sequence: z3.string().nullish(),
       stop_details: anthropicStopDetailsSchema.nullish(),
       input_transformations: z3.array(anthropicInputTransformationSchema).nullish(),
+      safeguard_results: z3.array(anthropicSafeguardResultSchema).nullish(),
       usage: z3.looseObject({
         input_tokens: z3.number(),
         output_tokens: z3.number(),
@@ -872,6 +887,7 @@ var anthropicChunkSchema = lazySchema3(
           stop_reason: z3.string().nullish(),
           stop_sequence: z3.string().nullish(),
           stop_details: anthropicStopDetailsSchema.nullish(),
+          safeguard_results: z3.array(anthropicSafeguardResultSchema).nullish(),
           container: z3.object({
             expires_at: z3.string(),
             id: z3.string(),
@@ -1220,6 +1236,22 @@ var anthropicLanguageModelOptions = z4.object({
    * Allow a provider to receive the full `betas` set if it needs it.
    */
   anthropicBeta: z4.array(z4.string()).optional(),
+  /**
+   * Server-side safeguards to run as part of the request.
+   *
+   * `dangerous_tool_use` asks the API to classify every `tool_use` block in
+   * the response for dangerous actions (the check Claude Code's auto mode
+   * relies on). The per-call verdicts are returned in
+   * `providerMetadata.anthropic.safeguardResults`, keyed by tool call id.
+   * `classifierContext` is passed through to the API as `classifier_context`.
+   * The `dangerous-tool-use-2026-09-03` beta is added automatically.
+   */
+  safeguards: z4.array(
+    z4.object({
+      type: z4.literal("dangerous_tool_use"),
+      classifierContext: z4.record(z4.string(), z4.unknown()).optional()
+    })
+  ).optional(),
   contextManagement: z4.object({
     edits: z4.array(
       z4.discriminatedUnion("type", [
@@ -4252,6 +4284,14 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
       // prompt:
       system: messagesPrompt.system,
       messages: messagesPrompt.messages,
+      ...(anthropicOptions == null ? void 0 : anthropicOptions.safeguards) && anthropicOptions.safeguards.length > 0 && {
+        safeguards: anthropicOptions.safeguards.map((safeguard) => ({
+          type: safeguard.type,
+          ...safeguard.classifierContext !== void 0 && {
+            classifier_context: safeguard.classifierContext
+          }
+        }))
+      },
       ...contextManagement && {
         context_management: {
           edits: contextManagement.edits.map((edit) => {
@@ -4364,6 +4404,9 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
     if ((anthropicOptions == null ? void 0 : anthropicOptions.mcpServers) && anthropicOptions.mcpServers.length > 0) {
       betas.add("mcp-client-2025-04-04");
     }
+    if ((anthropicOptions == null ? void 0 : anthropicOptions.safeguards) && anthropicOptions.safeguards.length > 0) {
+      betas.add("dangerous-tool-use-2026-09-03");
+    }
     if (contextManagement) {
       betas.add("context-management-2025-06-27");
       if (contextManagement.edits.some((e) => e.type === "compact_20260112")) {
@@ -4985,6 +5028,7 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
           stopSequence: (_a2 = response.stop_sequence) != null ? _a2 : null,
           ...stopDetails != null ? { stopDetails } : {},
           ...response.input_transformations != null ? { inputTransformations: response.input_transformations } : {},
+          ...response.safeguard_results != null ? { safeguardResults: response.safeguard_results } : {},
           iterations: response.usage.iterations ? response.usage.iterations.map(
             (iter) => ({
               type: iter.type,
@@ -5071,6 +5115,7 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
     let stopSequence = null;
     let stopDetails = void 0;
     let inputTransformations;
+    let safeguardResults;
     let container = null;
     let isJsonResponseFromTool = false;
     let isMessageOpen = false;
@@ -5845,6 +5890,9 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
               if (value.input_transformations != null) {
                 inputTransformations = value.input_transformations;
               }
+              if (value.delta.safeguard_results != null) {
+                safeguardResults = value.delta.safeguard_results;
+              }
               rawUsage = {
                 ...rawUsage,
                 ...value.usage
@@ -5859,6 +5907,7 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
                 stopSequence,
                 ...stopDetails != null ? { stopDetails } : {},
                 ...inputTransformations != null ? { inputTransformations } : {},
+                ...safeguardResults != null ? { safeguardResults } : {},
                 iterations: usage.iterations ? usage.iterations.map(
                   (iter) => ({
                     type: iter.type,
@@ -7002,6 +7051,7 @@ function convertAnthropicMessageMetadata(response) {
     stopSequence: (_a = response.stop_sequence) != null ? _a : null,
     ...stopDetails != null ? { stopDetails } : {},
     ...response.input_transformations != null ? { inputTransformations: response.input_transformations } : {},
+    ...response.safeguard_results != null ? { safeguardResults: response.safeguard_results } : {},
     iterations: response.usage.iterations ? response.usage.iterations.map(
       (iteration) => ({
         type: iteration.type,
@@ -7826,7 +7876,7 @@ var AnthropicSkills = class {
 };
 
 // src/version.ts
-var VERSION = true ? "4.0.57" : "0.0.0-test";
+var VERSION = true ? "4.0.59" : "0.0.0-test";
 
 // src/anthropic-provider.ts
 var ANTHROPIC_API_URL = "https://api.anthropic.com";