@ai-sdk/gateway 4.0.16 → 4.0.19

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @ai-sdk/gateway
 
+## 4.0.19
+
+### Patch Changes
+
+- 4be62c1: fix(provider-utils): validate provider-response URLs in `getFromApi`
+
+  `getFromApi` now has a `validateUrl` flag. It is optional so existing callers keep compiling (omitting it behaves like `false`, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When `true`, the URL is routed through `fetchWithValidatedRedirects` — the same guard used by `downloadBlob` — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than `Authorization` may); blocked URLs throw `DownloadError`. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass `validateUrl: false` and are unaffected.
+
+  A new optional `credentialedOrigin` withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.
+
+  A new optional `trustedOrigin` exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.
+
+  Also closes range gaps in `validateDownloadUrl` (IPv4 `224.0.0.0/4` multicast and the TEST-NET documentation ranges `192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`; IPv6 documentation ranges `2001:db8::/32` and `3fff::/20`), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a `Location` header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node `fetch` that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See `contributing/secure-url-handling.md`.
+
+- f8e82fd: Add experimental streaming transcription support to the gateway provider (`GatewayTranscriptionModel.doStream`), speaking the shared transcription-stream WebSocket envelope from `@ai-sdk/provider-utils`. `experimental_streamTranscribe` now works with gateway string model IDs, e.g. `experimental_streamTranscribe({ model: 'openai/gpt-realtime-whisper', ... })`.
+- Updated dependencies [4be62c1]
+- Updated dependencies [7805e4a]
+- Updated dependencies [cd12954]
+  - @ai-sdk/provider-utils@5.0.9
+
+## 4.0.18
+
+### Patch Changes
+
+- Updated dependencies [e193290]
+  - @ai-sdk/provider-utils@5.0.8
+
+## 4.0.17
+
+### Patch Changes
+
+- 867f80a: chore(provider/gateway): update gateway model settings files
+
 ## 4.0.16
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 import { LanguageModelV4, ProviderV4, EmbeddingModelV4, ImageModelV4, Experimental_VideoModelV4, RerankingModelV4, SpeechModelV4, TranscriptionModelV4, Experimental_RealtimeFactoryV4, TypeValidationError } from '@ai-sdk/provider';
 import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
-import { FetchFunction, InferSchema } from '@ai-sdk/provider-utils';
+import { FetchFunction, WebSocketConstructor, InferSchema } from '@ai-sdk/provider-utils';
 
-type GatewayModelId = 'alibaba/qwen-3-14b' | 'alibaba/qwen-3-235b' | 'alibaba/qwen-3-30b' | 'alibaba/qwen-3-32b' | 'alibaba/qwen-3.6-max-preview' | 'alibaba/qwen3-235b-a22b-thinking' | 'alibaba/qwen3-coder' | 'alibaba/qwen3-coder-30b-a3b' | 'alibaba/qwen3-coder-next' | 'alibaba/qwen3-coder-plus' | 'alibaba/qwen3-max' | 'alibaba/qwen3-max-preview' | 'alibaba/qwen3-max-thinking' | 'alibaba/qwen3-next-80b-a3b-instruct' | 'alibaba/qwen3-next-80b-a3b-thinking' | 'alibaba/qwen3-vl-235b-a22b-instruct' | 'alibaba/qwen3-vl-instruct' | 'alibaba/qwen3-vl-thinking' | 'alibaba/qwen3.5-flash' | 'alibaba/qwen3.5-plus' | 'alibaba/qwen3.6-27b' | 'alibaba/qwen3.6-plus' | 'alibaba/qwen3.7-max' | 'alibaba/qwen3.7-plus' | 'amazon/nova-2-lite' | 'amazon/nova-lite' | 'amazon/nova-micro' | 'amazon/nova-pro' | 'anthropic/claude-3-haiku' | 'anthropic/claude-3.5-haiku' | 'anthropic/claude-fable-5' | 'anthropic/claude-haiku-4.5' | 'anthropic/claude-opus-4' | 'anthropic/claude-opus-4.1' | 'anthropic/claude-opus-4.5' | 'anthropic/claude-opus-4.6' | 'anthropic/claude-opus-4.7' | 'anthropic/claude-opus-4.8' | 'anthropic/claude-sonnet-4' | 'anthropic/claude-sonnet-4.5' | 'anthropic/claude-sonnet-4.6' | 'anthropic/claude-sonnet-5' | 'arcee-ai/trinity-large-preview' | 'arcee-ai/trinity-large-thinking' | 'arcee-ai/trinity-mini' | 'bytedance/seed-1.6' | 'bytedance/seed-1.8' | 'cohere/command-a' | 'deepseek/deepseek-r1' | 'deepseek/deepseek-v3' | 'deepseek/deepseek-v3.1' | 'deepseek/deepseek-v3.1-terminus' | 'deepseek/deepseek-v3.2' | 'deepseek/deepseek-v3.2-thinking' | 'deepseek/deepseek-v4-flash' | 'deepseek/deepseek-v4-pro' | 'google/gemini-2.5-flash' | 'google/gemini-2.5-flash-image' | 'google/gemini-2.5-flash-lite' | 'google/gemini-2.5-pro' | 'google/gemini-3-flash' | 'google/gemini-3-pro-image' | 'google/gemini-3-pro-preview' | 'google/gemini-3.1-flash-image' | 'google/gemini-3.1-flash-image-preview' | 'google/gemini-3.1-flash-lite' | 'google/gemini-3.1-flash-lite-image' | 'google/gemini-3.1-flash-lite-preview' | 'google/gemini-3.1-pro-preview' | 'google/gemini-3.5-flash' | 'google/gemini-omni-flash-preview' | 'google/gemma-4-26b-a4b-it' | 'google/gemma-4-31b-it' | 'inception/mercury-2' | 'inception/mercury-coder-small' | 'interfaze/interfaze-beta' | 'kwaipilot/kat-coder-pro-v1' | 'kwaipilot/kat-coder-pro-v2' | 'meituan/longcat-flash-chat' | 'meituan/longcat-flash-thinking-2601' | 'meta/llama-3.1-70b' | 'meta/llama-3.1-8b' | 'meta/llama-3.2-11b' | 'meta/llama-3.2-1b' | 'meta/llama-3.2-3b' | 'meta/llama-3.2-90b' | 'meta/llama-3.3-70b' | 'meta/llama-4-maverick' | 'meta/llama-4-scout' | 'meta/muse-spark-1.1' | 'minimax/minimax-m2' | 'minimax/minimax-m2.1' | 'minimax/minimax-m2.1-lightning' | 'minimax/minimax-m2.5' | 'minimax/minimax-m2.5-highspeed' | 'minimax/minimax-m2.7' | 'minimax/minimax-m2.7-highspeed' | 'minimax/minimax-m3' | 'mistral/codestral' | 'mistral/devstral-2' | 'mistral/devstral-small' | 'mistral/devstral-small-2' | 'mistral/magistral-medium' | 'mistral/magistral-small' | 'mistral/ministral-14b' | 'mistral/ministral-3b' | 'mistral/ministral-8b' | 'mistral/mistral-large-3' | 'mistral/mistral-medium' | 'mistral/mistral-medium-3.5' | 'mistral/mistral-nemo' | 'mistral/mistral-small' | 'mistral/pixtral-12b' | 'mistral/pixtral-large' | 'moonshotai/kimi-k2' | 'moonshotai/kimi-k2-thinking' | 'moonshotai/kimi-k2.5' | 'moonshotai/kimi-k2.6' | 'moonshotai/kimi-k2.7-code' | 'moonshotai/kimi-k2.7-code-highspeed' | 'morph/morph-v3-fast' | 'morph/morph-v3-large' | 'nvidia/nemotron-3-nano-30b-a3b' | 'nvidia/nemotron-3-super-120b-a12b' | 'nvidia/nemotron-3-ultra-550b-a55b' | 'nvidia/nemotron-nano-12b-v2-vl' | 'nvidia/nemotron-nano-9b-v2' | 'openai/gpt-3.5-turbo' | 'openai/gpt-3.5-turbo-instruct' | 'openai/gpt-4-turbo' | 'openai/gpt-4.1' | 'openai/gpt-4.1-mini' | 'openai/gpt-4.1-nano' | 'openai/gpt-4o' | 'openai/gpt-4o-mini' | 'openai/gpt-4o-mini-search-preview' | 'openai/gpt-5' | 'openai/gpt-5-chat' | 'openai/gpt-5-codex' | 'openai/gpt-5-mini' | 'openai/gpt-5-nano' | 'openai/gpt-5-pro' | 'openai/gpt-5.1-codex' | 'openai/gpt-5.1-codex-max' | 'openai/gpt-5.1-codex-mini' | 'openai/gpt-5.1-instant' | 'openai/gpt-5.1-thinking' | 'openai/gpt-5.2' | 'openai/gpt-5.2-chat' | 'openai/gpt-5.2-codex' | 'openai/gpt-5.2-pro' | 'openai/gpt-5.3-chat' | 'openai/gpt-5.3-codex' | 'openai/gpt-5.4' | 'openai/gpt-5.4-mini' | 'openai/gpt-5.4-nano' | 'openai/gpt-5.4-pro' | 'openai/gpt-5.5' | 'openai/gpt-5.5-pro' | 'openai/gpt-5.6-luna' | 'openai/gpt-5.6-sol' | 'openai/gpt-5.6-terra' | 'openai/gpt-oss-120b' | 'openai/gpt-oss-20b' | 'openai/gpt-oss-safeguard-20b' | 'openai/o1' | 'openai/o3' | 'openai/o3-deep-research' | 'openai/o3-mini' | 'openai/o3-pro' | 'openai/o4-mini' | 'perplexity/sonar' | 'perplexity/sonar-pro' | 'perplexity/sonar-reasoning-pro' | 'sakana/fugu-ultra' | 'stepfun/step-3.5-flash' | 'stepfun/step-3.7-flash' | 'xai/grok-4.1-fast-non-reasoning' | 'xai/grok-4.1-fast-reasoning' | 'xai/grok-4.20-multi-agent' | 'xai/grok-4.20-multi-agent-beta' | 'xai/grok-4.20-non-reasoning' | 'xai/grok-4.20-non-reasoning-beta' | 'xai/grok-4.20-reasoning' | 'xai/grok-4.20-reasoning-beta' | 'xai/grok-4.3' | 'xai/grok-4.5' | 'xai/grok-build-0.1' | 'xiaomi/mimo-v2-flash' | 'xiaomi/mimo-v2-pro' | 'xiaomi/mimo-v2.5' | 'xiaomi/mimo-v2.5-pro' | 'zai/glm-4.5' | 'zai/glm-4.5-air' | 'zai/glm-4.5v' | 'zai/glm-4.6' | 'zai/glm-4.6v' | 'zai/glm-4.6v-flash' | 'zai/glm-4.7' | 'zai/glm-4.7-flash' | 'zai/glm-4.7-flashx' | 'zai/glm-5' | 'zai/glm-5-turbo' | 'zai/glm-5.1' | 'zai/glm-5.2' | 'zai/glm-5.2-fast' | 'zai/glm-5v-turbo' | (string & {});
+type GatewayModelId = 'alibaba/qwen-3-14b' | 'alibaba/qwen-3-235b' | 'alibaba/qwen-3-30b' | 'alibaba/qwen-3-32b' | 'alibaba/qwen-3.6-max-preview' | 'alibaba/qwen3-235b-a22b-thinking' | 'alibaba/qwen3-coder' | 'alibaba/qwen3-coder-30b-a3b' | 'alibaba/qwen3-coder-next' | 'alibaba/qwen3-coder-plus' | 'alibaba/qwen3-max' | 'alibaba/qwen3-max-preview' | 'alibaba/qwen3-max-thinking' | 'alibaba/qwen3-next-80b-a3b-instruct' | 'alibaba/qwen3-next-80b-a3b-thinking' | 'alibaba/qwen3-vl-235b-a22b-instruct' | 'alibaba/qwen3-vl-instruct' | 'alibaba/qwen3-vl-thinking' | 'alibaba/qwen3.5-flash' | 'alibaba/qwen3.5-plus' | 'alibaba/qwen3.6-27b' | 'alibaba/qwen3.6-plus' | 'alibaba/qwen3.7-max' | 'alibaba/qwen3.7-plus' | 'amazon/nova-2-lite' | 'amazon/nova-lite' | 'amazon/nova-micro' | 'amazon/nova-pro' | 'anthropic/claude-3-haiku' | 'anthropic/claude-3.5-haiku' | 'anthropic/claude-fable-5' | 'anthropic/claude-haiku-4.5' | 'anthropic/claude-opus-4' | 'anthropic/claude-opus-4.1' | 'anthropic/claude-opus-4.5' | 'anthropic/claude-opus-4.6' | 'anthropic/claude-opus-4.7' | 'anthropic/claude-opus-4.8' | 'anthropic/claude-sonnet-4' | 'anthropic/claude-sonnet-4.5' | 'anthropic/claude-sonnet-4.6' | 'anthropic/claude-sonnet-5' | 'arcee-ai/trinity-large-preview' | 'arcee-ai/trinity-large-thinking' | 'arcee-ai/trinity-mini' | 'bytedance/seed-1.6' | 'bytedance/seed-1.8' | 'cohere/command-a' | 'deepseek/deepseek-r1' | 'deepseek/deepseek-v3' | 'deepseek/deepseek-v3.1' | 'deepseek/deepseek-v3.1-terminus' | 'deepseek/deepseek-v3.2' | 'deepseek/deepseek-v3.2-thinking' | 'deepseek/deepseek-v4-flash' | 'deepseek/deepseek-v4-pro' | 'google/gemini-2.5-flash' | 'google/gemini-2.5-flash-image' | 'google/gemini-2.5-flash-lite' | 'google/gemini-2.5-pro' | 'google/gemini-3-flash' | 'google/gemini-3-pro-image' | 'google/gemini-3-pro-preview' | 'google/gemini-3.1-flash-image' | 'google/gemini-3.1-flash-image-preview' | 'google/gemini-3.1-flash-lite' | 'google/gemini-3.1-flash-lite-image' | 'google/gemini-3.1-flash-lite-preview' | 'google/gemini-3.1-pro-preview' | 'google/gemini-3.5-flash' | 'google/gemini-omni-flash-preview' | 'google/gemma-4-26b-a4b-it' | 'google/gemma-4-31b-it' | 'inception/mercury-2' | 'inception/mercury-coder-small' | 'interfaze/interfaze-beta' | 'kwaipilot/kat-coder-air-v2.5' | 'kwaipilot/kat-coder-pro-v1' | 'kwaipilot/kat-coder-pro-v2' | 'kwaipilot/kat-coder-pro-v2.5' | 'meituan/longcat-flash-chat' | 'meituan/longcat-flash-thinking-2601' | 'meta/llama-3.1-70b' | 'meta/llama-3.1-8b' | 'meta/llama-3.2-11b' | 'meta/llama-3.2-1b' | 'meta/llama-3.2-3b' | 'meta/llama-3.2-90b' | 'meta/llama-3.3-70b' | 'meta/llama-4-maverick' | 'meta/llama-4-scout' | 'meta/muse-spark-1.1' | 'minimax/minimax-m2' | 'minimax/minimax-m2.1' | 'minimax/minimax-m2.1-lightning' | 'minimax/minimax-m2.5' | 'minimax/minimax-m2.5-highspeed' | 'minimax/minimax-m2.7' | 'minimax/minimax-m2.7-highspeed' | 'minimax/minimax-m3' | 'mistral/codestral' | 'mistral/devstral-2' | 'mistral/devstral-small' | 'mistral/devstral-small-2' | 'mistral/magistral-medium' | 'mistral/magistral-small' | 'mistral/ministral-14b' | 'mistral/ministral-3b' | 'mistral/ministral-8b' | 'mistral/mistral-large-3' | 'mistral/mistral-medium' | 'mistral/mistral-medium-3.5' | 'mistral/mistral-nemo' | 'mistral/mistral-small' | 'mistral/pixtral-12b' | 'mistral/pixtral-large' | 'moonshotai/kimi-k2' | 'moonshotai/kimi-k2-thinking' | 'moonshotai/kimi-k2.5' | 'moonshotai/kimi-k2.6' | 'moonshotai/kimi-k2.7-code' | 'moonshotai/kimi-k2.7-code-highspeed' | 'morph/morph-v3-fast' | 'morph/morph-v3-large' | 'nvidia/nemotron-3-nano-30b-a3b' | 'nvidia/nemotron-3-super-120b-a12b' | 'nvidia/nemotron-3-ultra-550b-a55b' | 'nvidia/nemotron-nano-12b-v2-vl' | 'nvidia/nemotron-nano-9b-v2' | 'openai/gpt-3.5-turbo' | 'openai/gpt-3.5-turbo-instruct' | 'openai/gpt-4-turbo' | 'openai/gpt-4.1' | 'openai/gpt-4.1-mini' | 'openai/gpt-4.1-nano' | 'openai/gpt-4o' | 'openai/gpt-4o-mini' | 'openai/gpt-4o-mini-search-preview' | 'openai/gpt-5' | 'openai/gpt-5-chat' | 'openai/gpt-5-codex' | 'openai/gpt-5-mini' | 'openai/gpt-5-nano' | 'openai/gpt-5-pro' | 'openai/gpt-5.1-codex' | 'openai/gpt-5.1-codex-max' | 'openai/gpt-5.1-codex-mini' | 'openai/gpt-5.1-instant' | 'openai/gpt-5.1-thinking' | 'openai/gpt-5.2' | 'openai/gpt-5.2-chat' | 'openai/gpt-5.2-codex' | 'openai/gpt-5.2-pro' | 'openai/gpt-5.3-chat' | 'openai/gpt-5.3-codex' | 'openai/gpt-5.4' | 'openai/gpt-5.4-mini' | 'openai/gpt-5.4-nano' | 'openai/gpt-5.4-pro' | 'openai/gpt-5.5' | 'openai/gpt-5.5-pro' | 'openai/gpt-5.6-luna' | 'openai/gpt-5.6-sol' | 'openai/gpt-5.6-terra' | 'openai/gpt-oss-120b' | 'openai/gpt-oss-20b' | 'openai/gpt-oss-safeguard-20b' | 'openai/o1' | 'openai/o3' | 'openai/o3-deep-research' | 'openai/o3-mini' | 'openai/o3-pro' | 'openai/o4-mini' | 'perplexity/sonar' | 'perplexity/sonar-pro' | 'perplexity/sonar-reasoning-pro' | 'sakana/fugu-ultra' | 'stepfun/step-3.5-flash' | 'stepfun/step-3.7-flash' | 'xai/grok-4.1-fast-non-reasoning' | 'xai/grok-4.1-fast-reasoning' | 'xai/grok-4.20-multi-agent' | 'xai/grok-4.20-multi-agent-beta' | 'xai/grok-4.20-non-reasoning' | 'xai/grok-4.20-non-reasoning-beta' | 'xai/grok-4.20-reasoning' | 'xai/grok-4.20-reasoning-beta' | 'xai/grok-4.3' | 'xai/grok-4.5' | 'xai/grok-build-0.1' | 'xiaomi/mimo-v2-flash' | 'xiaomi/mimo-v2-pro' | 'xiaomi/mimo-v2.5' | 'xiaomi/mimo-v2.5-pro' | 'zai/glm-4.5' | 'zai/glm-4.5-air' | 'zai/glm-4.5v' | 'zai/glm-4.6' | 'zai/glm-4.6v' | 'zai/glm-4.6v-flash' | 'zai/glm-4.7' | 'zai/glm-4.7-flash' | 'zai/glm-4.7-flashx' | 'zai/glm-5' | 'zai/glm-5-turbo' | 'zai/glm-5.1' | 'zai/glm-5.2' | 'zai/glm-5.2-fast' | 'zai/glm-5v-turbo' | (string & {});
 
 /**
- * Shared WebSocket subprotocol contract for AI Gateway realtime auth.
+ * Shared WebSocket subprotocol contract for AI Gateway realtime and streaming
+ * transcription auth.
  *
  * The browser `WebSocket` API cannot set request headers, so the Gateway auth
  * (bearer) token is carried through the `Sec-WebSocket-Protocol` handshake
@@ -14,8 +15,9 @@ type GatewayModelId = 'alibaba/qwen-3-14b' | 'alibaba/qwen-3-235b' | 'alibaba/qw
  *
  * This module is the single source of truth for that contract so the client and
  * the Gateway server can't drift: the client encodes values with
- * `getGatewayRealtimeProtocols`, and the Gateway server decodes them with
- * `getGatewayRealtimeAuthToken` / `getGatewayRealtimeTeamIdOrSlug`.
+ * `getGatewayRealtimeProtocols` / `getGatewayTranscriptionProtocols`, and the
+ * Gateway server decodes them with `getGatewayRealtimeAuthToken` /
+ * `getGatewayRealtimeTeamIdOrSlug`.
  *
  * WebSocket subprotocol values must fit the RFC token grammar. The auth token is
  * sent as-is, so callers must use tokens that are valid subprotocol tokens; the
@@ -24,11 +26,16 @@ type GatewayModelId = 'alibaba/qwen-3-14b' | 'alibaba/qwen-3-235b' | 'alibaba/qw
  * budget) because intermediaries may reject large upgrade headers.
  */
 /**
- * Marker subprotocol offered on every handshake so the Gateway can echo a
- * negotiated subprotocol on the 101 response (some clients require the server to
- * select one of the offered subprotocols).
+ * Marker subprotocol offered on every realtime handshake so the Gateway can
+ * echo a negotiated subprotocol on the 101 response (some clients require the
+ * server to select one of the offered subprotocols).
  */
 declare const GATEWAY_REALTIME_SUBPROTOCOL = "ai-gateway-realtime.v1";
+/**
+ * Marker subprotocol for streaming transcription handshakes (same negotiation
+ * purpose as `GATEWAY_REALTIME_SUBPROTOCOL`).
+ */
+declare const GATEWAY_TRANSCRIPTION_SUBPROTOCOL = "ai-gateway-transcription.v1";
 /** Subprotocol prefix that carries the Gateway auth (bearer) token. */
 declare const GATEWAY_AUTH_SUBPROTOCOL_PREFIX = "ai-gateway-auth.";
 /** Subprotocol prefix that carries optional Vercel team scoping. */
@@ -40,6 +47,13 @@ declare const GATEWAY_TEAM_SUBPROTOCOL_PREFIX = "ai-gateway-team.";
 declare function getGatewayRealtimeProtocols(token: string, options?: {
     teamIdOrSlug?: string;
 }): string[];
+/**
+ * Client-side: `getGatewayRealtimeProtocols`, but with the streaming
+ * transcription marker subprotocol.
+ */
+declare function getGatewayTranscriptionProtocols(token: string, options?: {
+    teamIdOrSlug?: string;
+}): string[];
 /**
  * Server-side: extract the Gateway auth (bearer) token from a
  * `Sec-WebSocket-Protocol` header value, or `undefined` when it is absent or
@@ -57,13 +71,13 @@ declare function getGatewayRealtimeAuthToken(secWebSocketProtocol: string | null
  */
 declare function getGatewayRealtimeTeamIdOrSlug(secWebSocketProtocol: string | null | undefined): string | undefined;
 
-type GatewayRealtimeModelId = 'openai/gpt-realtime-1.5' | 'openai/gpt-realtime-2' | 'openai/gpt-realtime-mini' | 'xai/grok-voice-think-fast-1.0' | (string & {});
+type GatewayRealtimeModelId = 'openai/gpt-realtime-1.5' | 'openai/gpt-realtime-2' | 'openai/gpt-realtime-2.1' | 'openai/gpt-realtime-mini' | 'xai/grok-voice-think-fast-1.0' | (string & {});
 
 type GatewayRerankingModelId = 'cohere/rerank-v3.5' | 'cohere/rerank-v4-fast' | 'cohere/rerank-v4-pro' | 'voyage/rerank-2.5' | 'voyage/rerank-2.5-lite' | (string & {});
 
 type GatewaySpeechModelId = 'openai/tts-1' | 'openai/tts-1-hd' | 'xai/grok-tts' | (string & {});
 
-type GatewayTranscriptionModelId = 'openai/gpt-4o-mini-transcribe' | 'openai/gpt-4o-transcribe' | 'openai/whisper-1' | 'xai/grok-stt' | (string & {});
+type GatewayTranscriptionModelId = 'openai/gpt-4o-mini-transcribe' | 'openai/gpt-4o-transcribe' | 'openai/gpt-realtime-whisper' | 'openai/whisper-1' | 'xai/grok-stt' | (string & {});
 
 type GatewayVideoModelId = 'alibaba/wan-v2.5-t2v-preview' | 'alibaba/wan-v2.6-i2v' | 'alibaba/wan-v2.6-i2v-flash' | 'alibaba/wan-v2.6-r2v' | 'alibaba/wan-v2.6-r2v-flash' | 'alibaba/wan-v2.6-t2v' | 'alibaba/wan-v2.7-r2v' | 'alibaba/wan-v2.7-t2v' | 'bytedance/seedance-2.0' | 'bytedance/seedance-2.0-fast' | 'bytedance/seedance-v1.0-pro' | 'bytedance/seedance-v1.0-pro-fast' | 'bytedance/seedance-v1.5-pro' | 'google/veo-3.0-fast-generate-001' | 'google/veo-3.0-generate-001' | 'google/veo-3.1-fast-generate-001' | 'google/veo-3.1-generate-001' | 'klingai/kling-v2.5-turbo-i2v' | 'klingai/kling-v2.5-turbo-t2v' | 'klingai/kling-v2.6-i2v' | 'klingai/kling-v2.6-motion-control' | 'klingai/kling-v2.6-t2v' | 'klingai/kling-v3.0-i2v' | 'klingai/kling-v3.0-motion-control' | 'klingai/kling-v3.0-t2v' | 'xai/grok-imagine-video' | 'xai/grok-imagine-video-1.5' | 'xai/grok-imagine-video-1.5-preview' | (string & {});
 
@@ -228,7 +242,7 @@ interface GatewayGenerationInfo {
 
 type GatewayEmbeddingModelId = 'alibaba/qwen3-embedding-0.6b' | 'alibaba/qwen3-embedding-4b' | 'alibaba/qwen3-embedding-8b' | 'amazon/titan-embed-text-v2' | 'cohere/embed-v4.0' | 'google/gemini-embedding-001' | 'google/gemini-embedding-2' | 'google/text-embedding-005' | 'google/text-multilingual-embedding-002' | 'mistral/codestral-embed' | 'mistral/mistral-embed' | 'openai/text-embedding-3-large' | 'openai/text-embedding-3-small' | 'openai/text-embedding-ada-002' | 'voyage/voyage-3-large' | 'voyage/voyage-3.5' | 'voyage/voyage-3.5-lite' | 'voyage/voyage-4' | 'voyage/voyage-4-large' | 'voyage/voyage-4-lite' | 'voyage/voyage-code-2' | 'voyage/voyage-code-3' | 'voyage/voyage-finance-2' | 'voyage/voyage-law-2' | (string & {});
 
-type GatewayImageModelId = 'bfl/flux-2-flex' | 'bfl/flux-2-klein-4b' | 'bfl/flux-2-klein-9b' | 'bfl/flux-2-max' | 'bfl/flux-2-pro' | 'bfl/flux-kontext-max' | 'bfl/flux-kontext-pro' | 'bfl/flux-pro-1.0-fill' | 'bfl/flux-pro-1.1' | 'bfl/flux-pro-1.1-ultra' | 'bytedance/seedream-4.0' | 'bytedance/seedream-4.5' | 'bytedance/seedream-5.0-lite' | 'google/imagen-4.0-fast-generate-001' | 'google/imagen-4.0-generate-001' | 'google/imagen-4.0-ultra-generate-001' | 'openai/gpt-image-1' | 'openai/gpt-image-1-mini' | 'openai/gpt-image-1.5' | 'openai/gpt-image-2' | 'prodia/flux-fast-schnell' | 'quiverai/arrow-1.1' | 'recraft/recraft-v2' | 'recraft/recraft-v3' | 'recraft/recraft-v4' | 'recraft/recraft-v4-pro' | 'recraft/recraft-v4.1' | 'recraft/recraft-v4.1-pro' | 'recraft/recraft-v4.1-utility' | 'recraft/recraft-v4.1-utility-pro' | 'xai/grok-imagine-image' | (string & {});
+type GatewayImageModelId = 'bfl/flux-2-flex' | 'bfl/flux-2-klein-4b' | 'bfl/flux-2-klein-9b' | 'bfl/flux-2-max' | 'bfl/flux-2-pro' | 'bfl/flux-kontext-max' | 'bfl/flux-kontext-pro' | 'bfl/flux-pro-1.0-fill' | 'bfl/flux-pro-1.1' | 'bfl/flux-pro-1.1-ultra' | 'bytedance/seedream-4.0' | 'bytedance/seedream-4.5' | 'bytedance/seedream-5.0-lite' | 'bytedance/seedream-5.0-pro' | 'google/imagen-4.0-fast-generate-001' | 'google/imagen-4.0-generate-001' | 'google/imagen-4.0-ultra-generate-001' | 'openai/gpt-image-1' | 'openai/gpt-image-1-mini' | 'openai/gpt-image-1.5' | 'openai/gpt-image-2' | 'prodia/flux-fast-schnell' | 'quiverai/arrow-1.1' | 'recraft/recraft-v2' | 'recraft/recraft-v3' | 'recraft/recraft-v4' | 'recraft/recraft-v4-pro' | 'recraft/recraft-v4.1' | 'recraft/recraft-v4.1-pro' | 'recraft/recraft-v4.1-utility' | 'recraft/recraft-v4.1-utility-pro' | 'xai/grok-imagine-image' | (string & {});
 
 interface PerplexitySearchConfig {
     /**
@@ -763,6 +777,13 @@ interface GatewayProviderSettings {
      * or to provide a custom fetch implementation for e.g. testing.
      */
     fetch?: FetchFunction;
+    /**
+     * Custom WebSocket implementation used for streaming transcription. This is
+     * useful for testing or for runtimes without a global WebSocket. A
+     * header-capable implementation is not required — Gateway WebSocket auth is
+     * carried in the subprotocols.
+     */
+    webSocket?: WebSocketConstructor;
     /**
      * How frequently to refresh the metadata cache in milliseconds.
      */
@@ -1013,4 +1034,4 @@ declare class GatewayResponseError extends GatewayError {
 
 declare const VERSION: string;
 
-export { GATEWAY_AUTH_SUBPROTOCOL_PREFIX, GATEWAY_REALTIME_SUBPROTOCOL, GATEWAY_TEAM_SUBPROTOCOL_PREFIX, GatewayAuthenticationError, type GatewayCreditsResponse, GatewayError, type GatewayErrorResponse, GatewayFailedDependencyError, GatewayForbiddenError, type GatewayGenerationInfo, type GatewayGenerationInfoParams, GatewayInternalServerError, GatewayInvalidRequestError, type GatewayLanguageModelEntry, type GatewayProviderOptions as GatewayLanguageModelOptions, type GatewayLanguageModelSpecification, type GatewayLanguageModelEntry as GatewayModelEntry, type GatewayModelId, GatewayModelNotFoundError, type GatewayProvider, type GatewayProviderOptions, type GatewayProviderSettings, GatewayRateLimitError, type GatewayRealtimeModelId, type GatewayRerankingModelId, GatewayResponseError, type GatewaySpeechModelId, type GatewaySpendReportParams, type GatewaySpendReportResponse, type GatewaySpendReportRow, type GatewayTranscriptionModelId, type GatewayVideoModelId, VERSION, createGateway, createGateway as createGatewayProvider, gateway, getGatewayRealtimeAuthToken, getGatewayRealtimeProtocols, getGatewayRealtimeTeamIdOrSlug };
+export { GATEWAY_AUTH_SUBPROTOCOL_PREFIX, GATEWAY_REALTIME_SUBPROTOCOL, GATEWAY_TEAM_SUBPROTOCOL_PREFIX, GATEWAY_TRANSCRIPTION_SUBPROTOCOL, GatewayAuthenticationError, type GatewayCreditsResponse, GatewayError, type GatewayErrorResponse, GatewayFailedDependencyError, GatewayForbiddenError, type GatewayGenerationInfo, type GatewayGenerationInfoParams, GatewayInternalServerError, GatewayInvalidRequestError, type GatewayLanguageModelEntry, type GatewayProviderOptions as GatewayLanguageModelOptions, type GatewayLanguageModelSpecification, type GatewayLanguageModelEntry as GatewayModelEntry, type GatewayModelId, GatewayModelNotFoundError, type GatewayProvider, type GatewayProviderOptions, type GatewayProviderSettings, GatewayRateLimitError, type GatewayRealtimeModelId, type GatewayRerankingModelId, GatewayResponseError, type GatewaySpeechModelId, type GatewaySpendReportParams, type GatewaySpendReportResponse, type GatewaySpendReportRow, type GatewayTranscriptionModelId, type GatewayVideoModelId, VERSION, createGateway, createGateway as createGatewayProvider, gateway, getGatewayRealtimeAuthToken, getGatewayRealtimeProtocols, getGatewayRealtimeTeamIdOrSlug, getGatewayTranscriptionProtocols };

package/dist/index.js

@@ -1,12 +1,20 @@
 // src/gateway-realtime-auth.ts
 var GATEWAY_REALTIME_SUBPROTOCOL = "ai-gateway-realtime.v1";
+var GATEWAY_TRANSCRIPTION_SUBPROTOCOL = "ai-gateway-transcription.v1";
 var GATEWAY_AUTH_SUBPROTOCOL_PREFIX = "ai-gateway-auth.";
 var GATEWAY_TEAM_SUBPROTOCOL_PREFIX = "ai-gateway-team.";
 function getGatewayRealtimeProtocols(token, options) {
-  const protocols = [
-    GATEWAY_REALTIME_SUBPROTOCOL,
-    `${GATEWAY_AUTH_SUBPROTOCOL_PREFIX}${token}`
-  ];
+  return buildGatewayProtocols(GATEWAY_REALTIME_SUBPROTOCOL, token, options);
+}
+function getGatewayTranscriptionProtocols(token, options) {
+  return buildGatewayProtocols(
+    GATEWAY_TRANSCRIPTION_SUBPROTOCOL,
+    token,
+    options
+  );
+}
+function buildGatewayProtocols(marker11, token, options) {
+  const protocols = [marker11, `${GATEWAY_AUTH_SUBPROTOCOL_PREFIX}${token}`];
   if (options == null ? void 0 : options.teamIdOrSlug) {
     protocols.push(
       `${GATEWAY_TEAM_SUBPROTOCOL_PREFIX}${encodeSubprotocolValue(options.teamIdOrSlug)}`
@@ -641,6 +649,7 @@ var GatewayFetchMetadata = class {
     try {
       const { value } = await getFromApi({
         url: `${this.config.baseURL}/config`,
+        validateUrl: false,
         headers: this.config.headers ? await resolve(this.config.headers) : void 0,
         successfulResponseHandler: createJsonResponseHandler(
           gatewayAvailableModelsResponseSchema
@@ -661,6 +670,7 @@ var GatewayFetchMetadata = class {
       const baseUrl = new URL(this.config.baseURL);
       const { value } = await getFromApi({
         url: `${baseUrl.origin}/v1/credits`,
+        validateUrl: false,
         headers: this.config.headers ? await resolve(this.config.headers) : void 0,
         successfulResponseHandler: createJsonResponseHandler(
           gatewayCreditsResponseSchema
@@ -768,6 +778,7 @@ var GatewaySpendReport = class {
       }
       const { value } = await getFromApi2({
         url: `${baseUrl.origin}/v1/report?${searchParams.toString()}`,
+        validateUrl: false,
         headers: this.config.headers ? await resolve2(this.config.headers) : void 0,
         successfulResponseHandler: createJsonResponseHandler2(
           gatewaySpendReportResponseSchema
@@ -853,6 +864,7 @@ var GatewayGenerationInfoFetcher = class {
       const baseUrl = new URL(this.config.baseURL);
       const { value } = await getFromApi3({
         url: `${baseUrl.origin}/v1/generation?id=${encodeURIComponent(params.id)}`,
+        validateUrl: false,
         headers: this.config.headers ? await resolve3(this.config.headers) : void 0,
         successfulResponseHandler: createJsonResponseHandler3(
           gatewayGenerationInfoResponseSchema
@@ -1865,13 +1877,23 @@ var gatewaySpeechResponseSchema = z13.object({
 });
 
 // src/gateway-transcription-model.ts
+import {
+  getErrorMessage
+} from "@ai-sdk/provider";
 import {
   combineHeaders as combineHeaders7,
+  convertBase64ToUint8Array,
   convertUint8ArrayToBase64 as convertUint8ArrayToBase643,
   createJsonErrorResponseHandler as createJsonErrorResponseHandler10,
   createJsonResponseHandler as createJsonResponseHandler9,
+  connectToWebSocket,
+  normalizeHeaders,
+  experimental_parseTranscriptionStreamPart as parseTranscriptionStreamPart,
   postJsonToApi as postJsonToApi7,
-  resolve as resolve10
+  resolve as resolve10,
+  EXPERIMENTAL_TRANSCRIPTION_STREAM_AUDIO_DONE_FRAME_TYPE as TRANSCRIPTION_STREAM_AUDIO_DONE_FRAME_TYPE,
+  waitForWebSocketBufferDrain,
+  EXPERIMENTAL_TRANSCRIPTION_STREAM_START_FRAME_TYPE as TRANSCRIPTION_STREAM_START_FRAME_TYPE
 } from "@ai-sdk/provider-utils";
 import { z as z14 } from "zod/v4";
 var GatewayTranscriptionModel = class {
@@ -1941,6 +1963,41 @@ var GatewayTranscriptionModel = class {
       );
     }
   }
+  async doStream(options) {
+    var _a11, _b11, _c, _d, _e;
+    const currentDate = (_c = (_b11 = (_a11 = this.config._internal) == null ? void 0 : _a11.currentDate) == null ? void 0 : _b11.call(_a11)) != null ? _c : /* @__PURE__ */ new Date();
+    const headers = combineHeaders7(
+      await resolve10((_d = this.config.headers) != null ? _d : {}),
+      (_e = options.headers) != null ? _e : {},
+      this.getModelConfigHeaders(),
+      await resolve10(this.config.o11yHeaders)
+    );
+    const authMethod = await parseAuthMethod(headers);
+    const startFrame = {
+      type: TRANSCRIPTION_STREAM_START_FRAME_TYPE,
+      inputAudioFormat: options.inputAudioFormat,
+      ...options.providerOptions != null && {
+        providerOptions: options.providerOptions
+      },
+      ...options.includeRawChunks != null && {
+        includeRawChunks: options.includeRawChunks
+      }
+    };
+    return {
+      stream: createGatewayTranscriptionStream({
+        webSocket: this.config.webSocket,
+        url: toGatewayTranscriptionUrl(this.config.baseURL, this.modelId),
+        protocols: getProtocolsFromHeaders(headers),
+        headers,
+        startFrame,
+        audio: options.audio,
+        abortSignal: options.abortSignal,
+        authMethod
+      }),
+      request: { body: startFrame },
+      response: { timestamp: currentDate, modelId: this.modelId }
+    };
+  }
   getUrl() {
     return `${this.config.baseURL}/transcription-model`;
   }
@@ -1951,6 +2008,163 @@ var GatewayTranscriptionModel = class {
     };
   }
 };
+function toGatewayTranscriptionUrl(baseURL, modelId) {
+  const url = new URL(`${baseURL.replace(/^http/, "ws")}/transcription-model`);
+  url.searchParams.set("ai-model-id", modelId);
+  return url.toString();
+}
+function getProtocolsFromHeaders(headers) {
+  const normalizedHeaders = normalizeHeaders(headers);
+  const authorization = normalizedHeaders.authorization;
+  const token = (authorization == null ? void 0 : authorization.startsWith("Bearer ")) ? authorization.slice("Bearer ".length) : void 0;
+  return token == null ? [GATEWAY_TRANSCRIPTION_SUBPROTOCOL] : getGatewayTranscriptionProtocols(token, {
+    teamIdOrSlug: normalizedHeaders[VERCEL_AI_GATEWAY_TEAM_HEADER]
+  });
+}
+var MAX_AUDIO_FRAME_BYTES = 64 * 1024;
+function createGatewayTranscriptionStream({
+  webSocket,
+  url,
+  protocols,
+  headers,
+  startFrame,
+  audio,
+  abortSignal,
+  authMethod
+}) {
+  let finished = false;
+  let cleanup = () => {
+  };
+  return new ReadableStream({
+    start: (controller) => {
+      let audioReader;
+      let hasServerErrorPart = false;
+      let lastServerError;
+      let audioStopped = false;
+      let connection;
+      cleanup = (closeCode) => {
+        if (audioReader != null) {
+          void audioReader.cancel().catch(() => {
+          });
+        } else {
+          void audio.cancel().catch(() => {
+          });
+        }
+        connection == null ? void 0 : connection.close(closeCode);
+      };
+      const stopAudio = () => {
+        audioStopped = true;
+        if (audioReader != null) {
+          void audioReader.cancel().catch(() => {
+          });
+          audioReader = void 0;
+        } else {
+          void audio.cancel().catch(() => {
+          });
+        }
+      };
+      const finishWithError = (error) => {
+        if (finished) return;
+        finished = true;
+        cleanup();
+        void errorControllerWithGatewayError(controller, error, authMethod);
+      };
+      const sendAudio = async (socket) => {
+        const reader = audio.getReader();
+        audioReader = reader;
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done || finished) break;
+            const bytes = typeof value === "string" ? convertBase64ToUint8Array(value) : value;
+            for (let offset = 0; offset < bytes.length; offset += MAX_AUDIO_FRAME_BYTES) {
+              if (finished) break;
+              socket.send(
+                bytes.subarray(offset, offset + MAX_AUDIO_FRAME_BYTES)
+              );
+              await waitForWebSocketBufferDrain(socket);
+            }
+          }
+        } finally {
+          reader.releaseLock();
+          if (audioReader === reader) {
+            audioReader = void 0;
+          }
+        }
+        if (!finished && !audioStopped) {
+          socket.send(
+            JSON.stringify({
+              type: TRANSCRIPTION_STREAM_AUDIO_DONE_FRAME_TYPE
+            })
+          );
+        }
+      };
+      connection = connectToWebSocket({
+        url,
+        protocols,
+        headers,
+        webSocket,
+        abortSignal,
+        onAbort: (reason) => {
+          if (finished) return;
+          finished = true;
+          cleanup();
+          controller.error(reason);
+        },
+        onProcessingError: finishWithError,
+        onOpen: (socket) => {
+          socket.send(JSON.stringify(startFrame));
+          void sendAudio(socket).catch(finishWithError);
+        },
+        // Server frames are envelope-serialized stream parts; the codec
+        // handles parsing, unknown-part skipping, and timestamp revival.
+        onMessageText: (text) => {
+          if (finished) return;
+          const part = parseTranscriptionStreamPart(text);
+          if (part == null) return;
+          if (part.type === "finish") {
+            finished = true;
+            controller.enqueue(part);
+            controller.close();
+            cleanup(1e3);
+            return;
+          }
+          if (part.type === "error") {
+            hasServerErrorPart = true;
+            lastServerError = part.error;
+            stopAudio();
+          }
+          controller.enqueue(part);
+        },
+        onSocketError: () => {
+          finishWithError(
+            new Error("Connection error on AI Gateway transcription stream")
+          );
+        },
+        onClose: () => {
+          if (hasServerErrorPart) {
+            if (finished) return;
+            void createErrorFromServerErrorPart(
+              lastServerError,
+              authMethod
+            ).then(finishWithError);
+            return;
+          }
+          finishWithError(
+            new Error(
+              "AI Gateway transcription stream closed before a finish part was received"
+            )
+          );
+        }
+      });
+    },
+    cancel: () => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+    }
+  });
+}
 var providerMetadataEntrySchema4 = z14.object({}).catchall(z14.unknown());
 var gatewayTranscriptionWarningSchema = z14.discriminatedUnion("type", [
   z14.object({
@@ -1987,6 +2201,36 @@ var gatewayTranscriptionResponseSchema = z14.object({
   warnings: z14.array(gatewayTranscriptionWarningSchema).optional(),
   providerMetadata: z14.record(z14.string(), providerMetadataEntrySchema4).optional()
 });
+async function errorControllerWithGatewayError(controller, error, authMethod) {
+  controller.error(await asGatewayError(error, authMethod));
+}
+function getServerErrorMessage(error) {
+  if (error != null && typeof error === "object" && "message" in error && typeof error.message === "string") {
+    return error.message;
+  }
+  return getErrorMessage(error);
+}
+var SERVER_ERROR_STATUS_CODES = {
+  authentication_error: 401,
+  failed_dependency: 424,
+  forbidden: 403,
+  internal_server_error: 500,
+  invalid_request_error: 400,
+  model_not_found: 404,
+  rate_limit_exceeded: 429
+};
+async function createErrorFromServerErrorPart(error, authMethod) {
+  if (typeof error === "object" && error != null && "message" in error && typeof error.message === "string" && "type" in error && typeof error.type === "string" && error.type in SERVER_ERROR_STATUS_CODES) {
+    return createGatewayErrorFromResponse({
+      response: { error: { message: error.message, type: error.type } },
+      statusCode: SERVER_ERROR_STATUS_CODES[error.type],
+      authMethod
+    });
+  }
+  return new Error(
+    `AI Gateway transcription stream failed: ${getServerErrorMessage(error)}`
+  );
+}
 
 // src/gateway-realtime-model.ts
 var GatewayRealtimeModel = class {
@@ -2387,7 +2631,7 @@ async function getVercelRequestId() {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.16" : "0.0.0-test";
+var VERSION = true ? "4.0.19" : "0.0.0-test";
 
 // src/gateway-provider.ts
 var AI_GATEWAY_PROTOCOL_VERSION = "0.0.1";
@@ -2633,7 +2877,8 @@ function createGateway(options = {}) {
       baseURL,
       headers: getHeaders,
       fetch: options.fetch,
-      o11yHeaders: createO11yHeaders()
+      o11yHeaders: createO11yHeaders(),
+      webSocket: options.webSocket
     });
   };
   provider.transcriptionModel = createTranscriptionModel;
@@ -2695,6 +2940,7 @@ export {
   GATEWAY_AUTH_SUBPROTOCOL_PREFIX,
   GATEWAY_REALTIME_SUBPROTOCOL,
   GATEWAY_TEAM_SUBPROTOCOL_PREFIX,
+  GATEWAY_TRANSCRIPTION_SUBPROTOCOL,
   GatewayAuthenticationError,
   GatewayError,
   GatewayFailedDependencyError,
@@ -2710,6 +2956,7 @@ export {
   gateway,
   getGatewayRealtimeAuthToken,
   getGatewayRealtimeProtocols,
-  getGatewayRealtimeTeamIdOrSlug
+  getGatewayRealtimeTeamIdOrSlug,
+  getGatewayTranscriptionProtocols
 };
 //# sourceMappingURL=index.js.map