@ai-sdk/gateway 4.0.20 → 4.0.22

package/docs/00-ai-gateway.mdx

@@ -1065,7 +1065,7 @@ The following gateway provider options are available:
   per-provider option each provider expects, and overrides any tier
   also set in the per-provider options. Leave unset for provider
   default. See the [OpenAI](/providers/ai-sdk-providers/openai),
-  [Google Generative AI](/providers/ai-sdk-providers/google-generative-ai),
+  [Google Generative AI](/providers/ai-sdk-providers/google),
   and [Google Vertex AI](/providers/ai-sdk-providers/google-vertex)
   provider docs for tier semantics, model availability, and graceful
   downgrade behavior on each provider.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ai-sdk/gateway",
   "private": false,
-  "version": "4.0.20",
+  "version": "4.0.22",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,

package/src/gateway-language-model-settings.ts

@@ -35,7 +35,9 @@ export type GatewayModelId =
   | 'anthropic/claude-opus-4.5'
   | 'anthropic/claude-opus-4.6'
   | 'anthropic/claude-opus-4.7'
+  | 'anthropic/claude-opus-4.7-fast'
   | 'anthropic/claude-opus-4.8'
+  | 'anthropic/claude-opus-4.8-fast'
   | 'anthropic/claude-sonnet-4'
   | 'anthropic/claude-sonnet-4.5'
   | 'anthropic/claude-sonnet-4.6'
@@ -115,6 +117,7 @@ export type GatewayModelId =
   | 'moonshotai/kimi-k2.6'
   | 'moonshotai/kimi-k2.7-code'
   | 'moonshotai/kimi-k2.7-code-highspeed'
+  | 'moonshotai/kimi-k3'
   | 'morph/morph-v3-fast'
   | 'morph/morph-v3-large'
   | 'nvidia/nemotron-3-nano-30b-a3b'
@@ -171,6 +174,7 @@ export type GatewayModelId =
   | 'sakana/fugu-ultra'
   | 'stepfun/step-3.5-flash'
   | 'stepfun/step-3.7-flash'
+  | 'thinkingmachines/inkling'
   | 'xai/grok-4.1-fast-non-reasoning'
   | 'xai/grok-4.1-fast-reasoning'
   | 'xai/grok-4.20-multi-agent'

package/src/gateway-provider.ts

@@ -36,7 +36,10 @@ import { GatewayImageModel } from './gateway-image-model';
 import { GatewayVideoModel } from './gateway-video-model';
 import { GatewayRerankingModel } from './gateway-reranking-model';
 import { GatewaySpeechModel } from './gateway-speech-model';
-import { GatewayTranscriptionModel } from './gateway-transcription-model';
+import {
+  GatewayTranscriptionModel,
+  toGatewayTranscriptionUrl,
+} from './gateway-transcription-model';
 import { GatewayRealtimeModel } from './gateway-realtime-model';
 import type { GatewayEmbeddingModelId } from './gateway-embedding-model-settings';
 import type { GatewayImageModelId } from './gateway-image-model-settings';
@@ -174,12 +177,50 @@ export interface GatewayProvider extends ProviderV4 {
    */
   experimental_realtime: RealtimeFactoryV4;
 
+  /**
+   * Experimental streaming-transcription entry point. Callable like
+   * `transcription(modelId)`, plus `getToken` for minting a short-lived
+   * client secret (`vcst_`) a browser can use to open the streaming
+   * transcription WebSocket without holding the Gateway credential.
+   */
+  experimental_transcription: GatewayTranscriptionFactory;
+
   /**
    * Gateway-specific tools executed server-side.
    */
   tools: typeof gatewayTools;
 }
 
+export type GatewayTranscriptionFactoryGetTokenOptions = {
+  model: GatewayTranscriptionModelId;
+  /** Token lifetime in seconds. Gateway default is 60s (max 300s). */
+  expiresAfterSeconds?: number;
+};
+
+export type GatewayTranscriptionFactoryGetTokenResult = {
+  /** The minted `vcst_` client secret. */
+  token: string;
+  /** WebSocket URL of the streaming transcription surface for this model. */
+  url: string;
+  /** Token expiry, epoch seconds. */
+  expiresAt?: number;
+};
+
+/**
+ * Streaming-transcription factory: callable like `transcription(modelId)`,
+ * plus a server-side `getToken` that mints a transcription-bound short-lived
+ * client secret (`vcst_`). The browser connects with
+ * `createGateway({ apiKey: token }).transcription(modelId)` — the token rides
+ * the same auth subprotocol an API key does, without exposing the credential.
+ */
+export interface GatewayTranscriptionFactory {
+  (modelId: GatewayTranscriptionModelId): TranscriptionModelV4;
+
+  getToken(
+    options: GatewayTranscriptionFactoryGetTokenOptions,
+  ): Promise<GatewayTranscriptionFactoryGetTokenResult>;
+}
+
 export interface GatewayProviderSettings {
   /**
    * The base URL prefix for API calls. Defaults to `https://ai-gateway.vercel.sh/v4/ai`.
@@ -297,18 +338,21 @@ export function createGateway(
     }
   };
 
-  // Mints a short-lived realtime client secret (`vcst_`) via the Gateway's
+  // Mints a short-lived client secret (`vcst_`) via the Gateway's
   // `/v1/realtime/client-secrets` route, authenticated with the long-lived
   // Gateway credential. Server-side only (asserted) — the credential never
   // belongs in a browser; the browser receives only the minted token. The
   // mint route lives at the gateway origin's `/v1/realtime/client-secrets`,
-  // not under the realtime `baseURL` path (which targets `/v4/ai`), so the
-  // URL is resolved against the origin.
-  const mintRealtimeClientSecret = async (params: {
+  // not under the `baseURL` path (which targets `/v4/ai`), so the URL is
+  // resolved against the origin. `routeKind` binds the token to a WebSocket
+  // surface; it is omitted for realtime (the gateway default) so older
+  // gateway deployments keep accepting realtime mints.
+  const mintClientSecret = async (params: {
     modelId: string;
     expiresAfterSeconds?: number;
+    routeKind?: 'transcription';
   }): Promise<{ token: string; expiresAt?: number }> => {
-    assertGatewayRealtimeServerEnvironment();
+    assertGatewayClientSecretServerEnvironment();
     const auth = await getRealtimeAuthToken();
     const headers = createAuthHeaders(auth);
     const url = new URL('/v1/realtime/client-secrets', baseURL).toString();
@@ -318,6 +362,7 @@ export function createGateway(
         headers,
         body: {
           model: params.modelId,
+          ...(params.routeKind != null && { routeKind: params.routeKind }),
           ...(params.expiresAfterSeconds != null && {
             expiresIn: params.expiresAfterSeconds,
           }),
@@ -530,18 +575,42 @@ export function createGateway(
   };
   provider.transcriptionModel = createTranscriptionModel;
   provider.transcription = createTranscriptionModel;
+  // Callable like `transcription(modelId)`; `getToken` mints a
+  // transcription-bound client secret (server-side only) the browser uses to
+  // connect via `createGateway({ apiKey: token }).transcription(modelId)`.
+  provider.experimental_transcription = Object.assign(
+    (modelId: GatewayTranscriptionModelId) => createTranscriptionModel(modelId),
+    {
+      getToken: async (
+        tokenOptions: GatewayTranscriptionFactoryGetTokenOptions,
+      ): Promise<GatewayTranscriptionFactoryGetTokenResult> => {
+        const secret = await mintClientSecret({
+          modelId: tokenOptions.model,
+          routeKind: 'transcription',
+          ...(tokenOptions.expiresAfterSeconds != null && {
+            expiresAfterSeconds: tokenOptions.expiresAfterSeconds,
+          }),
+        });
+        return {
+          token: secret.token,
+          url: toGatewayTranscriptionUrl(baseURL, tokenOptions.model),
+          ...(secret.expiresAt != null && { expiresAt: secret.expiresAt }),
+        };
+      },
+    },
+  ) as GatewayTranscriptionFactory;
 
   // No server-environment guard here: building the realtime model is just the
   // event codec + WebSocket-config helper, which the browser legitimately
   // needs to drive the transport with a server-minted client secret. The
-  // server-only boundary is enforced on minting itself
-  // (`mintRealtimeClientSecret`), which requires the Gateway credential.
+  // server-only boundary is enforced on minting itself (`mintClientSecret`),
+  // which requires the Gateway credential.
   const createRealtimeModel = (modelId: GatewayRealtimeModelId) =>
     new GatewayRealtimeModel(modelId, {
       provider: 'gateway.realtime',
       baseURL,
       teamIdOrSlug: options.teamIdOrSlug,
-      createClientSecret: mintRealtimeClientSecret,
+      createClientSecret: mintClientSecret,
     });
   provider.experimental_realtime = Object.assign(
     (modelId: GatewayRealtimeModelId) => createRealtimeModel(modelId),
@@ -591,10 +660,10 @@ export async function getGatewayAuthToken(
   };
 }
 
-function assertGatewayRealtimeServerEnvironment(): void {
+function assertGatewayClientSecretServerEnvironment(): void {
   if (typeof globalThis.window !== 'undefined') {
     throw new Error(
-      'AI Gateway realtime client secrets must be minted server-side: minting needs your Gateway credential, which must never reach the browser. Call gateway.experimental_realtime.getToken() from your server and pass the returned token to the client.',
+      'AI Gateway client secrets must be minted server-side: minting needs your Gateway credential, which must never reach the browser. Call gateway.experimental_realtime.getToken() or gateway.experimental_transcription.getToken() from your server and pass the returned token to the client.',
     );
   }
 }

package/src/gateway-transcription-model-settings.ts

@@ -1,6 +1,7 @@
 export type GatewayTranscriptionModelId =
   | 'openai/gpt-4o-mini-transcribe'
   | 'openai/gpt-4o-transcribe'
+  | 'openai/gpt-realtime-whisper'
   | 'openai/whisper-1'
   | 'xai/grok-stt'
   | (string & {});

package/src/gateway-transcription-model.ts

@@ -181,7 +181,10 @@ export class GatewayTranscriptionModel implements TranscriptionModelV4 {
  * WS(S), model id in `?ai-model-id=` (browser `WebSocket` cannot set headers;
  * slash-safe for qualified ids like `openai/gpt-realtime-whisper`).
  */
-function toGatewayTranscriptionUrl(baseURL: string, modelId: string): string {
+export function toGatewayTranscriptionUrl(
+  baseURL: string,
+  modelId: string,
+): string {
   const url = new URL(`${baseURL.replace(/^http/, 'ws')}/transcription-model`);
   url.searchParams.set('ai-model-id', modelId);
   return url.toString();