@ai-sdk/provider-utils 3.0.20 → 3.0.22

package/dist/index.js

@@ -6,8 +6,8 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -31,7 +31,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  DEFAULT_MAX_DOWNLOAD_SIZE: () => DEFAULT_MAX_DOWNLOAD_SIZE,
   DelayedPromise: () => DelayedPromise,
+  DownloadError: () => DownloadError,
   EventSourceParserStream: () => import_stream2.EventSourceParserStream,
   VERSION: () => VERSION,
   asSchema: () => asSchema,
@@ -77,12 +79,14 @@ __export(src_exports, {
   postFormDataToApi: () => postFormDataToApi,
   postJsonToApi: () => postJsonToApi,
   postToApi: () => postToApi,
+  readResponseWithSizeLimit: () => readResponseWithSizeLimit,
   removeUndefinedEntries: () => removeUndefinedEntries,
   resolve: () => resolve,
   safeParseJSON: () => safeParseJSON,
   safeValidateTypes: () => safeValidateTypes,
   standardSchemaValidator: () => standardSchemaValidator,
   tool: () => tool,
+  validateDownloadUrl: () => validateDownloadUrl,
   validateTypes: () => validateTypes,
   validator: () => validator,
   withUserAgentSuffix: () => withUserAgentSuffix,
@@ -193,17 +197,17 @@ var DelayedPromise = class {
     return this._promise;
   }
   resolve(value) {
-    var _a;
+    var _a2;
     this.status = { type: "resolved", value };
     if (this._promise) {
-      (_a = this._resolve) == null ? void 0 : _a.call(this, value);
+      (_a2 = this._resolve) == null ? void 0 : _a2.call(this, value);
     }
   }
   reject(error) {
-    var _a;
+    var _a2;
     this.status = { type: "rejected", error };
     if (this._promise) {
-      (_a = this._reject) == null ? void 0 : _a.call(this, error);
+      (_a2 = this._reject) == null ? void 0 : _a2.call(this, error);
     }
   }
   isResolved() {
@@ -222,8 +226,88 @@ function extractResponseHeaders(response) {
   return Object.fromEntries([...response.headers]);
 }
 
-// src/generate-id.ts
+// src/download-error.ts
 var import_provider = require("@ai-sdk/provider");
+var name = "AI_DownloadError";
+var marker = `vercel.ai.error.${name}`;
+var symbol = Symbol.for(marker);
+var _a, _b;
+var DownloadError = class extends (_b = import_provider.AISDKError, _a = symbol, _b) {
+  constructor({
+    url,
+    statusCode,
+    statusText,
+    cause,
+    message = cause == null ? `Failed to download ${url}: ${statusCode} ${statusText}` : `Failed to download ${url}: ${cause}`
+  }) {
+    super({ name, message, cause });
+    this[_a] = true;
+    this.url = url;
+    this.statusCode = statusCode;
+    this.statusText = statusText;
+  }
+  static isInstance(error) {
+    return import_provider.AISDKError.hasMarker(error, marker);
+  }
+};
+
+// src/read-response-with-size-limit.ts
+var DEFAULT_MAX_DOWNLOAD_SIZE = 2 * 1024 * 1024 * 1024;
+async function readResponseWithSizeLimit({
+  response,
+  url,
+  maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE
+}) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength != null) {
+    const length = parseInt(contentLength, 10);
+    if (!isNaN(length) && length > maxBytes) {
+      throw new DownloadError({
+        url,
+        message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes (Content-Length: ${length}).`
+      });
+    }
+  }
+  const body = response.body;
+  if (body == null) {
+    return new Uint8Array(0);
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      totalBytes += value.length;
+      if (totalBytes > maxBytes) {
+        throw new DownloadError({
+          url,
+          message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes.`
+        });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  const result = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}
+
+// src/generate-id.ts
+var import_provider2 = require("@ai-sdk/provider");
 var createIdGenerator = ({
   prefix,
   size = 16,
@@ -242,7 +326,7 @@ var createIdGenerator = ({
     return generator;
   }
   if (alphabet.includes(separator)) {
-    throw new import_provider.InvalidArgumentError({
+    throw new import_provider2.InvalidArgumentError({
       argument: "separator",
       message: `The separator "${separator}" must not be part of the alphabet "${alphabet}".`
     });
@@ -266,10 +350,10 @@ function getErrorMessage(error) {
 }
 
 // src/get-from-api.ts
-var import_provider3 = require("@ai-sdk/provider");
+var import_provider4 = require("@ai-sdk/provider");
 
 // src/handle-fetch-error.ts
-var import_provider2 = require("@ai-sdk/provider");
+var import_provider3 = require("@ai-sdk/provider");
 
 // src/is-abort-error.ts
 function isAbortError(error) {
@@ -290,7 +374,7 @@ function handleFetchError({
   if (error instanceof TypeError && FETCH_FAILED_ERROR_MESSAGES.includes(error.message.toLowerCase())) {
     const cause = error.cause;
     if (cause != null) {
-      return new import_provider2.APICallError({
+      return new import_provider3.APICallError({
         message: `Cannot connect to API: ${cause.message}`,
         cause,
         url,
@@ -305,14 +389,14 @@ function handleFetchError({
 
 // src/get-runtime-environment-user-agent.ts
 function getRuntimeEnvironmentUserAgent(globalThisAny = globalThis) {
-  var _a, _b, _c;
+  var _a2, _b2, _c;
   if (globalThisAny.window) {
     return `runtime/browser`;
   }
-  if ((_a = globalThisAny.navigator) == null ? void 0 : _a.userAgent) {
+  if ((_a2 = globalThisAny.navigator) == null ? void 0 : _a2.userAgent) {
     return `runtime/${globalThisAny.navigator.userAgent.toLowerCase()}`;
   }
-  if ((_c = (_b = globalThisAny.process) == null ? void 0 : _b.versions) == null ? void 0 : _c.node) {
+  if ((_c = (_b2 = globalThisAny.process) == null ? void 0 : _b2.versions) == null ? void 0 : _c.node) {
     return `runtime/node.js/${globalThisAny.process.version.substring(0)}`;
   }
   if (globalThisAny.EdgeRuntime) {
@@ -356,7 +440,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.0.20" : "0.0.0-test";
+var VERSION = true ? "3.0.22" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -388,10 +472,10 @@ var getFromApi = async ({
           requestBodyValues: {}
         });
       } catch (error) {
-        if (isAbortError(error) || import_provider3.APICallError.isInstance(error)) {
+        if (isAbortError(error) || import_provider4.APICallError.isInstance(error)) {
           throw error;
         }
-        throw new import_provider3.APICallError({
+        throw new import_provider4.APICallError({
           message: "Failed to process error response",
           cause: error,
           statusCode: response.status,
@@ -410,11 +494,11 @@ var getFromApi = async ({
       });
     } catch (error) {
       if (error instanceof Error) {
-        if (isAbortError(error) || import_provider3.APICallError.isInstance(error)) {
+        if (isAbortError(error) || import_provider4.APICallError.isInstance(error)) {
           throw error;
         }
       }
-      throw new import_provider3.APICallError({
+      throw new import_provider4.APICallError({
         message: "Failed to process successful response",
         cause: error,
         statusCode: response.status,
@@ -453,8 +537,8 @@ function injectJsonInstructionIntoMessages({
   schemaPrefix,
   schemaSuffix
 }) {
-  var _a, _b;
-  const systemMessage = ((_a = messages[0]) == null ? void 0 : _a.role) === "system" ? { ...messages[0] } : { role: "system", content: "" };
+  var _a2, _b2;
+  const systemMessage = ((_a2 = messages[0]) == null ? void 0 : _a2.role) === "system" ? { ...messages[0] } : { role: "system", content: "" };
   systemMessage.content = injectJsonInstruction({
     prompt: systemMessage.content,
     schema,
@@ -463,7 +547,7 @@ function injectJsonInstructionIntoMessages({
   });
   return [
     systemMessage,
-    ...((_b = messages[0]) == null ? void 0 : _b.role) === "system" ? messages.slice(1) : messages
+    ...((_b2 = messages[0]) == null ? void 0 : _b2.role) === "system" ? messages.slice(1) : messages
   ];
 }
 
@@ -482,7 +566,7 @@ function isUrlSupported({
 }
 
 // src/load-api-key.ts
-var import_provider4 = require("@ai-sdk/provider");
+var import_provider5 = require("@ai-sdk/provider");
 function loadApiKey({
   apiKey,
   environmentVariableName,
@@ -493,23 +577,23 @@ function loadApiKey({
     return apiKey;
   }
   if (apiKey != null) {
-    throw new import_provider4.LoadAPIKeyError({
+    throw new import_provider5.LoadAPIKeyError({
       message: `${description} API key must be a string.`
     });
   }
   if (typeof process === "undefined") {
-    throw new import_provider4.LoadAPIKeyError({
+    throw new import_provider5.LoadAPIKeyError({
       message: `${description} API key is missing. Pass it using the '${apiKeyParameterName}' parameter. Environment variables is not supported in this environment.`
     });
   }
   apiKey = process.env[environmentVariableName];
   if (apiKey == null) {
-    throw new import_provider4.LoadAPIKeyError({
+    throw new import_provider5.LoadAPIKeyError({
       message: `${description} API key is missing. Pass it using the '${apiKeyParameterName}' parameter or the ${environmentVariableName} environment variable.`
     });
   }
   if (typeof apiKey !== "string") {
-    throw new import_provider4.LoadAPIKeyError({
+    throw new import_provider5.LoadAPIKeyError({
       message: `${description} API key must be a string. The value of the ${environmentVariableName} environment variable is not a string.`
     });
   }
@@ -535,7 +619,7 @@ function loadOptionalSetting({
 }
 
 // src/load-setting.ts
-var import_provider5 = require("@ai-sdk/provider");
+var import_provider6 = require("@ai-sdk/provider");
 function loadSetting({
   settingValue,
   environmentVariableName,
@@ -546,23 +630,23 @@ function loadSetting({
     return settingValue;
   }
   if (settingValue != null) {
-    throw new import_provider5.LoadSettingError({
+    throw new import_provider6.LoadSettingError({
       message: `${description} setting must be a string.`
     });
   }
   if (typeof process === "undefined") {
-    throw new import_provider5.LoadSettingError({
+    throw new import_provider6.LoadSettingError({
       message: `${description} setting is missing. Pass it using the '${settingName}' parameter. Environment variables is not supported in this environment.`
     });
   }
   settingValue = process.env[environmentVariableName];
   if (settingValue == null) {
-    throw new import_provider5.LoadSettingError({
+    throw new import_provider6.LoadSettingError({
       message: `${description} setting is missing. Pass it using the '${settingName}' parameter or the ${environmentVariableName} environment variable.`
     });
   }
   if (typeof settingValue !== "string") {
-    throw new import_provider5.LoadSettingError({
+    throw new import_provider6.LoadSettingError({
       message: `${description} setting must be a string. The value of the ${environmentVariableName} environment variable is not a string.`
     });
   }
@@ -571,23 +655,23 @@ function loadSetting({
 
 // src/media-type-to-extension.ts
 function mediaTypeToExtension(mediaType) {
-  var _a;
+  var _a2;
   const [_type, subtype = ""] = mediaType.toLowerCase().split("/");
-  return (_a = {
+  return (_a2 = {
     mpeg: "mp3",
     "x-wav": "wav",
     opus: "ogg",
     mp4: "m4a",
     "x-m4a": "m4a"
-  }[subtype]) != null ? _a : subtype;
+  }[subtype]) != null ? _a2 : subtype;
 }
 
 // src/parse-json.ts
-var import_provider8 = require("@ai-sdk/provider");
+var import_provider9 = require("@ai-sdk/provider");
 
 // src/secure-json-parse.ts
-var suspectProtoRx = /"__proto__"\s*:/;
-var suspectConstructorRx = /"constructor"\s*:/;
+var suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
+var suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
 function _parse(text) {
   const obj = JSON.parse(text);
   if (obj === null || typeof obj !== "object") {
@@ -607,7 +691,7 @@ function filter(obj) {
       if (Object.prototype.hasOwnProperty.call(node, "__proto__")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
-      if (Object.prototype.hasOwnProperty.call(node, "constructor") && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
+      if (Object.prototype.hasOwnProperty.call(node, "constructor") && node.constructor !== null && typeof node.constructor === "object" && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
       for (const key in node) {
@@ -635,10 +719,10 @@ function secureJsonParse(text) {
 }
 
 // src/validate-types.ts
-var import_provider7 = require("@ai-sdk/provider");
+var import_provider8 = require("@ai-sdk/provider");
 
 // src/validator.ts
-var import_provider6 = require("@ai-sdk/provider");
+var import_provider7 = require("@ai-sdk/provider");
 var validatorSymbol = Symbol.for("vercel.ai.validator");
 function validator(validate) {
   return { [validatorSymbol]: true, validate };
@@ -663,7 +747,7 @@ function standardSchemaValidator(standardSchema) {
     const result = await standardSchema["~standard"].validate(value);
     return result.issues == null ? { success: true, value: result.value } : {
       success: false,
-      error: new import_provider6.TypeValidationError({
+      error: new import_provider7.TypeValidationError({
         value,
         cause: result.issues
       })
@@ -678,7 +762,7 @@ async function validateTypes({
 }) {
   const result = await safeValidateTypes({ value, schema });
   if (!result.success) {
-    throw import_provider7.TypeValidationError.wrap({ value, cause: result.error });
+    throw import_provider8.TypeValidationError.wrap({ value, cause: result.error });
   }
   return result.value;
 }
@@ -697,13 +781,13 @@ async function safeValidateTypes({
     }
     return {
       success: false,
-      error: import_provider7.TypeValidationError.wrap({ value, cause: result.error }),
+      error: import_provider8.TypeValidationError.wrap({ value, cause: result.error }),
       rawValue: value
     };
   } catch (error) {
     return {
       success: false,
-      error: import_provider7.TypeValidationError.wrap({ value, cause: error }),
+      error: import_provider8.TypeValidationError.wrap({ value, cause: error }),
       rawValue: value
     };
   }
@@ -721,10 +805,10 @@ async function parseJSON({
     }
     return validateTypes({ value, schema });
   } catch (error) {
-    if (import_provider8.JSONParseError.isInstance(error) || import_provider8.TypeValidationError.isInstance(error)) {
+    if (import_provider9.JSONParseError.isInstance(error) || import_provider9.TypeValidationError.isInstance(error)) {
       throw error;
     }
-    throw new import_provider8.JSONParseError({ text, cause: error });
+    throw new import_provider9.JSONParseError({ text, cause: error });
   }
 }
 async function safeParseJSON({
@@ -740,7 +824,7 @@ async function safeParseJSON({
   } catch (error) {
     return {
       success: false,
-      error: import_provider8.JSONParseError.isInstance(error) ? error : new import_provider8.JSONParseError({ text, cause: error }),
+      error: import_provider9.JSONParseError.isInstance(error) ? error : new import_provider9.JSONParseError({ text, cause: error }),
       rawValue: void 0
     };
   }
@@ -773,7 +857,7 @@ function parseJsonEventStream({
 }
 
 // src/parse-provider-options.ts
-var import_provider9 = require("@ai-sdk/provider");
+var import_provider10 = require("@ai-sdk/provider");
 async function parseProviderOptions({
   provider,
   providerOptions,
@@ -787,7 +871,7 @@ async function parseProviderOptions({
     schema
   });
   if (!parsedProviderOptions.success) {
-    throw new import_provider9.InvalidArgumentError({
+    throw new import_provider10.InvalidArgumentError({
       argument: "providerOptions",
       message: `invalid ${provider} provider options`,
       cause: parsedProviderOptions.error
@@ -797,7 +881,7 @@ async function parseProviderOptions({
 }
 
 // src/post-to-api.ts
-var import_provider10 = require("@ai-sdk/provider");
+var import_provider11 = require("@ai-sdk/provider");
 var getOriginalFetch2 = () => globalThis.fetch;
 var postJsonToApi = async ({
   url,
@@ -872,10 +956,10 @@ var postToApi = async ({
           requestBodyValues: body.values
         });
       } catch (error) {
-        if (isAbortError(error) || import_provider10.APICallError.isInstance(error)) {
+        if (isAbortError(error) || import_provider11.APICallError.isInstance(error)) {
           throw error;
         }
-        throw new import_provider10.APICallError({
+        throw new import_provider11.APICallError({
           message: "Failed to process error response",
           cause: error,
           statusCode: response.status,
@@ -894,11 +978,11 @@ var postToApi = async ({
       });
     } catch (error) {
       if (error instanceof Error) {
-        if (isAbortError(error) || import_provider10.APICallError.isInstance(error)) {
+        if (isAbortError(error) || import_provider11.APICallError.isInstance(error)) {
           throw error;
         }
       }
-      throw new import_provider10.APICallError({
+      throw new import_provider11.APICallError({
         message: "Failed to process successful response",
         cause: error,
         statusCode: response.status,
@@ -923,7 +1007,7 @@ function dynamicTool(tool2) {
 // src/provider-defined-tool-factory.ts
 function createProviderDefinedToolFactory({
   id,
-  name,
+  name: name2,
   inputSchema
 }) {
   return ({
@@ -937,7 +1021,7 @@ function createProviderDefinedToolFactory({
   }) => tool({
     type: "provider-defined",
     id,
-    name,
+    name: name2,
     args,
     inputSchema,
     outputSchema,
@@ -950,7 +1034,7 @@ function createProviderDefinedToolFactory({
 }
 function createProviderDefinedToolFactoryWithOutputSchema({
   id,
-  name,
+  name: name2,
   inputSchema,
   outputSchema
 }) {
@@ -964,7 +1048,7 @@ function createProviderDefinedToolFactoryWithOutputSchema({
   }) => tool({
     type: "provider-defined",
     id,
-    name,
+    name: name2,
     args,
     inputSchema,
     outputSchema,
@@ -992,7 +1076,7 @@ async function resolve(value) {
 }
 
 // src/response-handler.ts
-var import_provider11 = require("@ai-sdk/provider");
+var import_provider12 = require("@ai-sdk/provider");
 var createJsonErrorResponseHandler = ({
   errorSchema,
   errorToMessage,
@@ -1003,7 +1087,7 @@ var createJsonErrorResponseHandler = ({
   if (responseBody.trim() === "") {
     return {
       responseHeaders,
-      value: new import_provider11.APICallError({
+      value: new import_provider12.APICallError({
         message: response.statusText,
         url,
         requestBodyValues,
@@ -1021,7 +1105,7 @@ var createJsonErrorResponseHandler = ({
     });
     return {
       responseHeaders,
-      value: new import_provider11.APICallError({
+      value: new import_provider12.APICallError({
         message: errorToMessage(parsedError),
         url,
         requestBodyValues,
@@ -1035,7 +1119,7 @@ var createJsonErrorResponseHandler = ({
   } catch (parseError) {
     return {
       responseHeaders,
-      value: new import_provider11.APICallError({
+      value: new import_provider12.APICallError({
         message: response.statusText,
         url,
         requestBodyValues,
@@ -1050,7 +1134,7 @@ var createJsonErrorResponseHandler = ({
 var createEventSourceResponseHandler = (chunkSchema) => async ({ response }) => {
   const responseHeaders = extractResponseHeaders(response);
   if (response.body == null) {
-    throw new import_provider11.EmptyResponseBodyError({});
+    throw new import_provider12.EmptyResponseBodyError({});
   }
   return {
     responseHeaders,
@@ -1063,7 +1147,7 @@ var createEventSourceResponseHandler = (chunkSchema) => async ({ response }) =>
 var createJsonStreamResponseHandler = (chunkSchema) => async ({ response }) => {
   const responseHeaders = extractResponseHeaders(response);
   if (response.body == null) {
-    throw new import_provider11.EmptyResponseBodyError({});
+    throw new import_provider12.EmptyResponseBodyError({});
   }
   let buffer = "";
   return {
@@ -1095,7 +1179,7 @@ var createJsonResponseHandler = (responseSchema) => async ({ response, url, requ
   });
   const responseHeaders = extractResponseHeaders(response);
   if (!parsedResult.success) {
-    throw new import_provider11.APICallError({
+    throw new import_provider12.APICallError({
       message: "Invalid JSON response",
       cause: parsedResult.error,
       statusCode: response.status,
@@ -1114,7 +1198,7 @@ var createJsonResponseHandler = (responseSchema) => async ({ response, url, requ
 var createBinaryResponseHandler = () => async ({ response, url, requestBodyValues }) => {
   const responseHeaders = extractResponseHeaders(response);
   if (!response.body) {
-    throw new import_provider11.APICallError({
+    throw new import_provider12.APICallError({
       message: "Response body is empty",
       url,
       requestBodyValues,
@@ -1130,7 +1214,7 @@ var createBinaryResponseHandler = () => async ({ response, url, requestBodyValue
       value: new Uint8Array(buffer)
     };
   } catch (error) {
-    throw new import_provider11.APICallError({
+    throw new import_provider12.APICallError({
       message: "Failed to read response as array buffer",
       url,
       requestBodyValues,
@@ -1146,7 +1230,7 @@ var createStatusCodeErrorResponseHandler = () => async ({ response, url, request
   const responseBody = await response.text();
   return {
     responseHeaders,
-    value: new import_provider11.APICallError({
+    value: new import_provider12.APICallError({
       message: response.statusText,
       url,
       requestBodyValues,
@@ -1240,11 +1324,11 @@ function parseAnyDef() {
 // src/zod-to-json-schema/parsers/array.ts
 var import_v3 = require("zod/v3");
 function parseArrayDef(def, refs) {
-  var _a, _b, _c;
+  var _a2, _b2, _c;
   const res = {
     type: "array"
   };
-  if (((_a = def.type) == null ? void 0 : _a._def) && ((_c = (_b = def.type) == null ? void 0 : _b._def) == null ? void 0 : _c.typeName) !== import_v3.ZodFirstPartyTypeKind.ZodAny) {
+  if (((_a2 = def.type) == null ? void 0 : _a2._def) && ((_c = (_b2 = def.type) == null ? void 0 : _b2._def) == null ? void 0 : _c.typeName) !== import_v3.ZodFirstPartyTypeKind.ZodAny) {
     res.items = parseDef(def.type._def, {
       ...refs,
       currentPath: [...refs.currentPath, "items"]
@@ -1635,8 +1719,8 @@ function escapeNonAlphaNumeric(source) {
   return result;
 }
 function addFormat(schema, value, message, refs) {
-  var _a;
-  if (schema.format || ((_a = schema.anyOf) == null ? void 0 : _a.some((x) => x.format))) {
+  var _a2;
+  if (schema.format || ((_a2 = schema.anyOf) == null ? void 0 : _a2.some((x) => x.format))) {
     if (!schema.anyOf) {
       schema.anyOf = [];
     }
@@ -1655,8 +1739,8 @@ function addFormat(schema, value, message, refs) {
   }
 }
 function addPattern(schema, regex, message, refs) {
-  var _a;
-  if (schema.pattern || ((_a = schema.allOf) == null ? void 0 : _a.some((x) => x.pattern))) {
+  var _a2;
+  if (schema.pattern || ((_a2 = schema.allOf) == null ? void 0 : _a2.some((x) => x.pattern))) {
     if (!schema.allOf) {
       schema.allOf = [];
     }
@@ -1675,7 +1759,7 @@ function addPattern(schema, regex, message, refs) {
   }
 }
 function stringifyRegExpWithFlags(regex, refs) {
-  var _a;
+  var _a2;
   if (!refs.applyRegexFlags || !regex.flags) {
     return regex.source;
   }
@@ -1705,7 +1789,7 @@ function stringifyRegExpWithFlags(regex, refs) {
             pattern += source[i];
             pattern += `${source[i - 2]}-${source[i]}`.toUpperCase();
             inCharRange = false;
-          } else if (source[i + 1] === "-" && ((_a = source[i + 2]) == null ? void 0 : _a.match(/[a-z]/))) {
+          } else if (source[i + 1] === "-" && ((_a2 = source[i + 2]) == null ? void 0 : _a2.match(/[a-z]/))) {
             pattern += source[i];
             inCharRange = true;
           } else {
@@ -1759,15 +1843,15 @@ function stringifyRegExpWithFlags(regex, refs) {
 
 // src/zod-to-json-schema/parsers/record.ts
 function parseRecordDef(def, refs) {
-  var _a, _b, _c, _d, _e, _f;
+  var _a2, _b2, _c, _d, _e, _f;
   const schema = {
     type: "object",
-    additionalProperties: (_a = parseDef(def.valueType._def, {
+    additionalProperties: (_a2 = parseDef(def.valueType._def, {
       ...refs,
       currentPath: [...refs.currentPath, "additionalProperties"]
-    })) != null ? _a : refs.allowedAdditionalProperties
+    })) != null ? _a2 : refs.allowedAdditionalProperties
   };
-  if (((_b = def.keyType) == null ? void 0 : _b._def.typeName) === import_v32.ZodFirstPartyTypeKind.ZodString && ((_c = def.keyType._def.checks) == null ? void 0 : _c.length)) {
+  if (((_b2 = def.keyType) == null ? void 0 : _b2._def.typeName) === import_v32.ZodFirstPartyTypeKind.ZodString && ((_c = def.keyType._def.checks) == null ? void 0 : _c.length)) {
     const { type, ...keyType } = parseStringDef(def.keyType._def, refs);
     return {
       ...schema,
@@ -2040,8 +2124,8 @@ function safeIsOptional(schema) {
 
 // src/zod-to-json-schema/parsers/optional.ts
 var parseOptionalDef = (def, refs) => {
-  var _a;
-  if (refs.currentPath.toString() === ((_a = refs.propertyPath) == null ? void 0 : _a.toString())) {
+  var _a2;
+  if (refs.currentPath.toString() === ((_a2 = refs.propertyPath) == null ? void 0 : _a2.toString())) {
     return parseDef(def.innerType._def, refs);
   }
   const innerSchema = parseDef(def.innerType._def, {
@@ -2229,10 +2313,10 @@ var selectParser = (def, typeName, refs) => {
 
 // src/zod-to-json-schema/parse-def.ts
 function parseDef(def, refs, forceResolution = false) {
-  var _a;
+  var _a2;
   const seenItem = refs.seen.get(def);
   if (refs.override) {
-    const overrideResult = (_a = refs.override) == null ? void 0 : _a.call(
+    const overrideResult = (_a2 = refs.override) == null ? void 0 : _a2.call(
       refs,
       def,
       refs,
@@ -2300,11 +2384,11 @@ var getRefs = (options) => {
     currentPath,
     propertyPath: void 0,
     seen: new Map(
-      Object.entries(_options.definitions).map(([name, def]) => [
+      Object.entries(_options.definitions).map(([name2, def]) => [
         def._def,
         {
           def: def._def,
-          path: [..._options.basePath, _options.definitionPath, name],
+          path: [..._options.basePath, _options.definitionPath, name2],
           // Resolution of references will be forced even though seen, so it's ok that the schema is undefined here for now.
           jsonSchema: void 0
         }
@@ -2315,50 +2399,50 @@ var getRefs = (options) => {
 
 // src/zod-to-json-schema/zod-to-json-schema.ts
 var zodToJsonSchema = (schema, options) => {
-  var _a;
+  var _a2;
   const refs = getRefs(options);
   let definitions = typeof options === "object" && options.definitions ? Object.entries(options.definitions).reduce(
-    (acc, [name2, schema2]) => {
-      var _a2;
+    (acc, [name3, schema2]) => {
+      var _a3;
       return {
         ...acc,
-        [name2]: (_a2 = parseDef(
+        [name3]: (_a3 = parseDef(
           schema2._def,
           {
             ...refs,
-            currentPath: [...refs.basePath, refs.definitionPath, name2]
+            currentPath: [...refs.basePath, refs.definitionPath, name3]
           },
           true
-        )) != null ? _a2 : parseAnyDef()
+        )) != null ? _a3 : parseAnyDef()
       };
     },
     {}
   ) : void 0;
-  const name = typeof options === "string" ? options : (options == null ? void 0 : options.nameStrategy) === "title" ? void 0 : options == null ? void 0 : options.name;
-  const main = (_a = parseDef(
+  const name2 = typeof options === "string" ? options : (options == null ? void 0 : options.nameStrategy) === "title" ? void 0 : options == null ? void 0 : options.name;
+  const main = (_a2 = parseDef(
     schema._def,
-    name === void 0 ? refs : {
+    name2 === void 0 ? refs : {
       ...refs,
-      currentPath: [...refs.basePath, refs.definitionPath, name]
+      currentPath: [...refs.basePath, refs.definitionPath, name2]
     },
     false
-  )) != null ? _a : parseAnyDef();
+  )) != null ? _a2 : parseAnyDef();
   const title = typeof options === "object" && options.name !== void 0 && options.nameStrategy === "title" ? options.name : void 0;
   if (title !== void 0) {
     main.title = title;
   }
-  const combined = name === void 0 ? definitions ? {
+  const combined = name2 === void 0 ? definitions ? {
     ...main,
     [refs.definitionPath]: definitions
   } : main : {
     $ref: [
       ...refs.$refStrategy === "relative" ? [] : refs.basePath,
       refs.definitionPath,
-      name
+      name2
     ].join("/"),
     [refs.definitionPath]: {
       ...definitions,
-      [name]: main
+      [name2]: main
     }
   };
   combined.$schema = "http://json-schema.org/draft-07/schema#";
@@ -2370,8 +2454,8 @@ var zod_to_json_schema_default = zodToJsonSchema;
 
 // src/zod-schema.ts
 function zod3Schema(zodSchema2, options) {
-  var _a;
-  const useReferences = (_a = options == null ? void 0 : options.useReferences) != null ? _a : false;
+  var _a2;
+  const useReferences = (_a2 = options == null ? void 0 : options.useReferences) != null ? _a2 : false;
   return jsonSchema(
     // defer json schema creation to avoid unnecessary computation when only validation is needed
     () => zod_to_json_schema_default(zodSchema2, {
@@ -2386,8 +2470,8 @@ function zod3Schema(zodSchema2, options) {
   );
 }
 function zod4Schema(zodSchema2, options) {
-  var _a;
-  const useReferences = (_a = options == null ? void 0 : options.useReferences) != null ? _a : false;
+  var _a2;
+  const useReferences = (_a2 = options == null ? void 0 : options.useReferences) != null ? _a2 : false;
   return jsonSchema(
     // defer json schema creation to avoid unnecessary computation when only validation is needed
     () => addAdditionalPropertiesToJsonSchema(
@@ -2472,6 +2556,102 @@ function convertToBase64(value) {
   return value instanceof Uint8Array ? convertUint8ArrayToBase64(value) : value;
 }
 
+// src/validate-download-url.ts
+function validateDownloadUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (e) {
+    throw new DownloadError({
+      url,
+      message: `Invalid URL: ${url}`
+    });
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new DownloadError({
+      url,
+      message: `URL scheme must be http or https, got ${parsed.protocol}`
+    });
+  }
+  const hostname = parsed.hostname;
+  if (!hostname) {
+    throw new DownloadError({
+      url,
+      message: `URL must have a hostname`
+    });
+  }
+  if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".localhost")) {
+    throw new DownloadError({
+      url,
+      message: `URL with hostname ${hostname} is not allowed`
+    });
+  }
+  if (hostname.startsWith("[") && hostname.endsWith("]")) {
+    const ipv6 = hostname.slice(1, -1);
+    if (isPrivateIPv6(ipv6)) {
+      throw new DownloadError({
+        url,
+        message: `URL with IPv6 address ${hostname} is not allowed`
+      });
+    }
+    return;
+  }
+  if (isIPv4(hostname)) {
+    if (isPrivateIPv4(hostname)) {
+      throw new DownloadError({
+        url,
+        message: `URL with IP address ${hostname} is not allowed`
+      });
+    }
+    return;
+  }
+}
+function isIPv4(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) return false;
+  return parts.every((part) => {
+    const num = Number(part);
+    return Number.isInteger(num) && num >= 0 && num <= 255 && String(num) === part;
+  });
+}
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map(Number);
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::1") return true;
+  if (normalized === "::") return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mappedPart = normalized.slice(7);
+    if (isIPv4(mappedPart)) {
+      return isPrivateIPv4(mappedPart);
+    }
+    const hexParts = mappedPart.split(":");
+    if (hexParts.length === 2) {
+      const high = parseInt(hexParts[0], 16);
+      const low = parseInt(hexParts[1], 16);
+      if (!isNaN(high) && !isNaN(low)) {
+        const a = high >> 8 & 255;
+        const b = high & 255;
+        const c = low >> 8 & 255;
+        const d = low & 255;
+        return isPrivateIPv4(`${a}.${b}.${c}.${d}`);
+      }
+    }
+  }
+  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
+  if (normalized.startsWith("fe80")) return true;
+  return false;
+}
+
 // src/without-trailing-slash.ts
 function withoutTrailingSlash(url) {
   return url == null ? void 0 : url.replace(/\/$/, "");
@@ -2506,7 +2686,9 @@ __reExport(src_exports, require("@standard-schema/spec"), module.exports);
 var import_stream2 = require("eventsource-parser/stream");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_MAX_DOWNLOAD_SIZE,
   DelayedPromise,
+  DownloadError,
   EventSourceParserStream,
   VERSION,
   asSchema,
@@ -2552,12 +2734,14 @@ var import_stream2 = require("eventsource-parser/stream");
   postFormDataToApi,
   postJsonToApi,
   postToApi,
+  readResponseWithSizeLimit,
   removeUndefinedEntries,
   resolve,
   safeParseJSON,
   safeValidateTypes,
   standardSchemaValidator,
   tool,
+  validateDownloadUrl,
   validateTypes,
   validator,
   withUserAgentSuffix,