@ai-sdk/provider-utils 3.0.20 → 3.0.22

package/dist/index.mjs

@@ -100,17 +100,17 @@ var DelayedPromise = class {
     return this._promise;
   }
   resolve(value) {
-    var _a;
+    var _a2;
     this.status = { type: "resolved", value };
     if (this._promise) {
-      (_a = this._resolve) == null ? void 0 : _a.call(this, value);
+      (_a2 = this._resolve) == null ? void 0 : _a2.call(this, value);
     }
   }
   reject(error) {
-    var _a;
+    var _a2;
     this.status = { type: "rejected", error };
     if (this._promise) {
-      (_a = this._reject) == null ? void 0 : _a.call(this, error);
+      (_a2 = this._reject) == null ? void 0 : _a2.call(this, error);
     }
   }
   isResolved() {
@@ -129,6 +129,86 @@ function extractResponseHeaders(response) {
   return Object.fromEntries([...response.headers]);
 }
 
+// src/download-error.ts
+import { AISDKError } from "@ai-sdk/provider";
+var name = "AI_DownloadError";
+var marker = `vercel.ai.error.${name}`;
+var symbol = Symbol.for(marker);
+var _a, _b;
+var DownloadError = class extends (_b = AISDKError, _a = symbol, _b) {
+  constructor({
+    url,
+    statusCode,
+    statusText,
+    cause,
+    message = cause == null ? `Failed to download ${url}: ${statusCode} ${statusText}` : `Failed to download ${url}: ${cause}`
+  }) {
+    super({ name, message, cause });
+    this[_a] = true;
+    this.url = url;
+    this.statusCode = statusCode;
+    this.statusText = statusText;
+  }
+  static isInstance(error) {
+    return AISDKError.hasMarker(error, marker);
+  }
+};
+
+// src/read-response-with-size-limit.ts
+var DEFAULT_MAX_DOWNLOAD_SIZE = 2 * 1024 * 1024 * 1024;
+async function readResponseWithSizeLimit({
+  response,
+  url,
+  maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE
+}) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength != null) {
+    const length = parseInt(contentLength, 10);
+    if (!isNaN(length) && length > maxBytes) {
+      throw new DownloadError({
+        url,
+        message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes (Content-Length: ${length}).`
+      });
+    }
+  }
+  const body = response.body;
+  if (body == null) {
+    return new Uint8Array(0);
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      totalBytes += value.length;
+      if (totalBytes > maxBytes) {
+        throw new DownloadError({
+          url,
+          message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes.`
+        });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  const result = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}
+
 // src/generate-id.ts
 import { InvalidArgumentError } from "@ai-sdk/provider";
 var createIdGenerator = ({
@@ -212,14 +292,14 @@ function handleFetchError({
 
 // src/get-runtime-environment-user-agent.ts
 function getRuntimeEnvironmentUserAgent(globalThisAny = globalThis) {
-  var _a, _b, _c;
+  var _a2, _b2, _c;
   if (globalThisAny.window) {
     return `runtime/browser`;
   }
-  if ((_a = globalThisAny.navigator) == null ? void 0 : _a.userAgent) {
+  if ((_a2 = globalThisAny.navigator) == null ? void 0 : _a2.userAgent) {
     return `runtime/${globalThisAny.navigator.userAgent.toLowerCase()}`;
   }
-  if ((_c = (_b = globalThisAny.process) == null ? void 0 : _b.versions) == null ? void 0 : _c.node) {
+  if ((_c = (_b2 = globalThisAny.process) == null ? void 0 : _b2.versions) == null ? void 0 : _c.node) {
     return `runtime/node.js/${globalThisAny.process.version.substring(0)}`;
   }
   if (globalThisAny.EdgeRuntime) {
@@ -263,7 +343,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.0.20" : "0.0.0-test";
+var VERSION = true ? "3.0.22" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -360,8 +440,8 @@ function injectJsonInstructionIntoMessages({
   schemaPrefix,
   schemaSuffix
 }) {
-  var _a, _b;
-  const systemMessage = ((_a = messages[0]) == null ? void 0 : _a.role) === "system" ? { ...messages[0] } : { role: "system", content: "" };
+  var _a2, _b2;
+  const systemMessage = ((_a2 = messages[0]) == null ? void 0 : _a2.role) === "system" ? { ...messages[0] } : { role: "system", content: "" };
   systemMessage.content = injectJsonInstruction({
     prompt: systemMessage.content,
     schema,
@@ -370,7 +450,7 @@ function injectJsonInstructionIntoMessages({
   });
   return [
     systemMessage,
-    ...((_b = messages[0]) == null ? void 0 : _b.role) === "system" ? messages.slice(1) : messages
+    ...((_b2 = messages[0]) == null ? void 0 : _b2.role) === "system" ? messages.slice(1) : messages
   ];
 }
 
@@ -478,15 +558,15 @@ function loadSetting({
 
 // src/media-type-to-extension.ts
 function mediaTypeToExtension(mediaType) {
-  var _a;
+  var _a2;
   const [_type, subtype = ""] = mediaType.toLowerCase().split("/");
-  return (_a = {
+  return (_a2 = {
     mpeg: "mp3",
     "x-wav": "wav",
     opus: "ogg",
     mp4: "m4a",
     "x-m4a": "m4a"
-  }[subtype]) != null ? _a : subtype;
+  }[subtype]) != null ? _a2 : subtype;
 }
 
 // src/parse-json.ts
@@ -496,8 +576,8 @@ import {
 } from "@ai-sdk/provider";
 
 // src/secure-json-parse.ts
-var suspectProtoRx = /"__proto__"\s*:/;
-var suspectConstructorRx = /"constructor"\s*:/;
+var suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
+var suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
 function _parse(text) {
   const obj = JSON.parse(text);
   if (obj === null || typeof obj !== "object") {
@@ -517,7 +597,7 @@ function filter(obj) {
       if (Object.prototype.hasOwnProperty.call(node, "__proto__")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
-      if (Object.prototype.hasOwnProperty.call(node, "constructor") && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
+      if (Object.prototype.hasOwnProperty.call(node, "constructor") && node.constructor !== null && typeof node.constructor === "object" && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
       for (const key in node) {
@@ -835,7 +915,7 @@ function dynamicTool(tool2) {
 // src/provider-defined-tool-factory.ts
 function createProviderDefinedToolFactory({
   id,
-  name,
+  name: name2,
   inputSchema
 }) {
   return ({
@@ -849,7 +929,7 @@ function createProviderDefinedToolFactory({
   }) => tool({
     type: "provider-defined",
     id,
-    name,
+    name: name2,
     args,
     inputSchema,
     outputSchema,
@@ -862,7 +942,7 @@ function createProviderDefinedToolFactory({
 }
 function createProviderDefinedToolFactoryWithOutputSchema({
   id,
-  name,
+  name: name2,
   inputSchema,
   outputSchema
 }) {
@@ -876,7 +956,7 @@ function createProviderDefinedToolFactoryWithOutputSchema({
   }) => tool({
     type: "provider-defined",
     id,
-    name,
+    name: name2,
     args,
     inputSchema,
     outputSchema,
@@ -1152,11 +1232,11 @@ function parseAnyDef() {
 // src/zod-to-json-schema/parsers/array.ts
 import { ZodFirstPartyTypeKind } from "zod/v3";
 function parseArrayDef(def, refs) {
-  var _a, _b, _c;
+  var _a2, _b2, _c;
   const res = {
     type: "array"
   };
-  if (((_a = def.type) == null ? void 0 : _a._def) && ((_c = (_b = def.type) == null ? void 0 : _b._def) == null ? void 0 : _c.typeName) !== ZodFirstPartyTypeKind.ZodAny) {
+  if (((_a2 = def.type) == null ? void 0 : _a2._def) && ((_c = (_b2 = def.type) == null ? void 0 : _b2._def) == null ? void 0 : _c.typeName) !== ZodFirstPartyTypeKind.ZodAny) {
     res.items = parseDef(def.type._def, {
       ...refs,
       currentPath: [...refs.currentPath, "items"]
@@ -1549,8 +1629,8 @@ function escapeNonAlphaNumeric(source) {
   return result;
 }
 function addFormat(schema, value, message, refs) {
-  var _a;
-  if (schema.format || ((_a = schema.anyOf) == null ? void 0 : _a.some((x) => x.format))) {
+  var _a2;
+  if (schema.format || ((_a2 = schema.anyOf) == null ? void 0 : _a2.some((x) => x.format))) {
     if (!schema.anyOf) {
       schema.anyOf = [];
     }
@@ -1569,8 +1649,8 @@ function addFormat(schema, value, message, refs) {
   }
 }
 function addPattern(schema, regex, message, refs) {
-  var _a;
-  if (schema.pattern || ((_a = schema.allOf) == null ? void 0 : _a.some((x) => x.pattern))) {
+  var _a2;
+  if (schema.pattern || ((_a2 = schema.allOf) == null ? void 0 : _a2.some((x) => x.pattern))) {
     if (!schema.allOf) {
       schema.allOf = [];
     }
@@ -1589,7 +1669,7 @@ function addPattern(schema, regex, message, refs) {
   }
 }
 function stringifyRegExpWithFlags(regex, refs) {
-  var _a;
+  var _a2;
   if (!refs.applyRegexFlags || !regex.flags) {
     return regex.source;
   }
@@ -1619,7 +1699,7 @@ function stringifyRegExpWithFlags(regex, refs) {
             pattern += source[i];
             pattern += `${source[i - 2]}-${source[i]}`.toUpperCase();
             inCharRange = false;
-          } else if (source[i + 1] === "-" && ((_a = source[i + 2]) == null ? void 0 : _a.match(/[a-z]/))) {
+          } else if (source[i + 1] === "-" && ((_a2 = source[i + 2]) == null ? void 0 : _a2.match(/[a-z]/))) {
             pattern += source[i];
             inCharRange = true;
           } else {
@@ -1673,15 +1753,15 @@ function stringifyRegExpWithFlags(regex, refs) {
 
 // src/zod-to-json-schema/parsers/record.ts
 function parseRecordDef(def, refs) {
-  var _a, _b, _c, _d, _e, _f;
+  var _a2, _b2, _c, _d, _e, _f;
   const schema = {
     type: "object",
-    additionalProperties: (_a = parseDef(def.valueType._def, {
+    additionalProperties: (_a2 = parseDef(def.valueType._def, {
       ...refs,
       currentPath: [...refs.currentPath, "additionalProperties"]
-    })) != null ? _a : refs.allowedAdditionalProperties
+    })) != null ? _a2 : refs.allowedAdditionalProperties
   };
-  if (((_b = def.keyType) == null ? void 0 : _b._def.typeName) === ZodFirstPartyTypeKind2.ZodString && ((_c = def.keyType._def.checks) == null ? void 0 : _c.length)) {
+  if (((_b2 = def.keyType) == null ? void 0 : _b2._def.typeName) === ZodFirstPartyTypeKind2.ZodString && ((_c = def.keyType._def.checks) == null ? void 0 : _c.length)) {
     const { type, ...keyType } = parseStringDef(def.keyType._def, refs);
     return {
       ...schema,
@@ -1954,8 +2034,8 @@ function safeIsOptional(schema) {
 
 // src/zod-to-json-schema/parsers/optional.ts
 var parseOptionalDef = (def, refs) => {
-  var _a;
-  if (refs.currentPath.toString() === ((_a = refs.propertyPath) == null ? void 0 : _a.toString())) {
+  var _a2;
+  if (refs.currentPath.toString() === ((_a2 = refs.propertyPath) == null ? void 0 : _a2.toString())) {
     return parseDef(def.innerType._def, refs);
   }
   const innerSchema = parseDef(def.innerType._def, {
@@ -2143,10 +2223,10 @@ var selectParser = (def, typeName, refs) => {
 
 // src/zod-to-json-schema/parse-def.ts
 function parseDef(def, refs, forceResolution = false) {
-  var _a;
+  var _a2;
   const seenItem = refs.seen.get(def);
   if (refs.override) {
-    const overrideResult = (_a = refs.override) == null ? void 0 : _a.call(
+    const overrideResult = (_a2 = refs.override) == null ? void 0 : _a2.call(
       refs,
       def,
       refs,
@@ -2214,11 +2294,11 @@ var getRefs = (options) => {
     currentPath,
     propertyPath: void 0,
     seen: new Map(
-      Object.entries(_options.definitions).map(([name, def]) => [
+      Object.entries(_options.definitions).map(([name2, def]) => [
         def._def,
         {
           def: def._def,
-          path: [..._options.basePath, _options.definitionPath, name],
+          path: [..._options.basePath, _options.definitionPath, name2],
           // Resolution of references will be forced even though seen, so it's ok that the schema is undefined here for now.
           jsonSchema: void 0
         }
@@ -2229,50 +2309,50 @@ var getRefs = (options) => {
 
 // src/zod-to-json-schema/zod-to-json-schema.ts
 var zodToJsonSchema = (schema, options) => {
-  var _a;
+  var _a2;
   const refs = getRefs(options);
   let definitions = typeof options === "object" && options.definitions ? Object.entries(options.definitions).reduce(
-    (acc, [name2, schema2]) => {
-      var _a2;
+    (acc, [name3, schema2]) => {
+      var _a3;
       return {
         ...acc,
-        [name2]: (_a2 = parseDef(
+        [name3]: (_a3 = parseDef(
           schema2._def,
           {
             ...refs,
-            currentPath: [...refs.basePath, refs.definitionPath, name2]
+            currentPath: [...refs.basePath, refs.definitionPath, name3]
           },
           true
-        )) != null ? _a2 : parseAnyDef()
+        )) != null ? _a3 : parseAnyDef()
       };
     },
     {}
   ) : void 0;
-  const name = typeof options === "string" ? options : (options == null ? void 0 : options.nameStrategy) === "title" ? void 0 : options == null ? void 0 : options.name;
-  const main = (_a = parseDef(
+  const name2 = typeof options === "string" ? options : (options == null ? void 0 : options.nameStrategy) === "title" ? void 0 : options == null ? void 0 : options.name;
+  const main = (_a2 = parseDef(
     schema._def,
-    name === void 0 ? refs : {
+    name2 === void 0 ? refs : {
       ...refs,
-      currentPath: [...refs.basePath, refs.definitionPath, name]
+      currentPath: [...refs.basePath, refs.definitionPath, name2]
     },
     false
-  )) != null ? _a : parseAnyDef();
+  )) != null ? _a2 : parseAnyDef();
   const title = typeof options === "object" && options.name !== void 0 && options.nameStrategy === "title" ? options.name : void 0;
   if (title !== void 0) {
     main.title = title;
   }
-  const combined = name === void 0 ? definitions ? {
+  const combined = name2 === void 0 ? definitions ? {
     ...main,
     [refs.definitionPath]: definitions
   } : main : {
     $ref: [
       ...refs.$refStrategy === "relative" ? [] : refs.basePath,
       refs.definitionPath,
-      name
+      name2
     ].join("/"),
     [refs.definitionPath]: {
       ...definitions,
-      [name]: main
+      [name2]: main
     }
   };
   combined.$schema = "http://json-schema.org/draft-07/schema#";
@@ -2284,8 +2364,8 @@ var zod_to_json_schema_default = zodToJsonSchema;
 
 // src/zod-schema.ts
 function zod3Schema(zodSchema2, options) {
-  var _a;
-  const useReferences = (_a = options == null ? void 0 : options.useReferences) != null ? _a : false;
+  var _a2;
+  const useReferences = (_a2 = options == null ? void 0 : options.useReferences) != null ? _a2 : false;
   return jsonSchema(
     // defer json schema creation to avoid unnecessary computation when only validation is needed
     () => zod_to_json_schema_default(zodSchema2, {
@@ -2300,8 +2380,8 @@ function zod3Schema(zodSchema2, options) {
   );
 }
 function zod4Schema(zodSchema2, options) {
-  var _a;
-  const useReferences = (_a = options == null ? void 0 : options.useReferences) != null ? _a : false;
+  var _a2;
+  const useReferences = (_a2 = options == null ? void 0 : options.useReferences) != null ? _a2 : false;
   return jsonSchema(
     // defer json schema creation to avoid unnecessary computation when only validation is needed
     () => addAdditionalPropertiesToJsonSchema(
@@ -2386,6 +2466,102 @@ function convertToBase64(value) {
   return value instanceof Uint8Array ? convertUint8ArrayToBase64(value) : value;
 }
 
+// src/validate-download-url.ts
+function validateDownloadUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (e) {
+    throw new DownloadError({
+      url,
+      message: `Invalid URL: ${url}`
+    });
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new DownloadError({
+      url,
+      message: `URL scheme must be http or https, got ${parsed.protocol}`
+    });
+  }
+  const hostname = parsed.hostname;
+  if (!hostname) {
+    throw new DownloadError({
+      url,
+      message: `URL must have a hostname`
+    });
+  }
+  if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".localhost")) {
+    throw new DownloadError({
+      url,
+      message: `URL with hostname ${hostname} is not allowed`
+    });
+  }
+  if (hostname.startsWith("[") && hostname.endsWith("]")) {
+    const ipv6 = hostname.slice(1, -1);
+    if (isPrivateIPv6(ipv6)) {
+      throw new DownloadError({
+        url,
+        message: `URL with IPv6 address ${hostname} is not allowed`
+      });
+    }
+    return;
+  }
+  if (isIPv4(hostname)) {
+    if (isPrivateIPv4(hostname)) {
+      throw new DownloadError({
+        url,
+        message: `URL with IP address ${hostname} is not allowed`
+      });
+    }
+    return;
+  }
+}
+function isIPv4(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) return false;
+  return parts.every((part) => {
+    const num = Number(part);
+    return Number.isInteger(num) && num >= 0 && num <= 255 && String(num) === part;
+  });
+}
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map(Number);
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::1") return true;
+  if (normalized === "::") return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mappedPart = normalized.slice(7);
+    if (isIPv4(mappedPart)) {
+      return isPrivateIPv4(mappedPart);
+    }
+    const hexParts = mappedPart.split(":");
+    if (hexParts.length === 2) {
+      const high = parseInt(hexParts[0], 16);
+      const low = parseInt(hexParts[1], 16);
+      if (!isNaN(high) && !isNaN(low)) {
+        const a = high >> 8 & 255;
+        const b = high & 255;
+        const c = low >> 8 & 255;
+        const d = low & 255;
+        return isPrivateIPv4(`${a}.${b}.${c}.${d}`);
+      }
+    }
+  }
+  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true;
+  if (normalized.startsWith("fe80")) return true;
+  return false;
+}
+
 // src/without-trailing-slash.ts
 function withoutTrailingSlash(url) {
   return url == null ? void 0 : url.replace(/\/$/, "");
@@ -2421,7 +2597,9 @@ import {
   EventSourceParserStream as EventSourceParserStream2
 } from "eventsource-parser/stream";
 export {
+  DEFAULT_MAX_DOWNLOAD_SIZE,
   DelayedPromise,
+  DownloadError,
   EventSourceParserStream2 as EventSourceParserStream,
   VERSION,
   asSchema,
@@ -2467,12 +2645,14 @@ export {
   postFormDataToApi,
   postJsonToApi,
   postToApi,
+  readResponseWithSizeLimit,
   removeUndefinedEntries,
   resolve,
   safeParseJSON,
   safeValidateTypes,
   standardSchemaValidator,
   tool,
+  validateDownloadUrl,
   validateTypes,
   validator,
   withUserAgentSuffix,