@ai-sdk/provider-utils 3.0.29 → 3.0.31

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ai-sdk/provider-utils
 
+## 3.0.31
+
+### Patch Changes
+
+- 7a6bdbc: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
+
+## 3.0.30
+
+### Patch Changes
+
+- 2fd6076: fix(ai): call `onInputStart` before `onInputAvailable` during non-streaming tool calls
+
 ## 3.0.29
 
 ### Patch Changes

package/dist/index.d.mts

@@ -92,6 +92,11 @@ declare class DownloadError extends AISDKError {
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
+ * On Node.js, the default fetch resolves every hostname through a validating
+ * lookup hook and passes those exact addresses to the connector, preventing
+ * hostname-to-private-IP and DNS-rebinding bypasses. Other runtimes should
+ * constrain egress at the network layer when handling untrusted URLs.
+ *
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
  * a redirect cannot be validated on a non-browser runtime.
  */
@@ -799,8 +804,8 @@ type Tool<INPUT extends JSONValue | unknown | never = any, OUTPUT extends JSONVa
      */
     inputSchema: FlexibleSchema<INPUT>;
     /**
-     * Optional function that is called when the argument streaming starts.
-     * Only called when the tool is used in a streaming context.
+     * Optional function that is called when the model starts generating the tool input.
+     * In non-streaming contexts, it is called immediately before `onInputAvailable`.
      */
     onInputStart?: (options: ToolCallOptions) => void | PromiseLike<void>;
     /**
@@ -945,9 +950,8 @@ declare function convertToBase64(value: string | Uint8Array): string;
  * Validates that a URL is safe to download from, blocking private/internal addresses
  * to prevent SSRF attacks.
  *
- * Note: this performs string/literal-IP checks only. It does not resolve DNS, so a
- * hostname that resolves to a private address is not blocked here (see callers, which
- * should additionally constrain egress at the network layer when handling untrusted URLs).
+ * Note: this function performs string/literal-IP checks only. The Node.js
+ * download fetch additionally validates and pins DNS results at connect time.
  *
  * @param url - The URL string to validate.
  * @throws DownloadError if the URL is unsafe.

package/dist/index.d.ts

@@ -92,6 +92,11 @@ declare class DownloadError extends AISDKError {
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
+ * On Node.js, the default fetch resolves every hostname through a validating
+ * lookup hook and passes those exact addresses to the connector, preventing
+ * hostname-to-private-IP and DNS-rebinding bypasses. Other runtimes should
+ * constrain egress at the network layer when handling untrusted URLs.
+ *
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
  * a redirect cannot be validated on a non-browser runtime.
  */
@@ -799,8 +804,8 @@ type Tool<INPUT extends JSONValue | unknown | never = any, OUTPUT extends JSONVa
      */
     inputSchema: FlexibleSchema<INPUT>;
     /**
-     * Optional function that is called when the argument streaming starts.
-     * Only called when the tool is used in a streaming context.
+     * Optional function that is called when the model starts generating the tool input.
+     * In non-streaming contexts, it is called immediately before `onInputAvailable`.
      */
     onInputStart?: (options: ToolCallOptions) => void | PromiseLike<void>;
     /**
@@ -945,9 +950,8 @@ declare function convertToBase64(value: string | Uint8Array): string;
  * Validates that a URL is safe to download from, blocking private/internal addresses
  * to prevent SSRF attacks.
  *
- * Note: this performs string/literal-IP checks only. It does not resolve DNS, so a
- * hostname that resolves to a private address is not blocked here (see callers, which
- * should additionally constrain egress at the network layer when handling untrusted URLs).
+ * Note: this function performs string/literal-IP checks only. The Node.js
+ * download fetch additionally validates and pins DNS results at connect time.
  *
  * @param url - The URL string to validate.
  * @throws DownloadError if the URL is unsafe.

package/dist/index.js

@@ -322,6 +322,19 @@ function validateDownloadUrl(url) {
     return;
   }
 }
+function validateDownloadAddress({
+  address,
+  family,
+  hostname
+}) {
+  const isUnsafe = family === 4 ? !isIPv4(address) || isPrivateIPv4(address) : family === 6 ? isPrivateIPv6(address) : true;
+  if (isUnsafe) {
+    throw new DownloadError({
+      url: hostname,
+      message: `Hostname ${hostname} resolved to disallowed IP address ${address}`
+    });
+  }
+}
 function isIPv4(hostname) {
   const parts = hostname.split(".");
   if (parts.length !== 4) return false;
@@ -408,6 +421,104 @@ function isPrivateIPv6(ip) {
   return false;
 }
 
+// src/safe-node-fetch.ts
+function createSafeLookup(lookup) {
+  return ((hostname, options, callback) => {
+    lookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) {
+        callback(error);
+        return;
+      }
+      try {
+        const [firstAddress] = addresses;
+        if (firstAddress == null) {
+          throw new Error(`Hostname ${hostname} did not resolve to an address`);
+        }
+        for (const { address, family } of addresses) {
+          validateDownloadAddress({ address, family, hostname });
+        }
+        if (options.all === true) {
+          callback(null, addresses);
+        } else {
+          callback(
+            null,
+            firstAddress.address,
+            firstAddress.family
+          );
+        }
+      } catch (error2) {
+        callback(
+          error2 instanceof Error ? error2 : new Error(String(error2))
+        );
+      }
+    });
+  });
+}
+var safeNodeFetchPromise;
+var initialGlobalFetch = globalThis.fetch;
+var initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
+function isNodeRuntime() {
+  var _a2, _b2;
+  const runtimeProcess = globalThis.process;
+  return ((_a2 = runtimeProcess == null ? void 0 : runtimeProcess.release) == null ? void 0 : _a2.name) === "node" && ((_b2 = runtimeProcess.versions) == null ? void 0 : _b2.bun) == null;
+}
+async function getDefaultDownloadFetch() {
+  if (!isNodeRuntime() || !initialGlobalFetchIsNodeDefault || globalThis.fetch !== initialGlobalFetch) {
+    return globalThis.fetch;
+  }
+  return safeNodeFetchPromise != null ? safeNodeFetchPromise : safeNodeFetchPromise = createSafeNodeFetch();
+}
+function isNodeDefaultFetch(fetch) {
+  const source = Function.prototype.toString.call(fetch);
+  return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
+async function createSafeNodeFetch() {
+  const [{ createRequire }, { lookup }] = await Promise.all([
+    loadNodeModule("node:module"),
+    loadNodeModule("node:dns")
+  ]);
+  const { Agent, fetch } = createRequire(getCurrentModulePath())(
+    "undici"
+  );
+  const dispatcher = new Agent({
+    connect: {
+      lookup: createSafeLookup(lookup)
+    }
+  });
+  return ((input, init) => fetch(
+    input,
+    {
+      ...init,
+      dispatcher
+    }
+  ));
+}
+async function loadNodeModule(id) {
+  var _a2;
+  const processWithBuiltins = globalThis.process;
+  const builtinModule = (_a2 = processWithBuiltins == null ? void 0 : processWithBuiltins.getBuiltinModule) == null ? void 0 : _a2.call(processWithBuiltins, id);
+  return builtinModule == null ? await importNodeModule(id) : builtinModule;
+}
+function importNodeModule(id) {
+  return import(id);
+}
+function getCurrentModulePath() {
+  const originalPrepareStackTrace = Error.prepareStackTrace;
+  try {
+    Error.prepareStackTrace = (_error, callSites) => callSites;
+    const error = new Error("Capture current module path");
+    Error.captureStackTrace(error, getCurrentModulePath);
+    const [caller] = error.stack;
+    const fileName = caller == null ? void 0 : caller.getFileName();
+    if (fileName == null) {
+      throw new Error("Unable to determine the current module path");
+    }
+    return fileName;
+  } finally {
+    Error.prepareStackTrace = originalPrepareStackTrace;
+  }
+}
+
 // src/fetch-with-validated-redirects.ts
 var MAX_DOWNLOAD_REDIRECTS = 10;
 async function fetchWithValidatedRedirects({
@@ -423,6 +534,7 @@ async function fetchWithValidatedRedirects({
   let currentUrl = url;
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
     validateDownloadUrl(currentUrl);
+    const fetch = await getDefaultDownloadFetch();
     const response = await fetch(currentUrl, {
       ...baseInit,
       redirect: "manual"
@@ -640,7 +752,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.0.29" : "0.0.0-test";
+var VERSION = true ? "3.0.31" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -650,10 +762,10 @@ var getFromApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch: fetch2 = getOriginalFetch()
+  fetch = getOriginalFetch()
 }) => {
   try {
-    const response = await fetch2(url, {
+    const response = await fetch(url, {
       method: "GET",
       headers: withUserAgentSuffix(
         headers,
@@ -1099,7 +1211,7 @@ var postJsonToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 }) => postToApi({
   url,
   headers: {
@@ -1113,7 +1225,7 @@ var postJsonToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 });
 var postFormDataToApi = async ({
   url,
@@ -1122,7 +1234,7 @@ var postFormDataToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 }) => postToApi({
   url,
   headers,
@@ -1133,7 +1245,7 @@ var postFormDataToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 });
 var postToApi = async ({
   url,
@@ -1142,10 +1254,10 @@ var postToApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch: fetch2 = getOriginalFetch2()
+  fetch = getOriginalFetch2()
 }) => {
   try {
-    const response = await fetch2(url, {
+    const response = await fetch(url, {
       method: "POST",
       headers: withUserAgentSuffix(
         headers,