@ai-sdk/provider-utils 3.0.40 → 3.0.41

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @ai-sdk/provider-utils
 
+## 3.0.41
+
+### Patch Changes
+
+- 2b1c2df: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.
+- 2b1c2df: fix(mcp): prevent SSRF in OAuth metadata discovery
+- 2b1c2df: fix(provider-utils): make lazy Undici import visible to deployment tracers
+
 ## 3.0.40
 
 ### Patch Changes

package/dist/index.d.mts

@@ -80,6 +80,30 @@ declare class DownloadError extends AISDKError {
  */
 declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
 
+/**
+ * Fetch function type (standardizes the version of fetch used).
+ */
+type FetchFunction = typeof globalThis.fetch;
+
+/**
+ * Fetches one validated URL without following redirects.
+ *
+ * On Node.js, the default fetch validates and pins DNS results at connect time.
+ * An injected fetch is responsible for equivalent connect-time validation.
+ * Redirects are rejected by default. Callers using `redirect: 'manual'` must
+ * validate the Location target before issuing another request.
+ */
+declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, trustedOrigin, redirect, }: {
+    url: string | URL;
+    init?: RequestInit;
+    fetch?: FetchFunction;
+    /**
+     * A developer-configured origin that may legitimately resolve to a private
+     * address. This must never be derived from untrusted response data.
+     */
+    trustedOrigin?: string;
+    redirect?: 'error' | 'manual';
+}): Promise<Response>;
 /**
  * Fetches a URL while enforcing the SSRF download guard on every hop.
  *
@@ -97,6 +121,13 @@ declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
  * runtime we cannot validate the hop, so we fail closed rather than follow it
  * blindly and bypass the SSRF guard.
  *
+ * A hop that is same-origin with `trustedOrigin` (the developer-configured
+ * endpoint) skips target validation: that origin is exactly what an
+ * unvalidated, config-derived request would fetch anyway, and validating it
+ * would break legitimate self-hosted / localhost deployments whose response
+ * URLs point back at the configured host. Hops on any other origin are always
+ * validated.
+ *
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
@@ -108,11 +139,17 @@ declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
  * a redirect cannot be validated on a non-browser runtime.
  */
-declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, }: {
+declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, fetch: customFetch, trustedOrigin, }: {
     url: string;
     headers?: HeadersInit;
     abortSignal?: AbortSignal;
     maxRedirects?: number;
+    fetch?: FetchFunction;
+    /**
+     * A developer-configured origin whose hops skip target validation. Must
+     * never be derived from response data.
+     */
+    trustedOrigin?: string;
 }): Promise<Response>;
 
 /**
@@ -156,11 +193,6 @@ declare function readResponseWithSizeLimit({ response, url, maxBytes, }: {
     maxBytes?: number;
 }): Promise<Uint8Array>;
 
-/**
- * Fetch function type (standardizes the version of fetch used).
- */
-type FetchFunction = typeof globalThis.fetch;
-
 /**
 Creates an ID generator.
 The total length of the ID is the sum of the prefix, separator, and random part length.
@@ -1165,4 +1197,4 @@ interface ToolResult<NAME extends string, INPUT, OUTPUT> {
     dynamic?: boolean;
 }
 
-export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, type FetchFunction, type FilePart, type FlexibleSchema, type FlexibleValidator, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type InferValidator, type LazySchema, type LazyValidator, type ModelMessage, type ParseResult, type ProviderDefinedToolFactory, type ProviderDefinedToolFactoryWithOutputSchema, type ProviderOptions, type ReasoningPart, type Resolvable, type ResponseHandler, type Schema, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolModelMessage, type ToolResult, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, type Validator, asSchema, asValidator, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertToBase64, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createJsonStreamResponseHandler, createProviderDefinedToolFactory, createProviderDefinedToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, delay, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isParsableJson, isSameOrigin, isUrlSupported, isValidator, jsonSchema, lazySchema, lazyValidator, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, safeParseJSON, safeValidateTypes, standardSchemaValidator, tool, validateDownloadUrl, validateTypes, validator, withUserAgentSuffix, withoutTrailingSlash, zodSchema };
+export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, type FetchFunction, type FilePart, type FlexibleSchema, type FlexibleValidator, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type InferValidator, type LazySchema, type LazyValidator, type ModelMessage, type ParseResult, type ProviderDefinedToolFactory, type ProviderDefinedToolFactoryWithOutputSchema, type ProviderOptions, type ReasoningPart, type Resolvable, type ResponseHandler, type Schema, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolModelMessage, type ToolResult, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, type Validator, asSchema, asValidator, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertToBase64, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createJsonStreamResponseHandler, createProviderDefinedToolFactory, createProviderDefinedToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, delay, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isParsableJson, isSameOrigin, isUrlSupported, isValidator, jsonSchema, lazySchema, lazyValidator, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, safeParseJSON, safeValidateTypes, standardSchemaValidator, tool, validateDownloadUrl, validateTypes, validator, withUserAgentSuffix, withoutTrailingSlash, zodSchema };

package/dist/index.d.ts

@@ -80,6 +80,30 @@ declare class DownloadError extends AISDKError {
  */
 declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
 
+/**
+ * Fetch function type (standardizes the version of fetch used).
+ */
+type FetchFunction = typeof globalThis.fetch;
+
+/**
+ * Fetches one validated URL without following redirects.
+ *
+ * On Node.js, the default fetch validates and pins DNS results at connect time.
+ * An injected fetch is responsible for equivalent connect-time validation.
+ * Redirects are rejected by default. Callers using `redirect: 'manual'` must
+ * validate the Location target before issuing another request.
+ */
+declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, trustedOrigin, redirect, }: {
+    url: string | URL;
+    init?: RequestInit;
+    fetch?: FetchFunction;
+    /**
+     * A developer-configured origin that may legitimately resolve to a private
+     * address. This must never be derived from untrusted response data.
+     */
+    trustedOrigin?: string;
+    redirect?: 'error' | 'manual';
+}): Promise<Response>;
 /**
  * Fetches a URL while enforcing the SSRF download guard on every hop.
  *
@@ -97,6 +121,13 @@ declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
  * runtime we cannot validate the hop, so we fail closed rather than follow it
  * blindly and bypass the SSRF guard.
  *
+ * A hop that is same-origin with `trustedOrigin` (the developer-configured
+ * endpoint) skips target validation: that origin is exactly what an
+ * unvalidated, config-derived request would fetch anyway, and validating it
+ * would break legitimate self-hosted / localhost deployments whose response
+ * URLs point back at the configured host. Hops on any other origin are always
+ * validated.
+ *
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
@@ -108,11 +139,17 @@ declare const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL: unique symbol;
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
  * a redirect cannot be validated on a non-browser runtime.
  */
-declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, }: {
+declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, fetch: customFetch, trustedOrigin, }: {
     url: string;
     headers?: HeadersInit;
     abortSignal?: AbortSignal;
     maxRedirects?: number;
+    fetch?: FetchFunction;
+    /**
+     * A developer-configured origin whose hops skip target validation. Must
+     * never be derived from response data.
+     */
+    trustedOrigin?: string;
 }): Promise<Response>;
 
 /**
@@ -156,11 +193,6 @@ declare function readResponseWithSizeLimit({ response, url, maxBytes, }: {
     maxBytes?: number;
 }): Promise<Uint8Array>;
 
-/**
- * Fetch function type (standardizes the version of fetch used).
- */
-type FetchFunction = typeof globalThis.fetch;
-
 /**
 Creates an ID generator.
 The total length of the ID is the sum of the prefix, separator, and random part length.
@@ -1165,4 +1197,4 @@ interface ToolResult<NAME extends string, INPUT, OUTPUT> {
     dynamic?: boolean;
 }
 
-export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, type FetchFunction, type FilePart, type FlexibleSchema, type FlexibleValidator, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type InferValidator, type LazySchema, type LazyValidator, type ModelMessage, type ParseResult, type ProviderDefinedToolFactory, type ProviderDefinedToolFactoryWithOutputSchema, type ProviderOptions, type ReasoningPart, type Resolvable, type ResponseHandler, type Schema, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolModelMessage, type ToolResult, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, type Validator, asSchema, asValidator, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertToBase64, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createJsonStreamResponseHandler, createProviderDefinedToolFactory, createProviderDefinedToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, delay, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isParsableJson, isSameOrigin, isUrlSupported, isValidator, jsonSchema, lazySchema, lazyValidator, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, safeParseJSON, safeValidateTypes, standardSchemaValidator, tool, validateDownloadUrl, validateTypes, validator, withUserAgentSuffix, withoutTrailingSlash, zodSchema };
+export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, type FetchFunction, type FilePart, type FlexibleSchema, type FlexibleValidator, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type InferValidator, type LazySchema, type LazyValidator, type ModelMessage, type ParseResult, type ProviderDefinedToolFactory, type ProviderDefinedToolFactoryWithOutputSchema, type ProviderOptions, type ReasoningPart, type Resolvable, type ResponseHandler, type Schema, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolModelMessage, type ToolResult, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, type Validator, asSchema, asValidator, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertToBase64, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createJsonStreamResponseHandler, createProviderDefinedToolFactory, createProviderDefinedToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, delay, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isParsableJson, isSameOrigin, isUrlSupported, isValidator, jsonSchema, lazySchema, lazyValidator, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, safeParseJSON, safeValidateTypes, standardSchemaValidator, tool, validateDownloadUrl, validateTypes, validator, withUserAgentSuffix, withoutTrailingSlash, zodSchema };

package/dist/index.js

@@ -59,6 +59,7 @@ __export(index_exports, {
   dynamicTool: () => dynamicTool,
   executeTool: () => executeTool,
   extractResponseHeaders: () => extractResponseHeaders,
+  fetchWithValidatedEndpoint: () => fetchWithValidatedEndpoint,
   fetchWithValidatedRedirects: () => fetchWithValidatedRedirects,
   generateId: () => generateId,
   getErrorMessage: () => getErrorMessage,
@@ -276,6 +277,15 @@ function isBrowserRuntime(globalThisAny = globalThis) {
   return globalThisAny.window != null;
 }
 
+// src/is-same-origin.ts
+function isSameOrigin(url, baseUrl) {
+  try {
+    return new URL(url).origin === new URL(baseUrl).origin;
+  } catch (e) {
+    return false;
+  }
+}
+
 // src/validate-download-url.ts
 function validateDownloadUrl(url) {
   let parsed;
@@ -461,34 +471,24 @@ function createSafeLookup(lookup) {
   });
 }
 var safeNodeFetchPromise;
-var initialGlobalFetch = globalThis.fetch;
-var initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
 function isNodeRuntime() {
-  var _a2, _b2;
+  var _a2, _b2, _c;
   const runtimeProcess = globalThis.process;
-  return ((_a2 = runtimeProcess == null ? void 0 : runtimeProcess.release) == null ? void 0 : _a2.name) === "node" && ((_b2 = runtimeProcess.versions) == null ? void 0 : _b2.bun) == null;
+  return ((_a2 = runtimeProcess == null ? void 0 : runtimeProcess.release) == null ? void 0 : _a2.name) === "node" && ((_b2 = runtimeProcess.versions) == null ? void 0 : _b2.bun) == null && ((_c = runtimeProcess.versions) == null ? void 0 : _c.deno) == null && runtimeProcess.title !== "workerd" && globalThis.EdgeRuntime == null;
 }
 async function getDefaultDownloadFetch() {
-  if (!isNodeRuntime() || !initialGlobalFetchIsNodeDefault || globalThis.fetch !== initialGlobalFetch) {
+  if (!isNodeRuntime()) {
     return globalThis.fetch;
   }
   return safeNodeFetchPromise != null ? safeNodeFetchPromise : safeNodeFetchPromise = createSafeNodeFetch();
 }
-function isNodeDefaultFetch(fetch) {
-  if (typeof fetch !== "function") {
-    return false;
-  }
-  const source = Function.prototype.toString.call(fetch);
-  return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
-}
 async function createSafeNodeFetch() {
-  const [{ createRequire }, { lookup }] = await Promise.all([
+  const [module2, { lookup }] = await Promise.all([
     loadNodeModule("node:module"),
     loadNodeModule("node:dns")
   ]);
-  const { Agent, fetch } = createRequire(getCurrentModulePath())(
-    "undici"
-  );
+  const nodeRequire = module2.createRequire(getCurrentModulePath());
+  const { Agent, fetch } = nodeRequire("undici");
   const dispatcher = new Agent({
     connect: {
       lookup: createSafeLookup(lookup)
@@ -530,20 +530,47 @@ function getCurrentModulePath() {
 
 // src/fetch-with-validated-redirects.ts
 var MAX_DOWNLOAD_REDIRECTS = 10;
+async function getValidatedFetch(customFetch) {
+  return customFetch == null || customFetch === globalThis.fetch ? await getDefaultDownloadFetch() : customFetch;
+}
+async function fetchWithValidatedEndpoint({
+  url,
+  init,
+  fetch: customFetch,
+  trustedOrigin,
+  redirect = "error"
+}) {
+  const urlText = url.toString();
+  const isTrusted = trustedOrigin !== void 0 && isSameOrigin(urlText, trustedOrigin);
+  if (!isTrusted) {
+    validateDownloadUrl(urlText);
+  }
+  const fetch = isTrusted && customFetch != null ? customFetch : isTrusted ? globalThis.fetch : await getValidatedFetch(customFetch);
+  return await fetch(url, {
+    ...init,
+    redirect
+  });
+}
 async function fetchWithValidatedRedirects({
   url,
   headers,
   abortSignal,
-  maxRedirects = MAX_DOWNLOAD_REDIRECTS
+  maxRedirects = MAX_DOWNLOAD_REDIRECTS,
+  fetch: customFetch,
+  trustedOrigin
 }) {
+  var _a2;
   const baseInit = { signal: abortSignal };
   if (headers !== void 0) {
     baseInit.headers = headers;
   }
   let currentUrl = url;
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
-    validateDownloadUrl(currentUrl);
-    const fetch = await getDefaultDownloadFetch();
+    const isTrustedHop = trustedOrigin !== void 0 && isSameOrigin(currentUrl, trustedOrigin);
+    if (!isTrustedHop) {
+      validateDownloadUrl(currentUrl);
+    }
+    const fetch = isTrustedHop && customFetch != null ? customFetch : isTrustedHop ? globalThis.fetch : await getValidatedFetch(customFetch);
     const response = await fetch(currentUrl, {
       ...baseInit,
       redirect: "manual"
@@ -557,7 +584,7 @@ async function fetchWithValidatedRedirects({
       }
       return await fetch(currentUrl, { ...baseInit, redirect: "follow" });
     }
-    const location = response.headers.get("location");
+    const location = (_a2 = response.headers) == null ? void 0 : _a2.get("location");
     if (response.status >= 300 && response.status < 400 && location) {
       await cancelResponseBody(response);
       currentUrl = new URL(location, currentUrl).toString();
@@ -811,7 +838,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "3.0.40" : "0.0.0-test";
+var VERSION = true ? "3.0.41" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -922,15 +949,6 @@ function injectJsonInstructionIntoMessages({
   ];
 }
 
-// src/is-same-origin.ts
-function isSameOrigin(url, baseUrl) {
-  try {
-    return new URL(url).origin === new URL(baseUrl).origin;
-  } catch (e) {
-    return false;
-  }
-}
-
 // src/is-url-supported.ts
 function isUrlSupported({
   mediaType,
@@ -3435,6 +3453,7 @@ var import_stream2 = require("eventsource-parser/stream");
   dynamicTool,
   executeTool,
   extractResponseHeaders,
+  fetchWithValidatedEndpoint,
   fetchWithValidatedRedirects,
   generateId,
   getErrorMessage,