@ai-sdk/provider-utils 4.0.13 → 4.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "4.0.13",
+  "version": "4.0.15",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -35,7 +35,7 @@
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
     "eventsource-parser": "^3.0.6",
-    "@ai-sdk/provider": "3.0.7"
+    "@ai-sdk/provider": "3.0.8"
   },
   "devDependencies": {
     "@types/node": "20.17.24",

package/src/download-blob.ts

@@ -1,16 +1,28 @@
 import { DownloadError } from './download-error';
+import {
+  readResponseWithSizeLimit,
+  DEFAULT_MAX_DOWNLOAD_SIZE,
+} from './read-response-with-size-limit';
 
 /**
  * Download a file from a URL and return it as a Blob.
  *
  * @param url - The URL to download from.
+ * @param options - Optional settings for the download.
+ * @param options.maxBytes - Maximum allowed download size in bytes. Defaults to 100 MiB.
+ * @param options.abortSignal - An optional abort signal to cancel the download.
  * @returns A Promise that resolves to the downloaded Blob.
  *
- * @throws DownloadError if the download fails.
+ * @throws DownloadError if the download fails or exceeds maxBytes.
  */
-export async function downloadBlob(url: string): Promise<Blob> {
+export async function downloadBlob(
+  url: string,
+  options?: { maxBytes?: number; abortSignal?: AbortSignal },
+): Promise<Blob> {
   try {
-    const response = await fetch(url);
+    const response = await fetch(url, {
+      signal: options?.abortSignal,
+    });
 
     if (!response.ok) {
       throw new DownloadError({
@@ -20,7 +32,14 @@ export async function downloadBlob(url: string): Promise<Blob> {
       });
     }
 
-    return await response.blob();
+    const data = await readResponseWithSizeLimit({
+      response,
+      url,
+      maxBytes: options?.maxBytes ?? DEFAULT_MAX_DOWNLOAD_SIZE,
+    });
+
+    const contentType = response.headers.get('content-type') ?? undefined;
+    return new Blob([data], contentType ? { type: contentType } : undefined);
   } catch (error) {
     if (DownloadError.isInstance(error)) {
       throw error;

package/src/index.ts

@@ -11,6 +11,10 @@ export { convertImageModelFileToDataUri } from './convert-image-model-file-to-da
 export { convertToFormData } from './convert-to-form-data';
 export { downloadBlob } from './download-blob';
 export { DownloadError } from './download-error';
+export {
+  readResponseWithSizeLimit,
+  DEFAULT_MAX_DOWNLOAD_SIZE,
+} from './read-response-with-size-limit';
 export * from './fetch-function';
 export { createIdGenerator, generateId, type IdGenerator } from './generate-id';
 export * from './get-error-message';

package/src/read-response-with-size-limit.ts

@@ -0,0 +1,97 @@
+import { DownloadError } from './download-error';
+
+/**
+ * Default maximum download size: 2 GiB.
+ *
+ * `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
+ * body internally, then creates the JS ArrayBuffer), so very large downloads
+ * risk exceeding the default V8 heap limit on 64-bit systems and terminating
+ * the process with an out-of-memory error.
+ *
+ * Setting this limit converts an unrecoverable OOM crash into a catchable
+ * `DownloadError`.
+ */
+export const DEFAULT_MAX_DOWNLOAD_SIZE = 2 * 1024 * 1024 * 1024;
+
+/**
+ * Reads a fetch Response body with a size limit to prevent memory exhaustion.
+ *
+ * Checks the Content-Length header for early rejection, then reads the body
+ * incrementally via ReadableStream and aborts with a DownloadError when the
+ * limit is exceeded.
+ *
+ * @param response - The fetch Response to read.
+ * @param url - The URL being downloaded (used in error messages).
+ * @param maxBytes - Maximum allowed bytes. Defaults to DEFAULT_MAX_DOWNLOAD_SIZE.
+ * @returns A Uint8Array containing the response body.
+ * @throws DownloadError if the response exceeds maxBytes.
+ */
+export async function readResponseWithSizeLimit({
+  response,
+  url,
+  maxBytes = DEFAULT_MAX_DOWNLOAD_SIZE,
+}: {
+  response: Response;
+  url: string;
+  maxBytes?: number;
+}): Promise<Uint8Array> {
+  // Early rejection based on Content-Length header
+  const contentLength = response.headers.get('content-length');
+  if (contentLength != null) {
+    const length = parseInt(contentLength, 10);
+    if (!isNaN(length) && length > maxBytes) {
+      throw new DownloadError({
+        url,
+        message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes (Content-Length: ${length}).`,
+      });
+    }
+  }
+
+  const body = response.body;
+
+  // Handle missing body (empty responses)
+  if (body == null) {
+    return new Uint8Array(0);
+  }
+
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let totalBytes = 0;
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+
+      if (done) {
+        break;
+      }
+
+      totalBytes += value.length;
+
+      if (totalBytes > maxBytes) {
+        throw new DownloadError({
+          url,
+          message: `Download of ${url} exceeded maximum size of ${maxBytes} bytes.`,
+        });
+      }
+
+      chunks.push(value);
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+
+  // Concatenate chunks into a single Uint8Array
+  const result = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+
+  return result;
+}

package/src/response-handler.ts

@@ -1,5 +1,4 @@
 import { APICallError, EmptyResponseBodyError } from '@ai-sdk/provider';
-import { ZodType } from 'zod/v4';
 import { extractResponseHeaders } from './extract-response-headers';
 import { parseJSON, ParseResult, safeParseJSON } from './parse-json';
 import { parseJsonEventStream } from './parse-json-event-stream';