@ai-sdk/provider-utils 4.0.39 → 4.0.41

package/dist/index.mjs

@@ -300,6 +300,19 @@ function validateDownloadUrl(url) {
     return;
   }
 }
+function validateDownloadAddress({
+  address,
+  family,
+  hostname
+}) {
+  const isUnsafe = family === 4 ? !isIPv4(address) || isPrivateIPv4(address) : family === 6 ? isPrivateIPv6(address) : true;
+  if (isUnsafe) {
+    throw new DownloadError({
+      url: hostname,
+      message: `Hostname ${hostname} resolved to disallowed IP address ${address}`
+    });
+  }
+}
 function isIPv4(hostname) {
   const parts = hostname.split(".");
   if (parts.length !== 4) return false;
@@ -386,6 +399,104 @@ function isPrivateIPv6(ip) {
   return false;
 }
 
+// src/safe-node-fetch.ts
+function createSafeLookup(lookup) {
+  return ((hostname, options, callback) => {
+    lookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) {
+        callback(error);
+        return;
+      }
+      try {
+        const [firstAddress] = addresses;
+        if (firstAddress == null) {
+          throw new Error(`Hostname ${hostname} did not resolve to an address`);
+        }
+        for (const { address, family } of addresses) {
+          validateDownloadAddress({ address, family, hostname });
+        }
+        if (options.all === true) {
+          callback(null, addresses);
+        } else {
+          callback(
+            null,
+            firstAddress.address,
+            firstAddress.family
+          );
+        }
+      } catch (error2) {
+        callback(
+          error2 instanceof Error ? error2 : new Error(String(error2))
+        );
+      }
+    });
+  });
+}
+var safeNodeFetchPromise;
+var initialGlobalFetch = globalThis.fetch;
+var initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
+function isNodeRuntime() {
+  var _a2, _b2;
+  const runtimeProcess = globalThis.process;
+  return ((_a2 = runtimeProcess == null ? void 0 : runtimeProcess.release) == null ? void 0 : _a2.name) === "node" && ((_b2 = runtimeProcess.versions) == null ? void 0 : _b2.bun) == null;
+}
+async function getDefaultDownloadFetch() {
+  if (!isNodeRuntime() || !initialGlobalFetchIsNodeDefault || globalThis.fetch !== initialGlobalFetch) {
+    return globalThis.fetch;
+  }
+  return safeNodeFetchPromise != null ? safeNodeFetchPromise : safeNodeFetchPromise = createSafeNodeFetch();
+}
+function isNodeDefaultFetch(fetch) {
+  const source = Function.prototype.toString.call(fetch);
+  return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
+async function createSafeNodeFetch() {
+  const [{ createRequire }, { lookup }] = await Promise.all([
+    loadNodeModule("node:module"),
+    loadNodeModule("node:dns")
+  ]);
+  const { Agent, fetch } = createRequire(getCurrentModulePath())(
+    "undici"
+  );
+  const dispatcher = new Agent({
+    connect: {
+      lookup: createSafeLookup(lookup)
+    }
+  });
+  return ((input, init) => fetch(
+    input,
+    {
+      ...init,
+      dispatcher
+    }
+  ));
+}
+async function loadNodeModule(id) {
+  var _a2;
+  const processWithBuiltins = globalThis.process;
+  const builtinModule = (_a2 = processWithBuiltins == null ? void 0 : processWithBuiltins.getBuiltinModule) == null ? void 0 : _a2.call(processWithBuiltins, id);
+  return builtinModule == null ? await importNodeModule(id) : builtinModule;
+}
+function importNodeModule(id) {
+  return import(id);
+}
+function getCurrentModulePath() {
+  const originalPrepareStackTrace = Error.prepareStackTrace;
+  try {
+    Error.prepareStackTrace = (_error, callSites) => callSites;
+    const error = new Error("Capture current module path");
+    Error.captureStackTrace(error, getCurrentModulePath);
+    const [caller] = error.stack;
+    const fileName = caller == null ? void 0 : caller.getFileName();
+    if (fileName == null) {
+      throw new Error("Unable to determine the current module path");
+    }
+    return fileName;
+  } finally {
+    Error.prepareStackTrace = originalPrepareStackTrace;
+  }
+}
+
 // src/fetch-with-validated-redirects.ts
 var MAX_DOWNLOAD_REDIRECTS = 10;
 async function fetchWithValidatedRedirects({
@@ -401,6 +512,7 @@ async function fetchWithValidatedRedirects({
   let currentUrl = url;
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
     validateDownloadUrl(currentUrl);
+    const fetch = await getDefaultDownloadFetch();
     const response = await fetch(currentUrl, {
       ...baseInit,
       redirect: "manual"
@@ -677,7 +789,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.39" : "0.0.0-test";
+var VERSION = true ? "4.0.41" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -687,10 +799,10 @@ var getFromApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch: fetch2 = getOriginalFetch()
+  fetch = getOriginalFetch()
 }) => {
   try {
-    const response = await fetch2(url, {
+    const response = await fetch(url, {
       method: "GET",
       headers: withUserAgentSuffix(
         headers,
@@ -2451,7 +2563,7 @@ var postJsonToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 }) => postToApi({
   url,
   headers: {
@@ -2465,7 +2577,7 @@ var postJsonToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 });
 var postFormDataToApi = async ({
   url,
@@ -2474,7 +2586,7 @@ var postFormDataToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 }) => postToApi({
   url,
   headers,
@@ -2485,7 +2597,7 @@ var postFormDataToApi = async ({
   failedResponseHandler,
   successfulResponseHandler,
   abortSignal,
-  fetch: fetch2
+  fetch
 });
 var postToApi = async ({
   url,
@@ -2494,10 +2606,10 @@ var postToApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch: fetch2 = getOriginalFetch2()
+  fetch = getOriginalFetch2()
 }) => {
   try {
-    const response = await fetch2(url, {
+    const response = await fetch(url, {
       method: "POST",
       headers: withUserAgentSuffix(
         headers,