@ai-sdk/provider-utils 4.0.60 → 4.0.62

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @ai-sdk/provider-utils
 
+## 4.0.62
+
+### Patch Changes
+
+- 1183cc4: Block `.internal` hostnames in download URL validation.
+- d726591: Encode provider-returned identifiers in follow-up request paths with a shared encodePathSegment helper.
+
+## 4.0.61
+
+### Patch Changes
+
+- 5aa3086: feat(openai-compatible): support URL-based image responses
+
+  Add opt-in URL validation and credential origin handling to `getFromApi` for URL-based image responses. Validate redirect targets, strip unsafe request headers, and drop credentials on cross-origin redirects while preserving existing unvalidated requests.
+
 ## 4.0.60
 
 ### Patch Changes

package/dist/index.d.mts

@@ -250,24 +250,34 @@ declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, tru
     redirect?: 'error' | 'manual';
 }): Promise<Response>;
 /**
- * Fetches a URL while enforcing the SSRF download guard on every hop.
+ * Fetches a URL while enforcing the download guard on every hop.
  *
  * Redirects are followed manually (`redirect: 'manual'`) so each hop is
  * validated with {@link validateDownloadUrl} *before* it is requested. Relying
  * on the default `redirect: 'follow'` would issue the request to a redirect
  * target (e.g. an internal address) before we ever see its URL, defeating the
- * SSRF guard.
+ * guard.
+ *
+ * Request headers are also protected: {@link sanitizeRequestHeaders} strips
+ * proxy/metadata/cookie/hop-by-hop headers before the first request, and all
+ * caller headers except `User-Agent` are dropped on a cross-origin redirect.
+ * Credentials and custom headers are preserved on the first hop for backwards
+ * compatibility. The caller must ensure that the initial URL may receive them.
+ * The fetch spec only strips `Authorization` on cross-origin redirects because
+ * in a browser, CORS preflighting protects custom headers; there is no CORS on
+ * the server, so provider API keys carried in custom headers (e.g. `x-key`)
+ * must be dropped here as well.
  *
  * A `redirect: 'manual'` request yields an unreadable opaque response in the
  * browser (and in other spec-compliant fetch implementations), so the redirect
  * target cannot be validated here. In a real browser this is safe to follow
- * natively because SSRF is not reachable (fetch is constrained by CORS and
- * cannot reach a server's internal network or cloud-metadata). On any other
- * runtime we cannot validate the hop, so we fail closed rather than follow it
- * blindly and bypass the SSRF guard.
+ * natively because reaching an internal network is not possible (fetch is
+ * constrained by CORS and cannot reach a server's internal network or
+ * cloud-metadata). On any other runtime we cannot validate the hop, so we fail
+ * closed rather than follow it blindly and bypass the guard.
  *
  * A hop that is same-origin with `trustedOrigin` (the developer-configured
- * endpoint) skips target validation: that origin is exactly what an
+ * provider endpoint) skips target validation: that origin is exactly what an
  * unvalidated, config-derived request would fetch anyway, and validating it
  * would break legitimate self-hosted / localhost deployments whose response
  * URLs point back at the configured host. Hops on any other origin are always
@@ -278,7 +288,8 @@ declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, tru
  *
  * On Node.js, the default fetch resolves every hostname through a validating
  * lookup hook and passes those exact addresses to the connector, preventing
- * hostname-to-private-IP and DNS-rebinding bypasses. Other runtimes should
+ * hostname-to-private-IP and DNS-rebinding bypasses. An injected fetch is
+ * responsible for equivalent connect-time validation. Other runtimes should
  * constrain egress at the network layer when handling untrusted URLs.
  *
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
@@ -291,8 +302,8 @@ declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRed
     maxRedirects?: number;
     fetch?: FetchFunction;
     /**
-     * A developer-configured origin whose hops skip target validation. Must
-     * never be derived from response data.
+     * A developer-configured origin (e.g. the provider's `baseURL`) whose hops
+     * skip target validation. Must never be derived from response data.
      */
     trustedOrigin?: string;
 }): Promise<Response>;
@@ -323,6 +334,13 @@ type IdGenerator = () => string;
  */
 declare const generateId: IdGenerator;
 
+/**
+ * Encodes a raw identifier as one URL path segment, including standalone dot
+ * segments that URL parsers would otherwise normalize. Pass unencoded values;
+ * for resource paths with intentional slashes, encode each segment separately.
+ */
+declare function encodePathSegment(value: string): string;
+
 declare function getErrorMessage(error: unknown | undefined): string;
 
 /**
@@ -467,13 +485,44 @@ declare const createJsonResponseHandler: <T>(responseSchema: FlexibleSchema<T>)
 declare const createBinaryResponseHandler: () => ResponseHandler<Uint8Array>;
 declare const createStatusCodeErrorResponseHandler: () => ResponseHandler<APICallError>;
 
-declare const getFromApi: <T>({ url, headers, successfulResponseHandler, failedResponseHandler, abortSignal, fetch, }: {
+declare const getFromApi: <T>({ url, headers, successfulResponseHandler, failedResponseHandler, abortSignal, fetch, validateUrl, credentialedOrigin, trustedOrigin, }: {
     url: string;
     headers?: Record<string, string | undefined>;
     failedResponseHandler: ResponseHandler<Error>;
     successfulResponseHandler: ResponseHandler<T>;
     abortSignal?: AbortSignal;
     fetch?: FetchFunction;
+    /**
+     * Set `true` when `url` is untrusted (e.g. taken from a provider response
+     * body): it is routed through {@link fetchWithValidatedRedirects}, which
+     * rejects private/loopback/link-local targets and re-validates redirect
+     * hops; blocked URLs throw `DownloadError`. Set `false` only for URLs built
+     * from a developer-configured endpoint.
+     *
+     * Optional for backwards compatibility with existing callers; omitting it
+     * behaves like `false` (no validation).
+     */
+    validateUrl?: boolean;
+    /**
+     * When set, `headers` are sent only if `url` is same-origin with this origin
+     * (the user-agent suffix is always kept). Pass the provider's configured
+     * base URL alongside `validateUrl: true` so credentials never ride a request
+     * to a response-supplied host on a different origin (e.g. a CDN). Redirects
+     * that later cross origin drop all caller headers regardless (see
+     * {@link fetchWithValidatedRedirects}).
+     */
+    credentialedOrigin?: string;
+    /**
+     * A developer-configured origin (e.g. the provider's `baseURL`) that is
+     * exempt from URL validation when `validateUrl` is `true`. A response URL
+     * (or redirect hop) that is same-origin with it is fetched without target
+     * validation — it points at exactly the host a config-derived
+     * `validateUrl: false` request would fetch anyway, so blocking it would
+     * only break legitimate self-hosted / localhost deployments whose response
+     * URLs point back at the configured host. Hops on any other origin are
+     * still validated. Must never be derived from response data.
+     */
+    trustedOrigin?: string;
 }) => Promise<{
     value: T;
     rawValue?: unknown;
@@ -1695,4 +1744,4 @@ interface ToolResult<NAME extends string, INPUT, OUTPUT> {
  */
 type ToolCallOptions = ToolExecutionOptions;
 
-export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER as EXPERIMENTAL_EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER, type EmbeddingModelProviderOptionsTransformer, type FetchFunction, type FilePart, type FlexibleSchema, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type LazySchema, type MaybePromiseLike, type ModelMessage, type ParseResult, type ProviderOptions, type ProviderToolFactory, type ProviderToolFactoryWithOutputSchema, type ReasoningPart, type Resolvable, type ResponseHandler, type RetryDelayProvider, type RetryErrorFactory, type RetryErrorReason, type RetryFunction, type Schema, type ShouldRetryFunction, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolApprovalRequest, type ToolApprovalResponse, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolExecutionOptions, type ToolModelMessage, type ToolNameMapping, type ToolNeedsApprovalFunction, type ToolResult, type ToolResultOutput, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, asSchema, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertImageModelFileToDataUri, convertToBase64, convertToFormData, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, createToolNameMapping, delay, downloadBlob, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isNonNullable, isParsableJson, isSameOrigin, isUrlSupported, jsonSchema, lazySchema, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, retryWithExponentialBackoff, safeParseJSON, safeValidateTypes, secureJsonParse, stripFileExtension, tool, validateDownloadUrl, validateTypes, withUserAgentSuffix, withoutTrailingSlash, zodSchema };
+export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER as EXPERIMENTAL_EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER, type EmbeddingModelProviderOptionsTransformer, type FetchFunction, type FilePart, type FlexibleSchema, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type LazySchema, type MaybePromiseLike, type ModelMessage, type ParseResult, type ProviderOptions, type ProviderToolFactory, type ProviderToolFactoryWithOutputSchema, type ReasoningPart, type Resolvable, type ResponseHandler, type RetryDelayProvider, type RetryErrorFactory, type RetryErrorReason, type RetryFunction, type Schema, type ShouldRetryFunction, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolApprovalRequest, type ToolApprovalResponse, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolExecutionOptions, type ToolModelMessage, type ToolNameMapping, type ToolNeedsApprovalFunction, type ToolResult, type ToolResultOutput, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, asSchema, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertImageModelFileToDataUri, convertToBase64, convertToFormData, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, createToolNameMapping, delay, downloadBlob, dynamicTool, encodePathSegment, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isNonNullable, isParsableJson, isSameOrigin, isUrlSupported, jsonSchema, lazySchema, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, retryWithExponentialBackoff, safeParseJSON, safeValidateTypes, secureJsonParse, stripFileExtension, tool, validateDownloadUrl, validateTypes, withUserAgentSuffix, withoutTrailingSlash, zodSchema };

package/dist/index.d.ts

@@ -250,24 +250,34 @@ declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, tru
     redirect?: 'error' | 'manual';
 }): Promise<Response>;
 /**
- * Fetches a URL while enforcing the SSRF download guard on every hop.
+ * Fetches a URL while enforcing the download guard on every hop.
  *
  * Redirects are followed manually (`redirect: 'manual'`) so each hop is
  * validated with {@link validateDownloadUrl} *before* it is requested. Relying
  * on the default `redirect: 'follow'` would issue the request to a redirect
  * target (e.g. an internal address) before we ever see its URL, defeating the
- * SSRF guard.
+ * guard.
+ *
+ * Request headers are also protected: {@link sanitizeRequestHeaders} strips
+ * proxy/metadata/cookie/hop-by-hop headers before the first request, and all
+ * caller headers except `User-Agent` are dropped on a cross-origin redirect.
+ * Credentials and custom headers are preserved on the first hop for backwards
+ * compatibility. The caller must ensure that the initial URL may receive them.
+ * The fetch spec only strips `Authorization` on cross-origin redirects because
+ * in a browser, CORS preflighting protects custom headers; there is no CORS on
+ * the server, so provider API keys carried in custom headers (e.g. `x-key`)
+ * must be dropped here as well.
  *
  * A `redirect: 'manual'` request yields an unreadable opaque response in the
  * browser (and in other spec-compliant fetch implementations), so the redirect
  * target cannot be validated here. In a real browser this is safe to follow
- * natively because SSRF is not reachable (fetch is constrained by CORS and
- * cannot reach a server's internal network or cloud-metadata). On any other
- * runtime we cannot validate the hop, so we fail closed rather than follow it
- * blindly and bypass the SSRF guard.
+ * natively because reaching an internal network is not possible (fetch is
+ * constrained by CORS and cannot reach a server's internal network or
+ * cloud-metadata). On any other runtime we cannot validate the hop, so we fail
+ * closed rather than follow it blindly and bypass the guard.
  *
  * A hop that is same-origin with `trustedOrigin` (the developer-configured
- * endpoint) skips target validation: that origin is exactly what an
+ * provider endpoint) skips target validation: that origin is exactly what an
  * unvalidated, config-derived request would fetch anyway, and validating it
  * would break legitimate self-hosted / localhost deployments whose response
  * URLs point back at the configured host. Hops on any other origin are always
@@ -278,7 +288,8 @@ declare function fetchWithValidatedEndpoint({ url, init, fetch: customFetch, tru
  *
  * On Node.js, the default fetch resolves every hostname through a validating
  * lookup hook and passes those exact addresses to the connector, preventing
- * hostname-to-private-IP and DNS-rebinding bypasses. Other runtimes should
+ * hostname-to-private-IP and DNS-rebinding bypasses. An injected fetch is
+ * responsible for equivalent connect-time validation. Other runtimes should
  * constrain egress at the network layer when handling untrusted URLs.
  *
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
@@ -291,8 +302,8 @@ declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRed
     maxRedirects?: number;
     fetch?: FetchFunction;
     /**
-     * A developer-configured origin whose hops skip target validation. Must
-     * never be derived from response data.
+     * A developer-configured origin (e.g. the provider's `baseURL`) whose hops
+     * skip target validation. Must never be derived from response data.
      */
     trustedOrigin?: string;
 }): Promise<Response>;
@@ -323,6 +334,13 @@ type IdGenerator = () => string;
  */
 declare const generateId: IdGenerator;
 
+/**
+ * Encodes a raw identifier as one URL path segment, including standalone dot
+ * segments that URL parsers would otherwise normalize. Pass unencoded values;
+ * for resource paths with intentional slashes, encode each segment separately.
+ */
+declare function encodePathSegment(value: string): string;
+
 declare function getErrorMessage(error: unknown | undefined): string;
 
 /**
@@ -467,13 +485,44 @@ declare const createJsonResponseHandler: <T>(responseSchema: FlexibleSchema<T>)
 declare const createBinaryResponseHandler: () => ResponseHandler<Uint8Array>;
 declare const createStatusCodeErrorResponseHandler: () => ResponseHandler<APICallError>;
 
-declare const getFromApi: <T>({ url, headers, successfulResponseHandler, failedResponseHandler, abortSignal, fetch, }: {
+declare const getFromApi: <T>({ url, headers, successfulResponseHandler, failedResponseHandler, abortSignal, fetch, validateUrl, credentialedOrigin, trustedOrigin, }: {
     url: string;
     headers?: Record<string, string | undefined>;
     failedResponseHandler: ResponseHandler<Error>;
     successfulResponseHandler: ResponseHandler<T>;
     abortSignal?: AbortSignal;
     fetch?: FetchFunction;
+    /**
+     * Set `true` when `url` is untrusted (e.g. taken from a provider response
+     * body): it is routed through {@link fetchWithValidatedRedirects}, which
+     * rejects private/loopback/link-local targets and re-validates redirect
+     * hops; blocked URLs throw `DownloadError`. Set `false` only for URLs built
+     * from a developer-configured endpoint.
+     *
+     * Optional for backwards compatibility with existing callers; omitting it
+     * behaves like `false` (no validation).
+     */
+    validateUrl?: boolean;
+    /**
+     * When set, `headers` are sent only if `url` is same-origin with this origin
+     * (the user-agent suffix is always kept). Pass the provider's configured
+     * base URL alongside `validateUrl: true` so credentials never ride a request
+     * to a response-supplied host on a different origin (e.g. a CDN). Redirects
+     * that later cross origin drop all caller headers regardless (see
+     * {@link fetchWithValidatedRedirects}).
+     */
+    credentialedOrigin?: string;
+    /**
+     * A developer-configured origin (e.g. the provider's `baseURL`) that is
+     * exempt from URL validation when `validateUrl` is `true`. A response URL
+     * (or redirect hop) that is same-origin with it is fetched without target
+     * validation — it points at exactly the host a config-derived
+     * `validateUrl: false` request would fetch anyway, so blocking it would
+     * only break legitimate self-hosted / localhost deployments whose response
+     * URLs point back at the configured host. Hops on any other origin are
+     * still validated. Must never be derived from response data.
+     */
+    trustedOrigin?: string;
 }) => Promise<{
     value: T;
     rawValue?: unknown;
@@ -1695,4 +1744,4 @@ interface ToolResult<NAME extends string, INPUT, OUTPUT> {
  */
 type ToolCallOptions = ToolExecutionOptions;
 
-export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER as EXPERIMENTAL_EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER, type EmbeddingModelProviderOptionsTransformer, type FetchFunction, type FilePart, type FlexibleSchema, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type LazySchema, type MaybePromiseLike, type ModelMessage, type ParseResult, type ProviderOptions, type ProviderToolFactory, type ProviderToolFactoryWithOutputSchema, type ReasoningPart, type Resolvable, type ResponseHandler, type RetryDelayProvider, type RetryErrorFactory, type RetryErrorReason, type RetryFunction, type Schema, type ShouldRetryFunction, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolApprovalRequest, type ToolApprovalResponse, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolExecutionOptions, type ToolModelMessage, type ToolNameMapping, type ToolNeedsApprovalFunction, type ToolResult, type ToolResultOutput, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, asSchema, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertImageModelFileToDataUri, convertToBase64, convertToFormData, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, createToolNameMapping, delay, downloadBlob, dynamicTool, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isNonNullable, isParsableJson, isSameOrigin, isUrlSupported, jsonSchema, lazySchema, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, retryWithExponentialBackoff, safeParseJSON, safeValidateTypes, secureJsonParse, stripFileExtension, tool, validateDownloadUrl, validateTypes, withUserAgentSuffix, withoutTrailingSlash, zodSchema };
+export { type AssistantContent, type AssistantModelMessage, DEFAULT_MAX_DOWNLOAD_SIZE, type DataContent, DelayedPromise, DownloadError, EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL, EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER as EXPERIMENTAL_EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER, type EmbeddingModelProviderOptionsTransformer, type FetchFunction, type FilePart, type FlexibleSchema, type IdGenerator, type ImagePart, type InferSchema, type InferToolInput, type InferToolOutput, type LazySchema, type MaybePromiseLike, type ModelMessage, type ParseResult, type ProviderOptions, type ProviderToolFactory, type ProviderToolFactoryWithOutputSchema, type ReasoningPart, type Resolvable, type ResponseHandler, type RetryDelayProvider, type RetryErrorFactory, type RetryErrorReason, type RetryFunction, type Schema, type ShouldRetryFunction, type StreamingToolCallDelta, StreamingToolCallTracker, type StreamingToolCallTrackerOptions, type SystemModelMessage, type TextPart, type Tool, type ToolApprovalRequest, type ToolApprovalResponse, type ToolCall, type ToolCallOptions, type ToolCallPart, type ToolContent, type ToolExecuteFunction, type ToolExecutionOptions, type ToolModelMessage, type ToolNameMapping, type ToolNeedsApprovalFunction, type ToolResult, type ToolResultOutput, type ToolResultPart, type UserContent, type UserModelMessage, VERSION, type ValidationResult, asSchema, cancelResponseBody, combineHeaders, convertAsyncIteratorToReadableStream, convertBase64ToUint8Array, convertImageModelFileToDataUri, convertToBase64, convertToFormData, convertUint8ArrayToBase64, createBinaryResponseHandler, createEventSourceResponseHandler, createIdGenerator, createJsonErrorResponseHandler, createJsonResponseHandler, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, createStatusCodeErrorResponseHandler, createToolNameMapping, delay, downloadBlob, dynamicTool, encodePathSegment, executeTool, extractResponseHeaders, fetchWithValidatedEndpoint, fetchWithValidatedRedirects, generateId, getErrorMessage, getFromApi, getRuntimeEnvironmentUserAgent, injectJsonInstructionIntoMessages, isAbortError, isBrowserRuntime, isNonNullable, isParsableJson, isSameOrigin, isUrlSupported, jsonSchema, lazySchema, loadApiKey, loadOptionalSetting, loadSetting, mediaTypeToExtension, normalizeHeaders, parseJSON, parseJsonEventStream, parseProviderOptions, postFormDataToApi, postJsonToApi, postToApi, readResponseWithSizeLimit, removeUndefinedEntries, resolve, retryWithExponentialBackoff, safeParseJSON, safeValidateTypes, secureJsonParse, stripFileExtension, tool, validateDownloadUrl, validateTypes, withUserAgentSuffix, withoutTrailingSlash, zodSchema };

package/dist/index.js

@@ -59,6 +59,7 @@ __export(index_exports, {
   delay: () => delay,
   downloadBlob: () => downloadBlob,
   dynamicTool: () => dynamicTool,
+  encodePathSegment: () => encodePathSegment,
   executeTool: () => executeTool,
   extractResponseHeaders: () => extractResponseHeaders,
   fetchWithValidatedEndpoint: () => fetchWithValidatedEndpoint,
@@ -390,7 +391,7 @@ function validateDownloadUrl(url) {
       message: `URL must have a hostname`
     });
   }
-  if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".localhost")) {
+  if (hostname === "localhost" || hostname.endsWith(".local") || hostname.endsWith(".localhost") || hostname.endsWith(".internal")) {
     throw new DownloadError({
       url,
       message: `URL with hostname ${hostname} is not allowed`
@@ -605,8 +606,45 @@ function getCurrentModulePath() {
   }
 }
 
+// src/sanitize-request-headers.ts
+var BLOCKED_REQUEST_HEADERS = [
+  // Hop-by-hop / transport (RFC 7230 §6.1)
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  // Host / virtual-host routing
+  "host",
+  // Proxy / origin spoofing
+  "forwarded",
+  "proxy-authorization",
+  "via",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  // Cloud metadata (GCP, AWS IMDSv1/v2, Azure, Alibaba, DigitalOcean)
+  "metadata",
+  "metadata-flavor",
+  "x-aws-ec2-metadata-token",
+  "x-metadata-token",
+  // Session / cookie
+  "cookie",
+  "set-cookie"
+];
+function sanitizeRequestHeaders(input) {
+  const headers = new Headers(input);
+  for (const name2 of BLOCKED_REQUEST_HEADERS) {
+    headers.delete(name2);
+  }
+  return headers;
+}
+
 // src/fetch-with-validated-redirects.ts
 var MAX_DOWNLOAD_REDIRECTS = 10;
+var REDIRECT_STATUS_CODES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 async function getValidatedFetch(customFetch) {
   return customFetch == null || customFetch === globalThis.fetch ? await getDefaultDownloadFetch() : customFetch;
 }
@@ -637,10 +675,14 @@ async function fetchWithValidatedRedirects({
   trustedOrigin
 }) {
   var _a2;
-  const baseInit = { signal: abortSignal };
-  if (headers !== void 0) {
-    baseInit.headers = headers;
-  }
+  let currentHeaders = headers === void 0 ? void 0 : sanitizeRequestHeaders(headers);
+  const perHopInit = (redirect) => {
+    const init = { signal: abortSignal, redirect };
+    if (currentHeaders !== void 0) {
+      init.headers = new Headers(currentHeaders);
+    }
+    return init;
+  };
   let currentUrl = url;
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
     const isTrustedHop = trustedOrigin !== void 0 && isSameOrigin(currentUrl, trustedOrigin);
@@ -648,10 +690,7 @@ async function fetchWithValidatedRedirects({
       validateDownloadUrl(currentUrl);
     }
     const fetch = isTrustedHop && customFetch != null ? customFetch : isTrustedHop ? globalThis.fetch : await getValidatedFetch(customFetch);
-    const response = await fetch(currentUrl, {
-      ...baseInit,
-      redirect: "manual"
-    });
+    const response = await fetch(currentUrl, perHopInit("manual"));
     if (response.type === "opaqueredirect") {
       if (!isBrowserRuntime()) {
         throw new DownloadError({
@@ -659,12 +698,19 @@ async function fetchWithValidatedRedirects({
           message: `Redirect from ${currentUrl} could not be validated and was blocked`
         });
       }
-      return await fetch(currentUrl, { ...baseInit, redirect: "follow" });
+      return await fetch(currentUrl, perHopInit("follow"));
     }
     const location = (_a2 = response.headers) == null ? void 0 : _a2.get("location");
-    if (response.status >= 300 && response.status < 400 && location) {
-      await cancelResponseBody(response);
-      currentUrl = new URL(location, currentUrl).toString();
+    if (REDIRECT_STATUS_CODES.has(response.status) && location) {
+      void cancelResponseBody(response);
+      const nextUrl = new URL(location, currentUrl).toString();
+      if (currentHeaders !== void 0 && !isSameOrigin(nextUrl, currentUrl)) {
+        const userAgent = currentHeaders.get("user-agent");
+        currentHeaders = new Headers(
+          userAgent == null ? void 0 : { "user-agent": userAgent }
+        );
+      }
+      currentUrl = nextUrl;
       continue;
     }
     return response;
@@ -800,6 +846,12 @@ var createIdGenerator = ({
 };
 var generateId = createIdGenerator();
 
+// src/encode-path-segment.ts
+function encodePathSegment(value) {
+  const encodedValue = encodeURIComponent(value);
+  return encodedValue === "." ? "%252E" : encodedValue === ".." ? "%252E%252E" : encodedValue;
+}
+
 // src/get-error-message.ts
 function getErrorMessage(error) {
   if (error == null) {
@@ -954,7 +1006,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.60" : "0.0.0-test";
+var VERSION = true ? "4.0.62" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -964,16 +1016,28 @@ var getFromApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch = getOriginalFetch()
+  fetch,
+  validateUrl,
+  credentialedOrigin,
+  trustedOrigin
 }) => {
   try {
-    const response = await fetch(url, {
+    const requestFetch = fetch != null ? fetch : getOriginalFetch();
+    const outgoingHeaders = credentialedOrigin !== void 0 && !isSameOrigin(url, credentialedOrigin) ? {} : headers;
+    const requestHeaders = withUserAgentSuffix(
+      outgoingHeaders,
+      `ai-sdk/provider-utils/${VERSION}`,
+      getRuntimeEnvironmentUserAgent()
+    );
+    const response = validateUrl ? await fetchWithValidatedRedirects({
+      url,
+      headers: requestHeaders,
+      abortSignal,
+      fetch,
+      trustedOrigin
+    }) : await requestFetch(url, {
       method: "GET",
-      headers: withUserAgentSuffix(
-        headers,
-        `ai-sdk/provider-utils/${VERSION}`,
-        getRuntimeEnvironmentUserAgent()
-      ),
+      headers: requestHeaders,
       signal: abortSignal
     });
     const responseHeaders = extractResponseHeaders(response);
@@ -3618,6 +3682,7 @@ var import_stream2 = require("eventsource-parser/stream");
   delay,
   downloadBlob,
   dynamicTool,
+  encodePathSegment,
   executeTool,
   extractResponseHeaders,
   fetchWithValidatedEndpoint,