@ai-sdk/provider-utils 5.0.39 → 5.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "5.0.39",
+  "version": "5.0.40",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -32,7 +32,7 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/provider": "4.0.13",
+    "@ai-sdk/provider": "4.0.14",
     "@standard-schema/spec": "^1.1.0",
     "@workflow/serde": "4.1.0",
     "eventsource-parser": "^3.0.8",

package/src/detect-media-type.ts

@@ -3,7 +3,11 @@ import { convertBase64ToUint8Array } from './uint8-utils';
 const imageMediaTypeSignatures = [
   {
     mediaType: 'image/gif' as const,
-    bytesPrefix: [0x47, 0x49, 0x46], // GIF
+    bytesPrefix: [0x47, 0x49, 0x46, 0x38, 0x37, 0x61], // GIF87a
+  },
+  {
+    mediaType: 'image/gif' as const,
+    bytesPrefix: [0x47, 0x49, 0x46, 0x38, 0x39, 0x61], // GIF89a
   },
   {
     mediaType: 'image/png' as const,
@@ -32,7 +36,7 @@ const imageMediaTypeSignatures = [
   },
   {
     mediaType: 'image/bmp' as const,
-    bytesPrefix: [0x42, 0x4d],
+    bytesPrefix: [0x42, 0x4d, null, null, null, null, 0x00, 0x00, 0x00, 0x00],
   },
   {
     mediaType: 'image/tiff' as const,

package/src/fetch-with-validated-redirects.ts

@@ -14,6 +14,63 @@ const MAX_DOWNLOAD_REDIRECTS = 10;
 // even when a server attaches a Location header.
 const REDIRECT_STATUS_CODES = new Set([301, 302, 303, 307, 308]);
 
+async function getValidatedFetch(
+  customFetch: FetchFunction | undefined,
+): Promise<FetchFunction> {
+  // Callers commonly pass globalThis.fetch through several abstraction
+  // layers. Preserve the DNS-pinned Node.js default in that case rather than
+  // accidentally treating it as an intentionally custom fetch.
+  return customFetch == null || customFetch === globalThis.fetch
+    ? await getDefaultDownloadFetch()
+    : customFetch;
+}
+
+/**
+ * Fetches one validated URL without following redirects.
+ *
+ * On Node.js, the default fetch validates and pins DNS results at connect time.
+ * An injected fetch is responsible for equivalent connect-time validation.
+ * Redirects are rejected by default. Callers using `redirect: 'manual'` must
+ * validate the Location target before issuing another request.
+ */
+export async function fetchWithValidatedEndpoint({
+  url,
+  init,
+  fetch: customFetch,
+  trustedOrigin,
+  redirect = 'error',
+}: {
+  url: string | URL;
+  init?: RequestInit;
+  fetch?: FetchFunction;
+  /**
+   * A developer-configured origin that may legitimately resolve to a private
+   * address. This must never be derived from untrusted response data.
+   */
+  trustedOrigin?: string;
+  redirect?: 'error' | 'manual';
+}): Promise<Response> {
+  const urlText = url.toString();
+  const isTrusted =
+    trustedOrigin !== undefined && isSameOrigin(urlText, trustedOrigin);
+
+  if (!isTrusted) {
+    validateDownloadUrl(urlText);
+  }
+
+  const fetch =
+    isTrusted && customFetch != null
+      ? customFetch
+      : isTrusted
+        ? globalThis.fetch
+        : await getValidatedFetch(customFetch);
+
+  return await fetch(url, {
+    ...init,
+    redirect,
+  });
+}
+
 /**
  * Fetches a URL while enforcing the download guard on every hop.
  *
@@ -106,8 +163,11 @@ export async function fetchWithValidatedRedirects({
     }
 
     const fetch =
-      customFetch ??
-      (isTrustedHop ? globalThis.fetch : await getDefaultDownloadFetch());
+      isTrustedHop && customFetch != null
+        ? customFetch
+        : isTrustedHop
+          ? globalThis.fetch
+          : await getValidatedFetch(customFetch);
 
     const response = await fetch(currentUrl, perHopInit('manual'));
 
@@ -121,7 +181,7 @@ export async function fetchWithValidatedRedirects({
       return await fetch(currentUrl, perHopInit('follow'));
     }
 
-    const location = response.headers.get('location');
+    const location = response.headers?.get('location');
     if (REDIRECT_STATUS_CODES.has(response.status) && location) {
       // Release the redirect response's connection before moving to the next
       // hop. Whether that hop is followed or rejected by the guard, an

package/src/index.ts

@@ -31,7 +31,10 @@ export {
 export { downloadBlob } from './download-blob';
 export { DownloadError } from './download-error';
 export { EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL } from './embedding-model-capabilities';
-export { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+export {
+  fetchWithValidatedEndpoint,
+  fetchWithValidatedRedirects,
+} from './fetch-with-validated-redirects';
 export { extractLines } from './extract-lines';
 export * from './extract-response-headers';
 export * from './fetch-function';