@ai-sdk/provider-utils 5.0.47 → 5.0.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "5.0.47",
+  "version": "5.0.50",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -37,7 +37,7 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/provider": "4.0.18",
+    "@ai-sdk/provider": "4.0.19",
     "@standard-schema/spec": "^1.1.0",
     "@workflow/serde": "4.1.0",
     "eventsource-parser": "^3.0.8",

package/src/download-blob.ts

@@ -1,6 +1,6 @@
 import { cancelResponseBody } from './cancel-response-body';
 import { DownloadError } from './download-error';
-import { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+import { fetchUntrustedUrl } from './fetch-untrusted-url';
 import {
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
@@ -22,7 +22,7 @@ export async function downloadBlob(
   options?: { maxBytes?: number; abortSignal?: AbortSignal },
 ): Promise<Blob> {
   try {
-    const response = await fetchWithValidatedRedirects({
+    const response = await fetchUntrustedUrl({
       url,
       abortSignal: options?.abortSignal,
     });

package/src/fetch-untrusted-url.ts

@@ -0,0 +1,86 @@
+import { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+import { isSameOrigin } from './is-same-origin';
+import { sanitizeRequestHeaders } from './sanitize-request-headers';
+
+// Providers can use arbitrary credential header names. Only established
+// non-credential request metadata is safe to forward without an origin assertion.
+const SAFE_UNTRUSTED_FIRST_HOP_HEADERS = new Set([
+  'accept',
+  'accept-language',
+  'baggage',
+  'cache-control',
+  'idempotency-key',
+  'if-match',
+  'if-modified-since',
+  'if-none-match',
+  'if-range',
+  'if-unmodified-since',
+  'pragma',
+  'range',
+  'traceparent',
+  'tracestate',
+  'user-agent',
+  'x-correlation-id',
+  'x-request-id',
+]);
+
+/**
+ * Fetches an untrusted URL with first-hop credential isolation and validated
+ * redirects. Uses the URL validation, DNS-pinned Node.js transport, redirect
+ * limits, and cross-origin header stripping of {@link fetchWithValidatedRedirects}.
+ * An injected fetch must provide equivalent connect-time DNS validation.
+ *
+ * Without a matching `credentialedOrigin` (or `trustedOrigin` when it is
+ * omitted), only allowlisted request metadata is sent on the first hop.
+ * Arbitrary caller headers require an explicit matching origin because vendor
+ * credential names cannot be inferred safely. Proxy, metadata, cookie, and
+ * hop-by-hop headers are sanitized even for a matching origin.
+ *
+ * `trustedOrigin` also exempts same-origin hops from URL validation, allowing
+ * developer-configured private endpoints. Both origin options must come from
+ * developer configuration, never from untrusted response data.
+ *
+ * This is an opt-in alternative to `fetchWithValidatedRedirects`, whose
+ * existing first-hop header behavior is preserved for compatibility.
+ */
+export async function fetchUntrustedUrl({
+  headers,
+  credentialedOrigin,
+  untrustedFirstHopHeaders,
+  ...options
+}: Parameters<typeof fetchWithValidatedRedirects>[0] & {
+  /**
+   * The developer-configured origin allowed to receive arbitrary caller
+   * headers on the first hop. Defaults to `trustedOrigin` when omitted.
+   * An explicit value takes precedence over `trustedOrigin` and does not
+   * exempt the URL from validation.
+   */
+  credentialedOrigin?: string;
+  /**
+   * Additional sanitized header names safe to disclose to an untrusted first
+   * hop. Use only for non-credential protocol metadata. Credentials require
+   * a matching `credentialedOrigin` instead. Names are case-insensitive.
+   */
+  untrustedFirstHopHeaders?: readonly string[];
+}): Promise<Response> {
+  let firstHopHeaders: Headers | undefined;
+  if (headers !== undefined) {
+    firstHopHeaders = sanitizeRequestHeaders(headers);
+    const origin = credentialedOrigin ?? options.trustedOrigin;
+
+    if (origin === undefined || !isSameOrigin(options.url, origin)) {
+      const allowedHeaders = new Set([
+        ...SAFE_UNTRUSTED_FIRST_HOP_HEADERS,
+        ...(untrustedFirstHopHeaders ?? []).map(name => name.toLowerCase()),
+      ]);
+      firstHopHeaders = new Headers(
+        [...firstHopHeaders].filter(([name]) => allowedHeaders.has(name)),
+      );
+    }
+  }
+
+  return fetchWithValidatedRedirects({
+    ...options,
+    headers: firstHopHeaders,
+  });
+}

package/src/fetch-with-validated-redirects.ts

@@ -83,6 +83,9 @@ export async function fetchWithValidatedEndpoint({
  * Request headers are also protected: {@link sanitizeRequestHeaders} strips
  * proxy/metadata/cookie/hop-by-hop headers before the first request, and all
  * caller headers except `User-Agent` are dropped on a cross-origin redirect.
+ * Credentials and custom headers are preserved on the first hop for backwards
+ * compatibility. The caller must ensure that the initial URL may receive them.
+ * Use `fetchUntrustedUrl` for URLs that require first-hop credential isolation.
  * The fetch spec only strips `Authorization` on cross-origin redirects because
  * in a browser, CORS preflighting protects custom headers; there is no CORS on
  * the server, so provider API keys carried in custom headers (e.g. `x-key`)

package/src/index.ts

@@ -42,6 +42,7 @@ export {
 export { extractLines } from './extract-lines';
 export * from './extract-response-headers';
 export * from './fetch-function';
+export { fetchUntrustedUrl } from './fetch-untrusted-url';
 export { filterNullable } from './filter-nullable';
 export { createIdGenerator, generateId, type IdGenerator } from './generate-id';
 export * from './get-error-message';

package/src/is-url-supported.ts

@@ -1,11 +1,11 @@
 /**
  * Checks if the given URL is supported natively by the model.
  *
- * @param mediaType - The media type of the URL. Case-sensitive. May be a full
+ * @param mediaType - The media type of the URL. Case-insensitive. May be a full
  *                    `type/subtype`, a wildcard `type/*`, or just the
  *                    top-level segment (e.g. `image`).
  * @param url - The URL to check.
- * @param supportedUrls - A record where keys are case-sensitive media types (or '*')
+ * @param supportedUrls - A record where keys are case-insensitive media types (or '*')
  *                        and values are arrays of RegExp patterns for URLs.
  *
  * @returns `true` if the URL matches a pattern under the specific media type
@@ -46,7 +46,9 @@ export function isUrlSupported({
         if (isTopLevelOnly) {
           return `${mediaType}/` === mediaTypePrefix;
         }
-        return mediaType.startsWith(mediaTypePrefix);
+        return mediaTypePrefix.endsWith('/')
+          ? mediaType.startsWith(mediaTypePrefix)
+          : mediaType === mediaTypePrefix;
       })
       .flatMap(({ regexes }) => regexes)
       // check if any pattern matches the url:

package/src/sanitize-request-headers.ts

@@ -4,9 +4,11 @@
  * transport headers (RFC 7230 §6.1).
  *
  * `Authorization` and other credential-bearing caller headers (e.g. `x-key`)
- * are intentionally not listed — they're needed on the first hop of some
- * provider polling calls. Instead, all caller headers except the user-agent are
- * dropped on a cross-origin redirect (see `fetch-with-validated-redirects`).
+ * are intentionally not listed because trusted provider requests may need
+ * them. `fetchUntrustedUrl` separately restricts an untrusted first hop to an
+ * explicit allowlist of non-credential request metadata. Both it and
+ * `fetchWithValidatedRedirects` drop all caller headers except the user-agent
+ * on a cross-origin redirect.
  */
 const BLOCKED_REQUEST_HEADERS: readonly string[] = [
   // Hop-by-hop / transport (RFC 7230 §6.1)

package/src/streaming-tool-call-argument-state.ts

@@ -0,0 +1,100 @@
+type ArgumentStructure =
+  | { kind: 'undetermined' }
+  | { kind: 'other' }
+  | {
+      kind: 'structured';
+      stack: Array<'{' | '['>;
+      inString: boolean;
+      escaped: boolean;
+      complete: boolean;
+    };
+
+export function startsWithStructuredValue(
+  value: string | null | undefined,
+): boolean {
+  if (typeof value !== 'string') {
+    return false;
+  }
+
+  const firstCharacter = value.trimStart()[0];
+  return firstCharacter === '{' || firstCharacter === '[';
+}
+
+/**
+ * Incrementally tracks whether streamed tool-call arguments contain a complete
+ * structured JSON value. This is intentionally structural rather than a JSON
+ * parse: a currently parsable scalar can still be the prefix of a later value.
+ */
+export class StreamingToolCallArgumentState {
+  private structure: ArgumentStructure = { kind: 'undetermined' };
+
+  constructor(initialValue = '') {
+    this.append(initialValue);
+  }
+
+  get hasCompleteStructuredValue(): boolean {
+    return (
+      this.structure.kind === 'structured' && this.structure.complete === true
+    );
+  }
+
+  append(delta: string): void {
+    let nextStructure = this.structure;
+
+    for (const character of delta) {
+      if (nextStructure.kind === 'undetermined') {
+        if (/\s/.test(character)) {
+          continue;
+        }
+
+        if (character !== '{' && character !== '[') {
+          nextStructure = { kind: 'other' };
+          continue;
+        }
+
+        nextStructure = {
+          kind: 'structured',
+          stack: [character],
+          inString: false,
+          escaped: false,
+          complete: false,
+        };
+        continue;
+      }
+
+      if (nextStructure.kind !== 'structured' || nextStructure.complete) {
+        continue;
+      }
+
+      if (nextStructure.inString) {
+        if (nextStructure.escaped) {
+          nextStructure.escaped = false;
+        } else if (character === '\\') {
+          nextStructure.escaped = true;
+        } else if (character === '"') {
+          nextStructure.inString = false;
+        }
+        continue;
+      }
+
+      if (character === '"') {
+        nextStructure.inString = true;
+      } else if (character === '{' || character === '[') {
+        nextStructure.stack.push(character);
+      } else if (character === '}' || character === ']') {
+        const expectedOpening = character === '}' ? '{' : '[';
+        if (nextStructure.stack.at(-1) !== expectedOpening) {
+          nextStructure = { kind: 'other' };
+          continue;
+        }
+
+        nextStructure.stack.pop();
+        if (nextStructure.stack.length === 0) {
+          nextStructure.complete = true;
+        }
+      }
+    }
+
+    this.structure = nextStructure;
+  }
+}