@ai-sdk/xai 4.0.10 → 4.0.13

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @ai-sdk/xai
 
+## 4.0.13
+
+### Patch Changes
+
+- Updated dependencies [31c7be8]
+  - @ai-sdk/provider-utils@5.0.10
+  - @ai-sdk/openai-compatible@3.0.10
+
+## 4.0.12
+
+### Patch Changes
+
+- 4be62c1: fix(provider-utils): validate provider-response URLs in `getFromApi`
+
+  `getFromApi` now has a `validateUrl` flag. It is optional so existing callers keep compiling (omitting it behaves like `false`, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When `true`, the URL is routed through `fetchWithValidatedRedirects` — the same guard used by `downloadBlob` — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than `Authorization` may); blocked URLs throw `DownloadError`. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass `validateUrl: false` and are unaffected.
+
+  A new optional `credentialedOrigin` withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.
+
+  A new optional `trustedOrigin` exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.
+
+  Also closes range gaps in `validateDownloadUrl` (IPv4 `224.0.0.0/4` multicast and the TEST-NET documentation ranges `192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`; IPv6 documentation ranges `2001:db8::/32` and `3fff::/20`), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a `Location` header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node `fetch` that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See `contributing/secure-url-handling.md`.
+
+- Updated dependencies [4be62c1]
+- Updated dependencies [7805e4a]
+- Updated dependencies [cd12954]
+  - @ai-sdk/provider-utils@5.0.9
+  - @ai-sdk/openai-compatible@3.0.9
+
+## 4.0.11
+
+### Patch Changes
+
+- e193290: Add `connectToWebSocket` to `@ai-sdk/provider-utils`: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to `postToApi` for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from `doStream`, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
+- e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like `ws` throw on undefined values).
+- e193290: Fix streaming transcription stream parts against the live xAI STT API: `transcript-final` was emitted for every `is_final: true` event, but xAI re-sends the finalized text with `speech_final: false` before the `speech_final: true` event (duplicating finals) and also finalizes _fragments_ whose text the eventual `speech_final` event merges and re-punctuates (later-revised finals). `transcript-final` is now only emitted on `speech_final: true`; finalized fragments surface as `transcript-partial`. Additionally, xAI's `transcript.done` event arrives with an empty `text`, which produced an empty `finish.text` and made `experimental_streamTranscribe` throw `NoTranscriptGeneratedError` despite a full transcript having streamed — the finish text now falls back to the accumulated finalized utterances (plus any trailing unfinalized text).
+- Updated dependencies [e193290]
+  - @ai-sdk/provider-utils@5.0.8
+  - @ai-sdk/openai-compatible@3.0.8
+
 ## 4.0.10
 
 ### Patch Changes

package/dist/index.js

@@ -1181,6 +1181,9 @@ var XaiImageModel = class _XaiImageModel {
   async downloadImage(url, abortSignal) {
     const { value } = await getFromApi({
       url,
+      // url is a generated-image URL from the provider response; validate it.
+      validateUrl: true,
+      trustedOrigin: this.config.baseURL,
       abortSignal,
       failedResponseHandler: createStatusCodeErrorResponseHandler(),
       successfulResponseHandler: createBinaryResponseHandler(),
@@ -3474,7 +3477,7 @@ var xaiTools = {
 };
 
 // src/version.ts
-var VERSION = true ? "4.0.10" : "0.0.0-test";
+var VERSION = true ? "4.0.13" : "0.0.0-test";
 
 // src/files/xai-files.ts
 import {
@@ -3912,6 +3915,7 @@ var XaiVideoModel = class {
       }
       const { value: statusResponse, responseHeaders: pollHeaders } = await getFromApi2({
         url: `${baseURL}/videos/${requestId}`,
+        validateUrl: false,
         headers: combineHeaders5(this.config.headers(), options.headers),
         successfulResponseHandler: createJsonResponseHandler5(
           xaiVideoStatusResponseSchema
@@ -4172,14 +4176,14 @@ import {
   combineHeaders as combineHeaders7,
   convertBase64ToUint8Array,
   createJsonResponseHandler as createJsonResponseHandler6,
-  getWebSocketConstructor,
+  connectToWebSocket,
   mediaTypeToExtension,
   parseProviderOptions as parseProviderOptions9,
   postFormDataToApi as postFormDataToApi2,
-  readWebSocketMessageText,
   safeParseJSON as safeParseJSON2,
   serializeModelOptions as serializeModelOptions5,
   toWebSocketUrl,
+  waitForWebSocketBufferDrain,
   WORKFLOW_DESERIALIZE as WORKFLOW_DESERIALIZE5,
   WORKFLOW_SERIALIZE as WORKFLOW_SERIALIZE5
 } from "@ai-sdk/provider-utils";
@@ -4430,19 +4434,21 @@ function createXaiStreamingTranscriptionStream({
   };
   return new ReadableStream({
     start: (controller) => {
-      const WebSocketConstructor = getWebSocketConstructor(webSocket);
-      const ws = new WebSocketConstructor(url, void 0, { headers });
       const doneTexts = /* @__PURE__ */ new Map();
+      const finalizedTexts = /* @__PURE__ */ new Map();
+      const pendingTexts = /* @__PURE__ */ new Map();
       let doneDuration;
       let audioReader;
+      let connection;
       cleanup = (closeCode) => {
-        abortSignal == null ? void 0 : abortSignal.removeEventListener("abort", abort);
-        void (audioReader == null ? void 0 : audioReader.cancel().catch(() => {
-        }));
-        try {
-          ws.close(closeCode);
-        } catch (e) {
+        if (audioReader != null) {
+          void audioReader.cancel().catch(() => {
+          });
+        } else {
+          void audio.cancel().catch(() => {
+          });
         }
+        connection == null ? void 0 : connection.close(closeCode);
       };
       const finishWithError = (error) => {
         if (finished) return;
@@ -4464,35 +4470,34 @@ function createXaiStreamingTranscriptionStream({
         controller.close();
         cleanup(1e3);
       };
-      const abort = () => {
-        var _a;
-        finishWithError((_a = abortSignal == null ? void 0 : abortSignal.reason) != null ? _a : new Error("Aborted"));
-      };
-      if (abortSignal == null ? void 0 : abortSignal.aborted) {
-        abort();
-        return;
-      }
-      abortSignal == null ? void 0 : abortSignal.addEventListener("abort", abort, { once: true });
-      const sendAudio = async () => {
+      const sendAudio = async (socket) => {
         audioReader = audio.getReader();
         try {
           while (true) {
             const { done, value } = await audioReader.read();
             if (done || finished) break;
-            ws.send(
+            socket.send(
               value instanceof Uint8Array ? value : convertBase64ToUint8Array(value)
             );
+            await waitForWebSocketBufferDrain(socket);
           }
         } finally {
           audioReader.releaseLock();
+          audioReader = void 0;
         }
         if (!finished) {
-          ws.send(JSON.stringify({ type: "audio.done" }));
+          socket.send(JSON.stringify({ type: "audio.done" }));
         }
       };
-      ws.onmessage = (event) => {
-        void readWebSocketMessageText(event.data).then(async (text) => {
-          var _a, _b, _c, _d, _e, _f;
+      connection = connectToWebSocket({
+        url,
+        headers,
+        webSocket,
+        abortSignal,
+        onAbort: finishWithError,
+        onProcessingError: finishWithError,
+        onMessageText: async (text) => {
+          var _a, _b, _c, _d, _e, _f, _g, _h, _i;
           const parsed = await safeParseJSON2({ text });
           if (!parsed.success) return;
           const raw = parsed.value;
@@ -4502,25 +4507,39 @@ function createXaiStreamingTranscriptionStream({
           switch (raw.type) {
             case "transcript.created": {
               controller.enqueue({ type: "stream-start", warnings });
-              void sendAudio().catch(finishWithError);
+              const socket = connection == null ? void 0 : connection.socket;
+              if (socket == null) {
+                finishWithError(new Error("WebSocket is not connected."));
+                break;
+              }
+              void sendAudio(socket).catch(finishWithError);
               break;
             }
             case "transcript.partial": {
               const id = channelId(raw.channel_index);
-              const timing = timingFromXaiEvent(raw);
-              if (raw.is_final) {
+              const channelIndex = (_a = raw.channel_index) != null ? _a : 0;
+              if (raw.is_final && raw.speech_final) {
+                const timing = timingFromXaiEvent(raw);
+                if (raw.text) {
+                  finalizedTexts.set(channelIndex, [
+                    ...(_b = finalizedTexts.get(channelIndex)) != null ? _b : [],
+                    raw.text
+                  ]);
+                }
+                pendingTexts.delete(channelIndex);
                 controller.enqueue({
                   type: "transcript-final",
                   id,
-                  text: (_a = raw.text) != null ? _a : "",
+                  text: (_c = raw.text) != null ? _c : "",
                   ...timing,
                   channelIndex: raw.channel_index
                 });
               } else {
+                pendingTexts.set(channelIndex, (_d = raw.text) != null ? _d : "");
                 controller.enqueue({
                   type: "transcript-partial",
                   id,
-                  text: (_b = raw.text) != null ? _b : "",
+                  text: (_e = raw.text) != null ? _e : "",
                   startSecond: raw.start,
                   durationInSeconds: raw.duration,
                   channelIndex: raw.channel_index
@@ -4529,32 +4548,36 @@ function createXaiStreamingTranscriptionStream({
               break;
             }
             case "transcript.done": {
-              const channelIndex = (_c = raw.channel_index) != null ? _c : 0;
-              doneTexts.set(channelIndex, (_d = raw.text) != null ? _d : "");
-              doneDuration = (_e = raw.duration) != null ? _e : doneDuration;
+              const channelIndex = (_f = raw.channel_index) != null ? _f : 0;
+              const accumulated = [
+                ...(_g = finalizedTexts.get(channelIndex)) != null ? _g : [],
+                ...pendingTexts.get(channelIndex) ? [pendingTexts.get(channelIndex)] : []
+              ].join(" ");
+              doneTexts.set(channelIndex, raw.text || accumulated);
+              doneDuration = (_h = raw.duration) != null ? _h : doneDuration;
               maybeFinish();
               break;
             }
             case "error": {
-              finishWithError(new Error((_f = raw.message) != null ? _f : "xAI STT error"));
+              finishWithError(new Error((_i = raw.message) != null ? _i : "xAI STT error"));
               break;
             }
           }
-        }).catch(finishWithError);
-      };
-      ws.onerror = () => {
-        finishWithError(
-          new Error(
-            "xAI streaming transcription error." + (webSocket == null ? " Note: the native WebSocket implementation in browsers, Node.js, Deno, and Bun cannot send the Authorization header required by xAI. Pass a header-capable WebSocket implementation (e.g. the 'ws' package) via createXai({ webSocket })." : "")
-          )
-        );
-      };
-      ws.onclose = () => {
-        if (finished) return;
-        finished = true;
-        cleanup();
-        controller.close();
-      };
+        },
+        onSocketError: () => {
+          finishWithError(
+            new Error(
+              "xAI streaming transcription error." + (webSocket == null ? " Note: the native WebSocket implementation in browsers, Node.js, Deno, and Bun cannot send the Authorization header required by xAI. Pass a header-capable WebSocket implementation (e.g. the 'ws' package) via createXai({ webSocket })." : "")
+            )
+          );
+        },
+        onClose: () => {
+          if (finished) return;
+          finished = true;
+          cleanup();
+          controller.close();
+        }
+      });
     },
     cancel: () => {
       if (finished) return;