@ai-sdk/xai 4.0.9 → 4.0.12

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # @ai-sdk/xai
 
+## 4.0.12
+
+### Patch Changes
+
+- 4be62c1: fix(provider-utils): validate provider-response URLs in `getFromApi`
+
+  `getFromApi` now has a `validateUrl` flag. It is optional so existing callers keep compiling (omitting it behaves like `false`, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When `true`, the URL is routed through `fetchWithValidatedRedirects` — the same guard used by `downloadBlob` — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than `Authorization` may); blocked URLs throw `DownloadError`. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass `validateUrl: false` and are unaffected.
+
+  A new optional `credentialedOrigin` withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.
+
+  A new optional `trustedOrigin` exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.
+
+  Also closes range gaps in `validateDownloadUrl` (IPv4 `224.0.0.0/4` multicast and the TEST-NET documentation ranges `192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`; IPv6 documentation ranges `2001:db8::/32` and `3fff::/20`), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a `Location` header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node `fetch` that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See `contributing/secure-url-handling.md`.
+
+- Updated dependencies [4be62c1]
+- Updated dependencies [7805e4a]
+- Updated dependencies [cd12954]
+  - @ai-sdk/provider-utils@5.0.9
+  - @ai-sdk/openai-compatible@3.0.9
+
+## 4.0.11
+
+### Patch Changes
+
+- e193290: Add `connectToWebSocket` to `@ai-sdk/provider-utils`: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to `postToApi` for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from `doStream`, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
+- e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like `ws` throw on undefined values).
+- e193290: Fix streaming transcription stream parts against the live xAI STT API: `transcript-final` was emitted for every `is_final: true` event, but xAI re-sends the finalized text with `speech_final: false` before the `speech_final: true` event (duplicating finals) and also finalizes _fragments_ whose text the eventual `speech_final` event merges and re-punctuates (later-revised finals). `transcript-final` is now only emitted on `speech_final: true`; finalized fragments surface as `transcript-partial`. Additionally, xAI's `transcript.done` event arrives with an empty `text`, which produced an empty `finish.text` and made `experimental_streamTranscribe` throw `NoTranscriptGeneratedError` despite a full transcript having streamed — the finish text now falls back to the accumulated finalized utterances (plus any trailing unfinalized text).
+- Updated dependencies [e193290]
+  - @ai-sdk/provider-utils@5.0.8
+  - @ai-sdk/openai-compatible@3.0.8
+
+## 4.0.10
+
+### Patch Changes
+
+- 0f93c57: feat (video): support video (not just image) reference inputs in `inputReferences` for reference-to-video generation
+- d25a084: feat (provider/xai): add grok-4.5 model id
+- Updated dependencies [0f93c57]
+  - @ai-sdk/provider@4.0.3
+  - @ai-sdk/openai-compatible@3.0.7
+  - @ai-sdk/provider-utils@5.0.7
+
 ## 4.0.9
 
 ### Patch Changes

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
 import { InferSchema, FetchFunction, WebSocketConstructor } from '@ai-sdk/provider-utils';
 import { ProviderV4, LanguageModelV4, ImageModelV4, Experimental_VideoModelV4, Experimental_RealtimeFactoryV4, SpeechModelV4, TranscriptionModelV4, FilesV4, Experimental_RealtimeModelV4, Experimental_RealtimeModelV4ClientSecretOptions, Experimental_RealtimeModelV4ClientSecretResult, Experimental_RealtimeModelV4ServerEvent, Experimental_RealtimeModelV4ClientEvent, Experimental_RealtimeModelV4SessionConfig } from '@ai-sdk/provider';
 
-type XaiChatModelId = 'grok-4.20-non-reasoning' | 'grok-4.20-reasoning' | 'grok-4.3' | 'grok-latest' | (string & {});
+type XaiChatModelId = 'grok-4.20-non-reasoning' | 'grok-4.20-reasoning' | 'grok-4.3' | 'grok-4.5' | 'grok-latest' | (string & {});
 declare const xaiLanguageModelChatOptions: z.ZodObject<{
     reasoningEffort: z.ZodOptional<z.ZodEnum<{
         none: "none";
@@ -72,7 +72,7 @@ declare const xaiFilePartProviderOptions: z.ZodObject<{
 }, z.core.$strip>;
 type XaiFilePartProviderOptions = z.infer<typeof xaiFilePartProviderOptions>;
 
-type XaiResponsesModelId = 'grok-4.20-non-reasoning' | 'grok-4.20-reasoning' | 'grok-4.3' | 'grok-latest' | (string & {});
+type XaiResponsesModelId = 'grok-4.20-non-reasoning' | 'grok-4.20-reasoning' | 'grok-4.3' | 'grok-4.5' | 'grok-latest' | (string & {});
 /**
  * @see https://docs.x.ai/docs/api-reference#create-new-response
  */

package/dist/index.js

@@ -1181,6 +1181,9 @@ var XaiImageModel = class _XaiImageModel {
   async downloadImage(url, abortSignal) {
     const { value } = await getFromApi({
       url,
+      // url is a generated-image URL from the provider response; validate it.
+      validateUrl: true,
+      trustedOrigin: this.config.baseURL,
       abortSignal,
       failedResponseHandler: createStatusCodeErrorResponseHandler(),
       successfulResponseHandler: createBinaryResponseHandler(),
@@ -3474,7 +3477,7 @@ var xaiTools = {
 };
 
 // src/version.ts
-var VERSION = true ? "4.0.9" : "0.0.0-test";
+var VERSION = true ? "4.0.12" : "0.0.0-test";
 
 // src/files/xai-files.ts
 import {
@@ -3587,6 +3590,7 @@ import {
   createJsonResponseHandler as createJsonResponseHandler5,
   delay,
   getFromApi as getFromApi2,
+  getTopLevelMediaType as getTopLevelMediaType3,
   parseProviderOptions as parseProviderOptions7,
   postJsonToApi as postJsonToApi4
 } from "@ai-sdk/provider-utils";
@@ -3661,17 +3665,28 @@ function resolveStartImage(options) {
   var _a;
   return (_a = getFirstFrameImage(options)) != null ? _a : options.image;
 }
+var isVideoFile = (file) => file.mediaType != null && getTopLevelMediaType3(file.mediaType) === "video";
 function fileToXaiImageUrl(file) {
-  var _a;
   if (file.type === "url") {
     return file.url;
   }
   const base64Data = typeof file.data === "string" ? file.data : convertUint8ArrayToBase64(file.data);
-  return `data:${(_a = file.mediaType) != null ? _a : "image/png"};base64,${base64Data}`;
+  return `data:${file.mediaType};base64,${base64Data}`;
 }
-function resolveReferenceImages(options, xaiOptions) {
+function resolveReferenceImages(options, xaiOptions, warnings) {
   if (options.inputReferences != null && options.inputReferences.length > 0) {
-    return options.inputReferences.map((reference) => ({
+    const imageReferences = options.inputReferences.filter((reference) => {
+      if (isVideoFile(reference)) {
+        warnings.push({
+          type: "unsupported",
+          feature: "inputReferences",
+          details: 'xAI reference-to-video accepts image references only. The video reference was ignored. Use providerOptions.xai.mode "extend-video" to continue from a video.'
+        });
+        return false;
+      }
+      return true;
+    });
+    return imageReferences.map((reference) => ({
       url: fileToXaiImageUrl(reference)
     }));
   }
@@ -3809,17 +3824,31 @@ var XaiVideoModel = class {
     }
     const startImage = resolveStartImage(options);
     if (startImage != null) {
-      body.image = { url: fileToXaiImageUrl(startImage) };
+      if (isVideoFile(startImage)) {
+        const fromFrameImages = getFirstFrameImage(options) != null;
+        warnings.push({
+          type: "unsupported",
+          feature: fromFrameImages ? "frameImages" : "image",
+          details: 'xAI does not accept a video as a start/frame image. The video was ignored. Use providerOptions.xai.mode "extend-video" to continue from a video instead.'
+        });
+      } else {
+        body.image = { url: fileToXaiImageUrl(startImage) };
+      }
     }
-    if (getLastFrameImage(options) != null) {
+    const lastFrameImage = getLastFrameImage(options);
+    if (lastFrameImage != null) {
       warnings.push({
         type: "unsupported",
         feature: "frameImages",
-        details: `xAI video models do not support last_frame. Use providerOptions.xai.mode "extend-video" to continue from a video's last frame. The last frame image was ignored.`
+        details: isVideoFile(lastFrameImage) ? 'xAI does not accept a video as a start/frame image. The video last frame was ignored. Use providerOptions.xai.mode "extend-video" to continue from a video instead.' : `xAI video models do not support last_frame. Use providerOptions.xai.mode "extend-video" to continue from a video's last frame. The last frame image was ignored.`
       });
     }
     if (hasReferenceImages) {
-      const referenceImages = resolveReferenceImages(options, xaiOptions);
+      const referenceImages = resolveReferenceImages(
+        options,
+        xaiOptions,
+        warnings
+      );
       if (referenceImages != null) {
         body.reference_images = referenceImages;
       }
@@ -3886,6 +3915,7 @@ var XaiVideoModel = class {
       }
       const { value: statusResponse, responseHeaders: pollHeaders } = await getFromApi2({
         url: `${baseURL}/videos/${requestId}`,
+        validateUrl: false,
         headers: combineHeaders5(this.config.headers(), options.headers),
         successfulResponseHandler: createJsonResponseHandler5(
           xaiVideoStatusResponseSchema
@@ -4146,14 +4176,14 @@ import {
   combineHeaders as combineHeaders7,
   convertBase64ToUint8Array,
   createJsonResponseHandler as createJsonResponseHandler6,
-  getWebSocketConstructor,
+  connectToWebSocket,
   mediaTypeToExtension,
   parseProviderOptions as parseProviderOptions9,
   postFormDataToApi as postFormDataToApi2,
-  readWebSocketMessageText,
   safeParseJSON as safeParseJSON2,
   serializeModelOptions as serializeModelOptions5,
   toWebSocketUrl,
+  waitForWebSocketBufferDrain,
   WORKFLOW_DESERIALIZE as WORKFLOW_DESERIALIZE5,
   WORKFLOW_SERIALIZE as WORKFLOW_SERIALIZE5
 } from "@ai-sdk/provider-utils";
@@ -4404,19 +4434,21 @@ function createXaiStreamingTranscriptionStream({
   };
   return new ReadableStream({
     start: (controller) => {
-      const WebSocketConstructor = getWebSocketConstructor(webSocket);
-      const ws = new WebSocketConstructor(url, void 0, { headers });
       const doneTexts = /* @__PURE__ */ new Map();
+      const finalizedTexts = /* @__PURE__ */ new Map();
+      const pendingTexts = /* @__PURE__ */ new Map();
       let doneDuration;
       let audioReader;
+      let connection;
       cleanup = (closeCode) => {
-        abortSignal == null ? void 0 : abortSignal.removeEventListener("abort", abort);
-        void (audioReader == null ? void 0 : audioReader.cancel().catch(() => {
-        }));
-        try {
-          ws.close(closeCode);
-        } catch (e) {
+        if (audioReader != null) {
+          void audioReader.cancel().catch(() => {
+          });
+        } else {
+          void audio.cancel().catch(() => {
+          });
         }
+        connection == null ? void 0 : connection.close(closeCode);
       };
       const finishWithError = (error) => {
         if (finished) return;
@@ -4438,35 +4470,34 @@ function createXaiStreamingTranscriptionStream({
         controller.close();
         cleanup(1e3);
       };
-      const abort = () => {
-        var _a;
-        finishWithError((_a = abortSignal == null ? void 0 : abortSignal.reason) != null ? _a : new Error("Aborted"));
-      };
-      if (abortSignal == null ? void 0 : abortSignal.aborted) {
-        abort();
-        return;
-      }
-      abortSignal == null ? void 0 : abortSignal.addEventListener("abort", abort, { once: true });
-      const sendAudio = async () => {
+      const sendAudio = async (socket) => {
         audioReader = audio.getReader();
         try {
           while (true) {
             const { done, value } = await audioReader.read();
             if (done || finished) break;
-            ws.send(
+            socket.send(
               value instanceof Uint8Array ? value : convertBase64ToUint8Array(value)
             );
+            await waitForWebSocketBufferDrain(socket);
           }
         } finally {
           audioReader.releaseLock();
+          audioReader = void 0;
         }
         if (!finished) {
-          ws.send(JSON.stringify({ type: "audio.done" }));
+          socket.send(JSON.stringify({ type: "audio.done" }));
         }
       };
-      ws.onmessage = (event) => {
-        void readWebSocketMessageText(event.data).then(async (text) => {
-          var _a, _b, _c, _d, _e, _f;
+      connection = connectToWebSocket({
+        url,
+        headers,
+        webSocket,
+        abortSignal,
+        onAbort: finishWithError,
+        onProcessingError: finishWithError,
+        onMessageText: async (text) => {
+          var _a, _b, _c, _d, _e, _f, _g, _h, _i;
           const parsed = await safeParseJSON2({ text });
           if (!parsed.success) return;
           const raw = parsed.value;
@@ -4476,25 +4507,39 @@ function createXaiStreamingTranscriptionStream({
           switch (raw.type) {
             case "transcript.created": {
               controller.enqueue({ type: "stream-start", warnings });
-              void sendAudio().catch(finishWithError);
+              const socket = connection == null ? void 0 : connection.socket;
+              if (socket == null) {
+                finishWithError(new Error("WebSocket is not connected."));
+                break;
+              }
+              void sendAudio(socket).catch(finishWithError);
               break;
             }
             case "transcript.partial": {
               const id = channelId(raw.channel_index);
-              const timing = timingFromXaiEvent(raw);
-              if (raw.is_final) {
+              const channelIndex = (_a = raw.channel_index) != null ? _a : 0;
+              if (raw.is_final && raw.speech_final) {
+                const timing = timingFromXaiEvent(raw);
+                if (raw.text) {
+                  finalizedTexts.set(channelIndex, [
+                    ...(_b = finalizedTexts.get(channelIndex)) != null ? _b : [],
+                    raw.text
+                  ]);
+                }
+                pendingTexts.delete(channelIndex);
                 controller.enqueue({
                   type: "transcript-final",
                   id,
-                  text: (_a = raw.text) != null ? _a : "",
+                  text: (_c = raw.text) != null ? _c : "",
                   ...timing,
                   channelIndex: raw.channel_index
                 });
               } else {
+                pendingTexts.set(channelIndex, (_d = raw.text) != null ? _d : "");
                 controller.enqueue({
                   type: "transcript-partial",
                   id,
-                  text: (_b = raw.text) != null ? _b : "",
+                  text: (_e = raw.text) != null ? _e : "",
                   startSecond: raw.start,
                   durationInSeconds: raw.duration,
                   channelIndex: raw.channel_index
@@ -4503,32 +4548,36 @@ function createXaiStreamingTranscriptionStream({
               break;
             }
             case "transcript.done": {
-              const channelIndex = (_c = raw.channel_index) != null ? _c : 0;
-              doneTexts.set(channelIndex, (_d = raw.text) != null ? _d : "");
-              doneDuration = (_e = raw.duration) != null ? _e : doneDuration;
+              const channelIndex = (_f = raw.channel_index) != null ? _f : 0;
+              const accumulated = [
+                ...(_g = finalizedTexts.get(channelIndex)) != null ? _g : [],
+                ...pendingTexts.get(channelIndex) ? [pendingTexts.get(channelIndex)] : []
+              ].join(" ");
+              doneTexts.set(channelIndex, raw.text || accumulated);
+              doneDuration = (_h = raw.duration) != null ? _h : doneDuration;
               maybeFinish();
               break;
             }
             case "error": {
-              finishWithError(new Error((_f = raw.message) != null ? _f : "xAI STT error"));
+              finishWithError(new Error((_i = raw.message) != null ? _i : "xAI STT error"));
               break;
             }
           }
-        }).catch(finishWithError);
-      };
-      ws.onerror = () => {
-        finishWithError(
-          new Error(
-            "xAI streaming transcription error." + (webSocket == null ? " Note: the native WebSocket implementation in browsers, Node.js, Deno, and Bun cannot send the Authorization header required by xAI. Pass a header-capable WebSocket implementation (e.g. the 'ws' package) via createXai({ webSocket })." : "")
-          )
-        );
-      };
-      ws.onclose = () => {
-        if (finished) return;
-        finished = true;
-        cleanup();
-        controller.close();
-      };
+        },
+        onSocketError: () => {
+          finishWithError(
+            new Error(
+              "xAI streaming transcription error." + (webSocket == null ? " Note: the native WebSocket implementation in browsers, Node.js, Deno, and Bun cannot send the Authorization header required by xAI. Pass a header-capable WebSocket implementation (e.g. the 'ws' package) via createXai({ webSocket })." : "")
+            )
+          );
+        },
+        onClose: () => {
+          if (finished) return;
+          finished = true;
+          cleanup();
+          controller.close();
+        }
+      });
     },
     cancel: () => {
       if (finished) return;