ai 5.0.183 → 5.0.185

package/dist/index.mjs

@@ -687,7 +687,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "5.0.183" : "0.0.0-test";
+var VERSION = true ? "5.0.185" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -1364,33 +1364,35 @@ var modelMessageSchema = z5.union([
 var coreMessageSchema = modelMessageSchema;
 
 // src/prompt/standardize-prompt.ts
-async function standardizePrompt(prompt) {
-  if (prompt.prompt == null && prompt.messages == null) {
+async function standardizePrompt({
+  allowSystemInMessages,
+  system,
+  prompt,
+  messages
+}) {
+  if (prompt == null && messages == null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt or messages must be defined"
     });
   }
-  if (prompt.prompt != null && prompt.messages != null) {
+  if (prompt != null && messages != null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt and messages cannot be defined at the same time"
     });
   }
-  if (prompt.system != null && typeof prompt.system !== "string") {
+  if (system != null && typeof system !== "string") {
     throw new InvalidPromptError2({
       prompt,
       message: "system must be a string"
     });
   }
-  let messages;
-  if (prompt.prompt != null && typeof prompt.prompt === "string") {
-    messages = [{ role: "user", content: prompt.prompt }];
-  } else if (prompt.prompt != null && Array.isArray(prompt.prompt)) {
-    messages = prompt.prompt;
-  } else if (prompt.messages != null) {
-    messages = prompt.messages;
-  } else {
+  if (prompt != null && typeof prompt === "string") {
+    messages = [{ role: "user", content: prompt }];
+  } else if (prompt != null && Array.isArray(prompt)) {
+    messages = prompt;
+  } else if (messages == null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt or messages must be defined"
@@ -1402,6 +1404,19 @@ async function standardizePrompt(prompt) {
       message: "messages must not be empty"
     });
   }
+  if (messages.some((message) => message.role === "system")) {
+    if (allowSystemInMessages === false) {
+      throw new InvalidPromptError2({
+        prompt,
+        message: "System messages are not allowed in the prompt or messages fields. Use the system option instead."
+      });
+    }
+    if (allowSystemInMessages === void 0) {
+      console.warn(
+        "AI SDK Warning: System messages in the prompt or messages fields can be a security risk because they may enable prompt injection attacks. Use the system option instead when possible. Set allowSystemInMessages to true to suppress this warning, or false to throw an error."
+      );
+    }
+  }
   const validationResult = await safeValidateTypes({
     value: messages,
     schema: z6.array(modelMessageSchema)
@@ -1413,10 +1428,7 @@ async function standardizePrompt(prompt) {
       cause: validationResult.error
     });
   }
-  return {
-    messages,
-    system: prompt.system
-  };
+  return { messages, system };
 }
 
 // src/prompt/wrap-gateway-error.ts
@@ -2170,6 +2182,7 @@ async function generateText({
   system,
   prompt,
   messages,
+  allowSystemInMessages,
   maxRetries: maxRetriesArg,
   abortSignal,
   headers,
@@ -2211,7 +2224,8 @@ async function generateText({
   const initialPrompt = await standardizePrompt({
     system,
     prompt,
-    messages
+    messages,
+    allowSystemInMessages
   });
   const tracer = getTracer(telemetry);
   try {
@@ -4470,6 +4484,7 @@ function streamText({
   system,
   prompt,
   messages,
+  allowSystemInMessages,
   maxRetries,
   abortSignal,
   headers,
@@ -4509,6 +4524,7 @@ function streamText({
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     tools,
     toolChoice,
     transforms: asArray(transform),
@@ -4607,6 +4623,7 @@ var DefaultStreamTextResult = class {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     tools,
     toolChoice,
     transforms,
@@ -4944,7 +4961,8 @@ var DefaultStreamTextResult = class {
           const initialPrompt = await standardizePrompt({
             system,
             prompt,
-            messages
+            messages,
+            allowSystemInMessages
           });
           const stepInputMessages = [
             ...initialPrompt.messages,
@@ -6982,6 +7000,7 @@ async function generateObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     maxRetries: maxRetriesArg,
     abortSignal,
     headers,
@@ -7065,7 +7084,8 @@ async function generateObject(options) {
         const standardizedPrompt = await standardizePrompt({
           system,
           prompt,
-          messages
+          messages,
+          allowSystemInMessages
         });
         const promptMessages = await convertToLanguageModelPrompt({
           prompt: standardizedPrompt,
@@ -7387,6 +7407,7 @@ function streamObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     maxRetries,
     abortSignal,
     headers,
@@ -7434,6 +7455,7 @@ function streamObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     schemaName,
     schemaDescription,
     providerOptions,
@@ -7458,6 +7480,7 @@ var DefaultStreamObjectResult = class {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     schemaName,
     schemaDescription,
     providerOptions,
@@ -7526,7 +7549,8 @@ var DefaultStreamObjectResult = class {
         const standardizedPrompt = await standardizePrompt({
           system,
           prompt,
-          messages
+          messages,
+          allowSystemInMessages
         });
         const callOptions = {
           responseFormat: {