ai 5.0.198 → 5.0.200

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # ai
 
+## 5.0.200
+
+### Patch Changes
+
+- eea9166: fix: harden download URL SSRF guard against hostname and redirect bypasses
+
+  `validateDownloadUrl` and the file download helpers (`downloadBlob`, `download`) could be bypassed in several ways when handling untrusted URLs:
+
+  - A fully-qualified hostname with a trailing dot (e.g. `localhost.`, `myhost.local.`) skipped the localhost/`.local` blocklist.
+  - IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (`::127.0.0.1`), IPv4-translated (`::ffff:0:127.0.0.1`), and NAT64 (`64:ff9b::127.0.0.1`, including the `64:ff9b:1::/48` local-use prefix) — were not decoded and checked against the private IPv4 ranges.
+  - Redirects were validated only _after_ `fetch` had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
+  - Several reserved/internal address ranges were not blocked: CGNAT (`100.64.0.0/10`, used by some cloud providers for internal traffic), benchmarking (`198.18.0.0/15`), IETF protocol assignments (`192.0.0.0/24`), the reserved `240.0.0.0/4` block (including the `255.255.255.255` broadcast address), and IPv6 site-local (`fec0::/10`) and multicast (`ff00::/8`).
+
+  The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (`redirect: 'manual'`), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.
+
+- 15cf74f: Harden stream text processing and middleware against prototype pollution from stream part IDs.
+- 8ad6f80: fix: redact server error details from UI message streams by default
+
+  `streamText(...).toUIMessageStream()` and `createUIMessageStream` defaulted their `onError` callback to `getErrorMessage`, which serializes the raw error (`error.toString()` / `JSON.stringify(error)`) into the client-facing `{ type: 'error', errorText }` chunk — and also into `tool-output-error` parts. The documented default was `() => 'An error occurred.'`, so applications relying on the documented behavior were unknowingly streaming server exception details (internal hostnames, paths, provider request data, validation inputs) to end users.
+
+  The default `onError` now returns the documented generic `'An error occurred.'`. Raw error details are only emitted when the developer explicitly supplies an `onError` handler. This also redacts `tool-output-error` and invalid-tool-input error text by default; pass an `onError` to surface richer messages.
+
+- Updated dependencies [9f67efe]
+- Updated dependencies [eea9166]
+  - @ai-sdk/provider-utils@3.0.26
+  - @ai-sdk/gateway@2.0.99
+
+## 5.0.199
+
+### Patch Changes
+
+- 040dc83: fix(ai): return schema-transformed elements in array output mode
+
+  Previously final array output validation checked each element against the schema but returned the raw model output. Array output now returns the validated values so Zod transforms, coercions, defaults, and pipes are applied consistently with object output.
+
 ## 5.0.198
 
 ### Patch Changes

package/dist/index.d.mts

@@ -3964,7 +3964,21 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
     onError: ErrorHandler | undefined;
 }
 
-declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, originalMessages, onFinish, generateId, }: {
+/**
+ * Creates a UI message stream that can be used to send messages to the client.
+ *
+ * @param options.execute - A function that is called with a writer to write UI message chunks to the stream.
+ * @param options.onError - A function that extracts an error message from an error. Defaults to `() => 'An error occurred.'` so server-side error details are not leaked to the client; supply your own to surface richer messages.
+ * @param options.originalMessages - The original messages. If provided, persistence mode is assumed
+ *   and a message ID is provided for the response message.
+ * @param options.onStepFinish - A callback that is called when each step finishes. Useful for persisting intermediate messages.
+ * @param options.onFinish - A callback that is called when the stream finishes.
+ * @param options.generateId - A function that generates a unique ID. Defaults to the built-in ID generator.
+ *
+ * @returns A `ReadableStream` of UI message chunks.
+ */
+declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, // prevent leaking server error details to the client by default
+originalMessages, onFinish, generateId, }: {
     execute: (options: {
         writer: UIMessageStreamWriter<UI_MESSAGE>;
     }) => Promise<void> | void;

package/dist/index.d.ts

@@ -3964,7 +3964,21 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
     onError: ErrorHandler | undefined;
 }
 
-declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, originalMessages, onFinish, generateId, }: {
+/**
+ * Creates a UI message stream that can be used to send messages to the client.
+ *
+ * @param options.execute - A function that is called with a writer to write UI message chunks to the stream.
+ * @param options.onError - A function that extracts an error message from an error. Defaults to `() => 'An error occurred.'` so server-side error details are not leaked to the client; supply your own to surface richer messages.
+ * @param options.originalMessages - The original messages. If provided, persistence mode is assumed
+ *   and a message ID is provided for the response message.
+ * @param options.onStepFinish - A callback that is called when each step finishes. Useful for persisting intermediate messages.
+ * @param options.onFinish - A callback that is called when the stream finishes.
+ * @param options.generateId - A function that generates a unique ID. Defaults to the built-in ID generator.
+ *
+ * @returns A `ReadableStream` of UI message chunks.
+ */
+declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, // prevent leaking server error details to the client by default
+originalMessages, onFinish, generateId, }: {
     execute: (options: {
         writer: UIMessageStreamWriter<UI_MESSAGE>;
     }) => Promise<void> | void;

package/dist/index.js

@@ -778,7 +778,7 @@ function detectMediaType({
 var import_provider_utils2 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "5.0.198" : "0.0.0-test";
+var VERSION = true ? "5.0.200" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -788,21 +788,19 @@ var download = async ({
 }) => {
   var _a16;
   const urlText = url.toString();
-  (0, import_provider_utils2.validateDownloadUrl)(urlText);
   try {
-    const response = await fetch(urlText, {
-      headers: (0, import_provider_utils2.withUserAgentSuffix)(
-        {},
-        `ai-sdk/${VERSION}`,
-        (0, import_provider_utils2.getRuntimeEnvironmentUserAgent)()
-      ),
-      signal: abortSignal
+    const headers = (0, import_provider_utils2.withUserAgentSuffix)(
+      {},
+      `ai-sdk/${VERSION}`,
+      (0, import_provider_utils2.getRuntimeEnvironmentUserAgent)()
+    );
+    const response = await (0, import_provider_utils2.fetchWithValidatedRedirects)({
+      url: urlText,
+      headers,
+      abortSignal
     });
-    if (response.redirected) {
-      (0, import_provider_utils2.validateDownloadUrl)(response.url);
-    }
     if (!response.ok) {
-      throw new DownloadError({
+      throw new import_provider_utils2.DownloadError({
         url: urlText,
         statusCode: response.status,
         statusText: response.statusText
@@ -818,10 +816,10 @@ var download = async ({
       mediaType: (_a16 = response.headers.get("content-type")) != null ? _a16 : void 0
     };
   } catch (error) {
-    if (DownloadError.isInstance(error)) {
+    if (import_provider_utils2.DownloadError.isInstance(error)) {
       throw error;
     }
-    throw new DownloadError({ url: urlText, cause: error });
+    throw new import_provider_utils2.DownloadError({ url: urlText, cause: error });
   }
 };
 
@@ -2839,7 +2837,6 @@ function asContent({
 }
 
 // src/generate-text/stream-text.ts
-var import_provider23 = require("@ai-sdk/provider");
 var import_provider_utils15 = require("@ai-sdk/provider-utils");
 
 // src/util/prepare-headers.ts
@@ -4730,8 +4727,8 @@ var DefaultStreamTextResult = class {
     let recordedWarnings = [];
     const recordedSteps = [];
     let rootSpan;
-    let activeTextContent = {};
-    let activeReasoningContent = {};
+    let activeTextContent = createIdMap();
+    let activeReasoningContent = createIdMap();
     const eventProcessor = new TransformStream({
       async transform(chunk, controller) {
         var _a16, _b, _c, _d;
@@ -4835,6 +4832,9 @@ var DefaultStreamTextResult = class {
           recordedContent.push(part);
         }
         if (part.type === "start-step") {
+          recordedContent = [];
+          activeReasoningContent = createIdMap();
+          activeTextContent = createIdMap();
           recordedRequest = part.request;
           recordedWarnings = part.warnings;
         }
@@ -4859,8 +4859,8 @@ var DefaultStreamTextResult = class {
           logWarnings(recordedWarnings);
           recordedSteps.push(currentStepResult);
           recordedContent = [];
-          activeReasoningContent = {};
-          activeTextContent = {};
+          activeReasoningContent = createIdMap();
+          activeTextContent = createIdMap();
           recordedResponseMessages.push(...stepMessages);
           stepFinish.resolve();
         }
@@ -5566,7 +5566,8 @@ var DefaultStreamTextResult = class {
     sendSources = false,
     sendStart = true,
     sendFinish = true,
-    onError = import_provider23.getErrorMessage
+    onError = () => "An error occurred."
+    // prevent leaking server error details to the client by default
   } = {}) {
     const responseMessageId = generateMessageId != null ? getResponseUIMessageId({
       originalMessages,
@@ -6612,7 +6613,7 @@ function extractReasoningContent(content) {
 }
 
 // src/generate-object/output-strategy.ts
-var import_provider24 = require("@ai-sdk/provider");
+var import_provider23 = require("@ai-sdk/provider");
 var import_provider_utils19 = require("@ai-sdk/provider-utils");
 var noSchemaOutputStrategy = {
   type: "no-schema",
@@ -6633,7 +6634,7 @@ var noSchemaOutputStrategy = {
     } : { success: true, value };
   },
   createElementStream() {
-    throw new import_provider24.UnsupportedFunctionalityError({
+    throw new import_provider23.UnsupportedFunctionalityError({
       functionality: "element streams in no-schema mode"
     });
   }
@@ -6655,7 +6656,7 @@ var objectOutputStrategy = (schema) => ({
     return (0, import_provider_utils19.safeValidateTypes)({ value, schema });
   },
   createElementStream() {
-    throw new import_provider24.UnsupportedFunctionalityError({
+    throw new import_provider23.UnsupportedFunctionalityError({
       functionality: "element streams in object mode"
     });
   }
@@ -6683,10 +6684,10 @@ var arrayOutputStrategy = (schema) => {
       isFinalDelta
     }) {
       var _a16;
-      if (!(0, import_provider24.isJSONObject)(value) || !(0, import_provider24.isJSONArray)(value.elements)) {
+      if (!(0, import_provider23.isJSONObject)(value) || !(0, import_provider23.isJSONArray)(value.elements)) {
         return {
           success: false,
-          error: new import_provider24.TypeValidationError({
+          error: new import_provider23.TypeValidationError({
             value,
             cause: "value must be an object that contains an array of elements"
           })
@@ -6726,23 +6727,25 @@ var arrayOutputStrategy = (schema) => {
       };
     },
     async validateFinalResult(value) {
-      if (!(0, import_provider24.isJSONObject)(value) || !(0, import_provider24.isJSONArray)(value.elements)) {
+      if (!(0, import_provider23.isJSONObject)(value) || !(0, import_provider23.isJSONArray)(value.elements)) {
         return {
           success: false,
-          error: new import_provider24.TypeValidationError({
+          error: new import_provider23.TypeValidationError({
             value,
             cause: "value must be an object that contains an array of elements"
           })
         };
       }
       const inputArray = value.elements;
+      const resultArray = [];
       for (const element of inputArray) {
         const result = await (0, import_provider_utils19.safeValidateTypes)({ value: element, schema });
         if (!result.success) {
           return result;
         }
+        resultArray.push(result.value);
       }
-      return { success: true, value: inputArray };
+      return { success: true, value: resultArray };
     },
     createElementStream(originalStream) {
       let publishedElements = 0;
@@ -6792,10 +6795,10 @@ var enumOutputStrategy = (enumValues) => {
       additionalProperties: false
     },
     async validateFinalResult(value) {
-      if (!(0, import_provider24.isJSONObject)(value) || typeof value.result !== "string") {
+      if (!(0, import_provider23.isJSONObject)(value) || typeof value.result !== "string") {
         return {
           success: false,
-          error: new import_provider24.TypeValidationError({
+          error: new import_provider23.TypeValidationError({
             value,
             cause: 'value must be an object that contains a string in the "result" property.'
           })
@@ -6804,17 +6807,17 @@ var enumOutputStrategy = (enumValues) => {
       const result = value.result;
       return enumValues.includes(result) ? { success: true, value: result } : {
         success: false,
-        error: new import_provider24.TypeValidationError({
+        error: new import_provider23.TypeValidationError({
           value,
           cause: "value must be a string in the enum"
         })
       };
     },
     async validatePartialResult({ value, textDelta }) {
-      if (!(0, import_provider24.isJSONObject)(value) || typeof value.result !== "string") {
+      if (!(0, import_provider23.isJSONObject)(value) || typeof value.result !== "string") {
         return {
           success: false,
-          error: new import_provider24.TypeValidationError({
+          error: new import_provider23.TypeValidationError({
             value,
             cause: 'value must be an object that contains a string in the "result" property.'
           })
@@ -6827,7 +6830,7 @@ var enumOutputStrategy = (enumValues) => {
       if (value.result.length === 0 || possibleEnumValues.length === 0) {
         return {
           success: false,
-          error: new import_provider24.TypeValidationError({
+          error: new import_provider23.TypeValidationError({
             value,
             cause: "value must be a string in the enum"
           })
@@ -6842,7 +6845,7 @@ var enumOutputStrategy = (enumValues) => {
       };
     },
     createElementStream() {
-      throw new import_provider24.UnsupportedFunctionalityError({
+      throw new import_provider23.UnsupportedFunctionalityError({
         functionality: "element streams in enum mode"
       });
     }
@@ -6870,7 +6873,7 @@ function getOutputStrategy({
 }
 
 // src/generate-object/parse-and-validate-object-result.ts
-var import_provider25 = require("@ai-sdk/provider");
+var import_provider24 = require("@ai-sdk/provider");
 var import_provider_utils20 = require("@ai-sdk/provider-utils");
 async function parseAndValidateObjectResult(result, outputStrategy, context) {
   const parseResult = await (0, import_provider_utils20.safeParseJSON)({ text: result });
@@ -6908,7 +6911,7 @@ async function parseAndValidateObjectResultWithRepair(result, outputStrategy, re
   try {
     return await parseAndValidateObjectResult(result, outputStrategy, context);
   } catch (error) {
-    if (repairText != null && NoObjectGeneratedError.isInstance(error) && (import_provider25.JSONParseError.isInstance(error.cause) || import_provider25.TypeValidationError.isInstance(error.cause))) {
+    if (repairText != null && NoObjectGeneratedError.isInstance(error) && (import_provider24.JSONParseError.isInstance(error.cause) || import_provider24.TypeValidationError.isInstance(error.cause))) {
       const repairedText = await repairText({
         text: result,
         error: error.cause
@@ -8221,7 +8224,7 @@ function pruneMessages({
 
 // src/generate-text/smooth-stream.ts
 var import_provider_utils26 = require("@ai-sdk/provider-utils");
-var import_provider26 = require("@ai-sdk/provider");
+var import_provider25 = require("@ai-sdk/provider");
 var CHUNKING_REGEXPS = {
   word: /\S+\s+/m,
   line: /\n+/m
@@ -8251,7 +8254,7 @@ function smoothStream({
   } else {
     const chunkingRegex = typeof chunking === "string" ? CHUNKING_REGEXPS[chunking] : chunking;
     if (chunkingRegex == null) {
-      throw new import_provider26.InvalidArgumentError({
+      throw new import_provider25.InvalidArgumentError({
         argument: "chunking",
         message: `Chunking must be "word" or "line" or a RegExp. Received: ${chunking}`
       });
@@ -8372,7 +8375,7 @@ function extractReasoningMiddleware({
     },
     wrapStream: async ({ doStream }) => {
       const { stream, ...rest } = await doStream();
-      const reasoningExtractions = {};
+      const reasoningExtractions = createIdMap();
       let delayedTextStart;
       return {
         stream: stream.pipeThrough(
@@ -8623,7 +8626,7 @@ function wrapProvider({
 }
 
 // src/registry/custom-provider.ts
-var import_provider27 = require("@ai-sdk/provider");
+var import_provider26 = require("@ai-sdk/provider");
 function customProvider({
   languageModels,
   textEmbeddingModels,
@@ -8640,7 +8643,7 @@ function customProvider({
       if (fallbackProvider) {
         return fallbackProvider.languageModel(modelId);
       }
-      throw new import_provider27.NoSuchModelError({ modelId, modelType: "languageModel" });
+      throw new import_provider26.NoSuchModelError({ modelId, modelType: "languageModel" });
     },
     textEmbeddingModel(modelId) {
       if (textEmbeddingModels != null && modelId in textEmbeddingModels) {
@@ -8649,7 +8652,7 @@ function customProvider({
       if (fallbackProvider) {
         return fallbackProvider.textEmbeddingModel(modelId);
       }
-      throw new import_provider27.NoSuchModelError({ modelId, modelType: "textEmbeddingModel" });
+      throw new import_provider26.NoSuchModelError({ modelId, modelType: "textEmbeddingModel" });
     },
     imageModel(modelId) {
       if (imageModels != null && modelId in imageModels) {
@@ -8658,7 +8661,7 @@ function customProvider({
       if (fallbackProvider == null ? void 0 : fallbackProvider.imageModel) {
         return fallbackProvider.imageModel(modelId);
       }
-      throw new import_provider27.NoSuchModelError({ modelId, modelType: "imageModel" });
+      throw new import_provider26.NoSuchModelError({ modelId, modelType: "imageModel" });
     },
     transcriptionModel(modelId) {
       if (transcriptionModels != null && modelId in transcriptionModels) {
@@ -8667,7 +8670,7 @@ function customProvider({
       if (fallbackProvider == null ? void 0 : fallbackProvider.transcriptionModel) {
         return fallbackProvider.transcriptionModel(modelId);
       }
-      throw new import_provider27.NoSuchModelError({ modelId, modelType: "transcriptionModel" });
+      throw new import_provider26.NoSuchModelError({ modelId, modelType: "transcriptionModel" });
     },
     speechModel(modelId) {
       if (speechModels != null && modelId in speechModels) {
@@ -8676,19 +8679,19 @@ function customProvider({
       if (fallbackProvider == null ? void 0 : fallbackProvider.speechModel) {
         return fallbackProvider.speechModel(modelId);
       }
-      throw new import_provider27.NoSuchModelError({ modelId, modelType: "speechModel" });
+      throw new import_provider26.NoSuchModelError({ modelId, modelType: "speechModel" });
     }
   };
 }
 var experimental_customProvider = customProvider;
 
 // src/registry/no-such-provider-error.ts
-var import_provider28 = require("@ai-sdk/provider");
+var import_provider27 = require("@ai-sdk/provider");
 var name15 = "AI_NoSuchProviderError";
 var marker15 = `vercel.ai.error.${name15}`;
 var symbol15 = Symbol.for(marker15);
 var _a15;
-var NoSuchProviderError = class extends import_provider28.NoSuchModelError {
+var NoSuchProviderError = class extends import_provider27.NoSuchModelError {
   constructor({
     modelId,
     modelType,
@@ -8702,13 +8705,13 @@ var NoSuchProviderError = class extends import_provider28.NoSuchModelError {
     this.availableProviders = availableProviders;
   }
   static isInstance(error) {
-    return import_provider28.AISDKError.hasMarker(error, marker15);
+    return import_provider27.AISDKError.hasMarker(error, marker15);
   }
 };
 _a15 = symbol15;
 
 // src/registry/provider-registry.ts
-var import_provider29 = require("@ai-sdk/provider");
+var import_provider28 = require("@ai-sdk/provider");
 function createProviderRegistry(providers, {
   separator = ":",
   languageModelMiddleware
@@ -8753,7 +8756,7 @@ var DefaultProviderRegistry = class {
   splitId(id, modelType) {
     const index = id.indexOf(this.separator);
     if (index === -1) {
-      throw new import_provider29.NoSuchModelError({
+      throw new import_provider28.NoSuchModelError({
         modelId: id,
         modelType,
         message: `Invalid ${modelType} id for registry: ${id} (must be in the format "providerId${this.separator}modelId")`
@@ -8769,7 +8772,7 @@ var DefaultProviderRegistry = class {
       modelId
     );
     if (model == null) {
-      throw new import_provider29.NoSuchModelError({ modelId: id, modelType: "languageModel" });
+      throw new import_provider28.NoSuchModelError({ modelId: id, modelType: "languageModel" });
     }
     if (this.languageModelMiddleware != null) {
       model = wrapLanguageModel({
@@ -8785,7 +8788,7 @@ var DefaultProviderRegistry = class {
     const provider = this.getProvider(providerId, "textEmbeddingModel");
     const model = (_a16 = provider.textEmbeddingModel) == null ? void 0 : _a16.call(provider, modelId);
     if (model == null) {
-      throw new import_provider29.NoSuchModelError({
+      throw new import_provider28.NoSuchModelError({
         modelId: id,
         modelType: "textEmbeddingModel"
       });
@@ -8798,7 +8801,7 @@ var DefaultProviderRegistry = class {
     const provider = this.getProvider(providerId, "imageModel");
     const model = (_a16 = provider.imageModel) == null ? void 0 : _a16.call(provider, modelId);
     if (model == null) {
-      throw new import_provider29.NoSuchModelError({ modelId: id, modelType: "imageModel" });
+      throw new import_provider28.NoSuchModelError({ modelId: id, modelType: "imageModel" });
     }
     return model;
   }
@@ -8808,7 +8811,7 @@ var DefaultProviderRegistry = class {
     const provider = this.getProvider(providerId, "transcriptionModel");
     const model = (_a16 = provider.transcriptionModel) == null ? void 0 : _a16.call(provider, modelId);
     if (model == null) {
-      throw new import_provider29.NoSuchModelError({
+      throw new import_provider28.NoSuchModelError({
         modelId: id,
         modelType: "transcriptionModel"
       });
@@ -8821,7 +8824,7 @@ var DefaultProviderRegistry = class {
     const provider = this.getProvider(providerId, "speechModel");
     const model = (_a16 = provider.speechModel) == null ? void 0 : _a16.call(provider, modelId);
     if (model == null) {
-      throw new import_provider29.NoSuchModelError({ modelId: id, modelType: "speechModel" });
+      throw new import_provider28.NoSuchModelError({ modelId: id, modelType: "speechModel" });
     }
     return model;
   }
@@ -8831,8 +8834,8 @@ var DefaultProviderRegistry = class {
 var import_provider_utils27 = require("@ai-sdk/provider-utils");
 
 // src/error/no-transcript-generated-error.ts
-var import_provider30 = require("@ai-sdk/provider");
-var NoTranscriptGeneratedError = class extends import_provider30.AISDKError {
+var import_provider29 = require("@ai-sdk/provider");
+var NoTranscriptGeneratedError = class extends import_provider29.AISDKError {
   constructor(options) {
     super({
       name: "AI_NoTranscriptGeneratedError",
@@ -9610,7 +9613,7 @@ var TextStreamChatTransport = class extends HttpChatTransport {
 };
 
 // src/ui/validate-ui-messages.ts
-var import_provider31 = require("@ai-sdk/provider");
+var import_provider30 = require("@ai-sdk/provider");
 var import_provider_utils32 = require("@ai-sdk/provider-utils");
 var import_v48 = require("zod/v4");
 var uiMessagesSchema = (0, import_provider_utils32.lazyValidator)(
@@ -9851,7 +9854,7 @@ async function safeValidateUIMessages({
           if (!dataSchema) {
             return {
               success: false,
-              error: new import_provider31.TypeValidationError({
+              error: new import_provider30.TypeValidationError({
                 value: dataPart.data,
                 cause: `No data schema found for data part ${dataName}`
               })
@@ -9875,7 +9878,7 @@ async function safeValidateUIMessages({
           if (!tool2) {
             return {
               success: false,
-              error: new import_provider31.TypeValidationError({
+              error: new import_provider30.TypeValidationError({
                 value: toolPart.input,
                 cause: `No tool schema found for tool part ${toolName}`
               })
@@ -9929,7 +9932,8 @@ async function validateUIMessages({
 var import_provider_utils33 = require("@ai-sdk/provider-utils");
 function createUIMessageStream({
   execute,
-  onError = import_provider_utils33.getErrorMessage,
+  onError = () => "An error occurred.",
+  // prevent leaking server error details to the client by default
   originalMessages,
   onFinish,
   generateId: generateId3 = import_provider_utils33.generateId