ai 6.0.117 → 6.0.119

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # ai
 
+## 6.0.119
+
+### Patch Changes
+
+- ab286f1: fix(ai): doStream should reflect transformed values
+- d68b122: feat(ai): add missing usage attributes
+
+## 6.0.118
+
+### Patch Changes
+
+- 64ac0fd: fix(security): validate redirect targets in download functions to prevent SSRF bypass
+
+  Both `downloadBlob` and `download` now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.
+
+- Updated dependencies [64ac0fd]
+  - @ai-sdk/provider-utils@4.0.20
+  - @ai-sdk/gateway@3.0.68
+
 ## 6.0.117
 
 ### Patch Changes

package/dist/index.js

@@ -1230,7 +1230,7 @@ var import_provider_utils3 = require("@ai-sdk/provider-utils");
 var import_provider_utils4 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "6.0.117" : "0.0.0-test";
+var VERSION = true ? "6.0.119" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -1250,6 +1250,9 @@ var download = async ({
       ),
       signal: abortSignal
     });
+    if (response.redirected) {
+      (0, import_provider_utils3.validateDownloadUrl)(response.url);
+    }
     if (!response.ok) {
       throw new import_provider_utils3.DownloadError({
         url: urlText,
@@ -4203,7 +4206,7 @@ async function generateText({
       }),
       tracer,
       fn: async (span) => {
-        var _a21, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
+        var _a21, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
         const initialMessages = initialPrompt.messages;
         const responseMessages = [];
         const { approvedToolApprovals, deniedToolApprovals } = collectToolApprovals({ messages: initialMessages });
@@ -4420,6 +4423,7 @@ async function generateText({
                       headers: (_g2 = result.response) == null ? void 0 : _g2.headers,
                       body: (_h2 = result.response) == null ? void 0 : _h2.body
                     };
+                    const usage = asLanguageModelUsage(result.usage);
                     span2.setAttributes(
                       await selectTelemetryAttributes({
                         telemetry,
@@ -4443,9 +4447,16 @@ async function generateText({
                           "ai.response.providerMetadata": JSON.stringify(
                             result.providerMetadata
                           ),
-                          // TODO rename telemetry attributes to inputTokens and outputTokens
-                          "ai.usage.promptTokens": result.usage.inputTokens.total,
-                          "ai.usage.completionTokens": result.usage.outputTokens.total,
+                          "ai.usage.inputTokens": result.usage.inputTokens.total,
+                          "ai.usage.inputTokenDetails.noCacheTokens": result.usage.inputTokens.noCache,
+                          "ai.usage.inputTokenDetails.cacheReadTokens": result.usage.inputTokens.cacheRead,
+                          "ai.usage.inputTokenDetails.cacheWriteTokens": result.usage.inputTokens.cacheWrite,
+                          "ai.usage.outputTokens": result.usage.outputTokens.total,
+                          "ai.usage.outputTokenDetails.textTokens": result.usage.outputTokens.text,
+                          "ai.usage.outputTokenDetails.reasoningTokens": result.usage.outputTokens.reasoning,
+                          "ai.usage.totalTokens": usage.totalTokens,
+                          "ai.usage.reasoningTokens": result.usage.outputTokens.reasoning,
+                          "ai.usage.cachedInputTokens": result.usage.inputTokens.cacheRead,
                           // standardized gen-ai llm span attributes:
                           "gen_ai.response.finish_reasons": [
                             result.finishReason.unified
@@ -4646,10 +4657,7 @@ async function generateText({
               },
               "ai.response.providerMetadata": JSON.stringify(
                 currentModelResponse.providerMetadata
-              ),
-              // TODO rename telemetry attributes to inputTokens and outputTokens
-              "ai.usage.promptTokens": currentModelResponse.usage.inputTokens.total,
-              "ai.usage.completionTokens": currentModelResponse.usage.outputTokens.total
+              )
             }
           })
         );
@@ -4666,6 +4674,23 @@ async function generateText({
             cachedInputTokens: void 0
           }
         );
+        span.setAttributes(
+          await selectTelemetryAttributes({
+            telemetry,
+            attributes: {
+              "ai.usage.inputTokens": totalUsage.inputTokens,
+              "ai.usage.inputTokenDetails.noCacheTokens": (_n = totalUsage.inputTokenDetails) == null ? void 0 : _n.noCacheTokens,
+              "ai.usage.inputTokenDetails.cacheReadTokens": (_o = totalUsage.inputTokenDetails) == null ? void 0 : _o.cacheReadTokens,
+              "ai.usage.inputTokenDetails.cacheWriteTokens": (_p = totalUsage.inputTokenDetails) == null ? void 0 : _p.cacheWriteTokens,
+              "ai.usage.outputTokens": totalUsage.outputTokens,
+              "ai.usage.outputTokenDetails.textTokens": (_q = totalUsage.outputTokenDetails) == null ? void 0 : _q.textTokens,
+              "ai.usage.outputTokenDetails.reasoningTokens": (_r = totalUsage.outputTokenDetails) == null ? void 0 : _r.reasoningTokens,
+              "ai.usage.totalTokens": totalUsage.totalTokens,
+              "ai.usage.reasoningTokens": (_s = totalUsage.outputTokenDetails) == null ? void 0 : _s.reasoningTokens,
+              "ai.usage.cachedInputTokens": (_t = totalUsage.inputTokenDetails) == null ? void 0 : _t.cacheReadTokens
+            }
+          })
+        );
         await notify({
           event: {
             stepNumber: lastStep.stepNumber,
@@ -6764,6 +6789,7 @@ var DefaultStreamTextResult = class {
         }
       },
       async flush(controller) {
+        var _a21, _b, _c, _d, _e, _f, _g;
         try {
           if (recordedSteps.length === 0) {
             const error = (abortSignal == null ? void 0 : abortSignal.aborted) ? abortSignal.reason : new NoOutputGeneratedError({
@@ -6827,18 +6853,23 @@ var DefaultStreamTextResult = class {
                 },
                 "ai.response.toolCalls": {
                   output: () => {
-                    var _a21;
-                    return ((_a21 = finalStep.toolCalls) == null ? void 0 : _a21.length) ? JSON.stringify(finalStep.toolCalls) : void 0;
+                    var _a22;
+                    return ((_a22 = finalStep.toolCalls) == null ? void 0 : _a22.length) ? JSON.stringify(finalStep.toolCalls) : void 0;
                   }
                 },
                 "ai.response.providerMetadata": JSON.stringify(
                   finalStep.providerMetadata
                 ),
                 "ai.usage.inputTokens": totalUsage.inputTokens,
+                "ai.usage.inputTokenDetails.noCacheTokens": (_a21 = totalUsage.inputTokenDetails) == null ? void 0 : _a21.noCacheTokens,
+                "ai.usage.inputTokenDetails.cacheReadTokens": (_b = totalUsage.inputTokenDetails) == null ? void 0 : _b.cacheReadTokens,
+                "ai.usage.inputTokenDetails.cacheWriteTokens": (_c = totalUsage.inputTokenDetails) == null ? void 0 : _c.cacheWriteTokens,
                 "ai.usage.outputTokens": totalUsage.outputTokens,
+                "ai.usage.outputTokenDetails.textTokens": (_d = totalUsage.outputTokenDetails) == null ? void 0 : _d.textTokens,
+                "ai.usage.outputTokenDetails.reasoningTokens": (_e = totalUsage.outputTokenDetails) == null ? void 0 : _e.reasoningTokens,
                 "ai.usage.totalTokens": totalUsage.totalTokens,
-                "ai.usage.reasoningTokens": totalUsage.reasoningTokens,
-                "ai.usage.cachedInputTokens": totalUsage.cachedInputTokens
+                "ai.usage.reasoningTokens": (_f = totalUsage.outputTokenDetails) == null ? void 0 : _f.reasoningTokens,
+                "ai.usage.cachedInputTokens": (_g = totalUsage.inputTokenDetails) == null ? void 0 : _g.cacheReadTokens
               }
             })
           );
@@ -7450,6 +7481,7 @@ var DefaultStreamTextResult = class {
                   },
                   // invoke onFinish callback and resolve toolResults promise when the stream is about to close:
                   async flush(controller) {
+                    var _a22, _b2, _c2, _d2, _e2, _f2, _g2;
                     const stepToolCallsJson = stepToolCalls.length > 0 ? JSON.stringify(stepToolCalls) : void 0;
                     try {
                       doStreamSpan.setAttributes(
@@ -7457,29 +7489,22 @@ var DefaultStreamTextResult = class {
                           telemetry,
                           attributes: {
                             "ai.response.finishReason": stepFinishReason,
-                            "ai.response.text": {
-                              output: () => activeText
-                            },
-                            "ai.response.reasoning": {
-                              output: () => {
-                                const reasoningParts = recordedContent.filter(
-                                  (c) => c.type === "reasoning"
-                                );
-                                return reasoningParts.length > 0 ? reasoningParts.map((r) => r.text).join("\n") : void 0;
-                              }
-                            },
                             "ai.response.toolCalls": {
                               output: () => stepToolCallsJson
                             },
                             "ai.response.id": stepResponse.id,
                             "ai.response.model": stepResponse.modelId,
                             "ai.response.timestamp": stepResponse.timestamp.toISOString(),
-                            "ai.response.providerMetadata": JSON.stringify(stepProviderMetadata),
                             "ai.usage.inputTokens": stepUsage.inputTokens,
+                            "ai.usage.inputTokenDetails.noCacheTokens": (_a22 = stepUsage.inputTokenDetails) == null ? void 0 : _a22.noCacheTokens,
+                            "ai.usage.inputTokenDetails.cacheReadTokens": (_b2 = stepUsage.inputTokenDetails) == null ? void 0 : _b2.cacheReadTokens,
+                            "ai.usage.inputTokenDetails.cacheWriteTokens": (_c2 = stepUsage.inputTokenDetails) == null ? void 0 : _c2.cacheWriteTokens,
                             "ai.usage.outputTokens": stepUsage.outputTokens,
+                            "ai.usage.outputTokenDetails.textTokens": (_d2 = stepUsage.outputTokenDetails) == null ? void 0 : _d2.textTokens,
+                            "ai.usage.outputTokenDetails.reasoningTokens": (_e2 = stepUsage.outputTokenDetails) == null ? void 0 : _e2.reasoningTokens,
                             "ai.usage.totalTokens": stepUsage.totalTokens,
-                            "ai.usage.reasoningTokens": stepUsage.reasoningTokens,
-                            "ai.usage.cachedInputTokens": stepUsage.cachedInputTokens,
+                            "ai.usage.reasoningTokens": (_f2 = stepUsage.outputTokenDetails) == null ? void 0 : _f2.reasoningTokens,
+                            "ai.usage.cachedInputTokens": (_g2 = stepUsage.inputTokenDetails) == null ? void 0 : _g2.cacheReadTokens,
                             // standardized gen-ai llm span attributes:
                             "gen_ai.response.finish_reasons": [
                               stepFinishReason
@@ -7492,8 +7517,6 @@ var DefaultStreamTextResult = class {
                         })
                       );
                     } catch (error) {
-                    } finally {
-                      doStreamSpan.end();
                     }
                     controller.enqueue({
                       type: "finish-step",
@@ -7511,6 +7534,28 @@ var DefaultStreamTextResult = class {
                       stepUsage
                     );
                     await stepFinish.promise;
+                    const processedStep = recordedSteps[recordedSteps.length - 1];
+                    try {
+                      doStreamSpan.setAttributes(
+                        await selectTelemetryAttributes({
+                          telemetry,
+                          attributes: {
+                            "ai.response.text": {
+                              output: () => processedStep.text
+                            },
+                            "ai.response.reasoning": {
+                              output: () => processedStep.reasoningText
+                            },
+                            "ai.response.providerMetadata": JSON.stringify(
+                              processedStep.providerMetadata
+                            )
+                          }
+                        })
+                      );
+                    } catch (error) {
+                    } finally {
+                      doStreamSpan.end();
+                    }
                     const clientToolCalls = stepToolCalls.filter(
                       (toolCall) => toolCall.providerExecuted !== true
                     );