ai 6.0.169 → 6.0.170

package/dist/index.mjs

@@ -1143,7 +1143,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "6.0.169" : "0.0.0-test";
+var VERSION = true ? "6.0.170" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -2040,35 +2040,35 @@ var modelMessageSchema = z5.union([
 ]);
 
 // src/prompt/standardize-prompt.ts
-async function standardizePrompt(prompt) {
-  if (prompt.prompt == null && prompt.messages == null) {
+async function standardizePrompt({
+  allowSystemInMessages,
+  system,
+  prompt,
+  messages
+}) {
+  if (prompt == null && messages == null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt or messages must be defined"
     });
   }
-  if (prompt.prompt != null && prompt.messages != null) {
+  if (prompt != null && messages != null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt and messages cannot be defined at the same time"
     });
   }
-  if (prompt.system != null && typeof prompt.system !== "string" && !asArray(prompt.system).every(
-    (message) => typeof message === "object" && message !== null && "role" in message && message.role === "system"
-  )) {
+  if (typeof system !== "string" && !asArray(system).every((message) => message.role === "system")) {
     throw new InvalidPromptError2({
       prompt,
       message: "system must be a string, SystemModelMessage, or array of SystemModelMessage"
     });
   }
-  let messages;
-  if (prompt.prompt != null && typeof prompt.prompt === "string") {
-    messages = [{ role: "user", content: prompt.prompt }];
-  } else if (prompt.prompt != null && Array.isArray(prompt.prompt)) {
-    messages = prompt.prompt;
-  } else if (prompt.messages != null) {
-    messages = prompt.messages;
-  } else {
+  if (prompt != null && typeof prompt === "string") {
+    messages = [{ role: "user", content: prompt }];
+  } else if (prompt != null && Array.isArray(prompt)) {
+    messages = prompt;
+  } else if (messages == null) {
     throw new InvalidPromptError2({
       prompt,
       message: "prompt or messages must be defined"
@@ -2080,6 +2080,19 @@ async function standardizePrompt(prompt) {
       message: "messages must not be empty"
     });
   }
+  if (messages.some((message) => message.role === "system")) {
+    if (allowSystemInMessages === false) {
+      throw new InvalidPromptError2({
+        prompt,
+        message: "System messages are not allowed in the prompt or messages fields. Use the system option instead."
+      });
+    }
+    if (allowSystemInMessages === void 0) {
+      console.warn(
+        "AI SDK Warning: System messages in the prompt or messages fields can be a security risk because they may enable prompt injection attacks. Use the system option instead when possible. Set allowSystemInMessages to true to suppress this warning, or false to throw an error."
+      );
+    }
+  }
   const validationResult = await safeValidateTypes({
     value: messages,
     schema: z6.array(modelMessageSchema)
@@ -2091,10 +2104,7 @@ async function standardizePrompt(prompt) {
       cause: validationResult.error
     });
   }
-  return {
-    messages,
-    system: prompt.system
-  };
+  return { messages, system };
 }
 
 // src/prompt/wrap-gateway-error.ts
@@ -4028,6 +4038,7 @@ async function generateText({
   system,
   prompt,
   messages,
+  allowSystemInMessages,
   maxRetries: maxRetriesArg,
   abortSignal,
   timeout,
@@ -4084,7 +4095,8 @@ async function generateText({
   const initialPrompt = await standardizePrompt({
     system,
     prompt,
-    messages
+    messages,
+    allowSystemInMessages
   });
   const globalTelemetry = createGlobalTelemetry(telemetry == null ? void 0 : telemetry.integrations);
   await notify({
@@ -6374,6 +6386,7 @@ function streamText({
   system,
   prompt,
   messages,
+  allowSystemInMessages,
   maxRetries,
   abortSignal,
   timeout,
@@ -6430,6 +6443,7 @@ function streamText({
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     tools,
     toolChoice,
     transforms: asArray(transform),
@@ -6536,6 +6550,7 @@ var DefaultStreamTextResult = class {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     tools,
     toolChoice,
     transforms,
@@ -6927,7 +6942,8 @@ var DefaultStreamTextResult = class {
         const initialPrompt = await standardizePrompt({
           system,
           prompt,
-          messages
+          messages,
+          allowSystemInMessages
         });
         await notify({
           event: {
@@ -10057,6 +10073,7 @@ async function generateObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     maxRetries: maxRetriesArg,
     abortSignal,
     headers,
@@ -10141,7 +10158,8 @@ async function generateObject(options) {
         const standardizedPrompt = await standardizePrompt({
           system,
           prompt,
-          messages
+          messages,
+          allowSystemInMessages
         });
         const promptMessages = await convertToLanguageModelPrompt({
           prompt: standardizedPrompt,
@@ -10469,6 +10487,7 @@ function streamObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     maxRetries,
     abortSignal,
     headers,
@@ -10516,6 +10535,7 @@ function streamObject(options) {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     schemaName,
     schemaDescription,
     providerOptions,
@@ -10540,6 +10560,7 @@ var DefaultStreamObjectResult = class {
     system,
     prompt,
     messages,
+    allowSystemInMessages,
     schemaName,
     schemaDescription,
     providerOptions,
@@ -10610,7 +10631,8 @@ var DefaultStreamObjectResult = class {
         const standardizedPrompt = await standardizePrompt({
           system,
           prompt,
-          messages
+          messages,
+          allowSystemInMessages
         });
         const callOptions = {
           responseFormat: {