ai 6.0.201 → 6.0.203

package/src/ui/ui-messages.ts

@@ -256,6 +256,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved?: never;
         reason?: never;
+        signature?: string;
       };
     }
   | {
@@ -268,6 +269,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: boolean;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -282,6 +284,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -296,6 +299,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -308,6 +312,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
         id: string;
         approved: false;
         reason?: string;
+        signature?: string;
       };
     }
 );
@@ -364,6 +369,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved?: never;
         reason?: never;
+        signature?: string;
       };
     }
   | {
@@ -376,6 +382,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: boolean;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -390,6 +397,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -403,6 +411,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: true;
         reason?: string;
+        signature?: string;
       };
     }
   | {
@@ -415,6 +424,7 @@ export type DynamicToolUIPart = {
         id: string;
         approved: false;
         reason?: string;
+        signature?: string;
       };
     }
 );

package/src/ui/validate-ui-messages.ts

@@ -122,6 +122,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.never().optional(),
                     reason: z.never().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -139,6 +140,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.boolean(),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -159,6 +161,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -180,6 +183,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -198,6 +202,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.literal(false),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -238,6 +243,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.never().optional(),
                     reason: z.never().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -254,6 +260,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.boolean(),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
                 z.object({
@@ -273,6 +280,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -293,6 +301,7 @@ const uiMessagesSchema = lazySchema(() =>
                       id: z.string(),
                       approved: z.literal(true),
                       reason: z.string().optional(),
+                      signature: z.string().optional(),
                     })
                     .optional(),
                 }),
@@ -310,6 +319,7 @@ const uiMessagesSchema = lazySchema(() =>
                     id: z.string(),
                     approved: z.literal(false),
                     reason: z.string().optional(),
+                    signature: z.string().optional(),
                   }),
                 }),
               ]),

package/src/ui-message-stream/create-ui-message-stream.ts

@@ -1,6 +1,5 @@
 import {
   generateId as generateIdFunc,
-  getErrorMessage,
   type IdGenerator,
 } from '@ai-sdk/provider-utils';
 import type { UIMessage } from '../ui/ui-messages';
@@ -14,7 +13,7 @@ import type { UIMessageStreamWriter } from './ui-message-stream-writer';
  * Creates a UI message stream that can be used to send messages to the client.
  *
  * @param options.execute - A function that is called with a writer to write UI message chunks to the stream.
- * @param options.onError - A function that extracts an error message from an error. Defaults to `getErrorMessage`.
+ * @param options.onError - A function that extracts an error message from an error. Defaults to `() => 'An error occurred.'` so server-side error details are not leaked to the client; supply your own to surface richer messages.
  * @param options.originalMessages - The original messages. If provided, persistence mode is assumed
  *   and a message ID is provided for the response message.
  * @param options.onStepFinish - A callback that is called when each step finishes. Useful for persisting intermediate messages.
@@ -25,7 +24,7 @@ import type { UIMessageStreamWriter } from './ui-message-stream-writer';
  */
 export function createUIMessageStream<UI_MESSAGE extends UIMessage>({
   execute,
-  onError = getErrorMessage,
+  onError = () => 'An error occurred.', // prevent leaking server error details to the client by default
   originalMessages,
   onStepFinish,
   onFinish,

package/src/ui-message-stream/ui-message-chunks.ts

@@ -85,6 +85,7 @@ export const uiMessageChunkSchema = lazySchema(() =>
         type: z.literal('tool-approval-request'),
         approvalId: z.string(),
         toolCallId: z.string(),
+        signature: z.string().optional(),
       }),
       z.strictObject({
         type: z.literal('tool-output-available'),
@@ -269,6 +270,7 @@ export type UIMessageChunk<
       type: 'tool-approval-request';
       approvalId: string;
       toolCallId: string;
+      signature?: string;
     }
   | {
       type: 'tool-output-available';

package/src/util/download/download.ts

@@ -2,7 +2,7 @@ import {
   DownloadError,
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
-  validateDownloadUrl,
+  fetchWithValidatedRedirects,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -28,21 +28,18 @@ export const download = async ({
   abortSignal?: AbortSignal;
 }) => {
   const urlText = url.toString();
-  validateDownloadUrl(urlText);
   try {
-    const response = await fetch(urlText, {
-      headers: withUserAgentSuffix(
-        {},
-        `ai-sdk/${VERSION}`,
-        getRuntimeEnvironmentUserAgent(),
-      ),
-      signal: abortSignal,
-    });
+    const headers = withUserAgentSuffix(
+      {},
+      `ai-sdk/${VERSION}`,
+      getRuntimeEnvironmentUserAgent(),
+    );
 
-    // Validate final URL after redirects to prevent SSRF via open redirect
-    if (response.redirected) {
-      validateDownloadUrl(response.url);
-    }
+    const response = await fetchWithValidatedRedirects({
+      url: urlText,
+      headers,
+      abortSignal,
+    });
 
     if (!response.ok) {
       throw new DownloadError({