ai 6.0.310 → 6.0.312

package/dist/internal/index.js

@@ -164,7 +164,7 @@ function detectMediaType({
 var import_provider_utils2 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "6.0.310" : "0.0.0-test";
+var VERSION = true ? "6.0.312" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/dist/internal/index.mjs

@@ -144,7 +144,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "6.0.310" : "0.0.0-test";
+var VERSION = true ? "6.0.312" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/docs/03-ai-sdk-core/16-mcp-tools.mdx

@@ -156,6 +156,33 @@ tokens are invalid.
 
 ### OAuth Authorization Server Validation
 
+Pre-registered confidential clients must be bound to their authorization server
+before starting OAuth. Set `issuer` on the credentials returned by
+`clientInformation()` to the issuer of the server that registered the client:
+
+```typescript
+clientInformation() {
+  return {
+    client_id: process.env.OAUTH_CLIENT_ID!,
+    client_secret: process.env.OAUTH_CLIENT_SECRET!,
+    issuer: 'https://accounts.example.com',
+  };
+}
+```
+
+The issuer must exactly match the discovered issuer. The SDK rejects a mismatch
+before redirecting or sending credentials, even if a stored authorization flow
+pin names the discovered server. Dynamic client registration attaches this
+binding automatically.
+
+Existing complete authorization server bindings on credentials, stored tokens,
+or `authorizationServerInformation()` are also supported. Without a binding,
+a pre-registered client secret or custom `addClientAuthentication` handler is
+rejected, even when `validateAuthorizationServerURL` accepts the selected server.
+Approving a server does not establish that the credentials belong to it.
+Do not derive the credential issuer from the MCP server's metadata; configure it
+from the client's registration.
+
 When using MCP OAuth in server-side applications, the MCP server can advertise
 the OAuth authorization server to use. If you connect to MCP servers outside
 your control, implement `validateAuthorizationServerURL` on your
@@ -183,8 +210,8 @@ const myOAuthClientProvider = {
 ```
 
 This hook is called before the SDK fetches authorization server metadata, so a
-rejected URL is not requested. It is optional and does not change existing OAuth
-flows unless you implement it.
+rejected URL is not requested. The hook is an optional additional restriction;
+it does not replace the credential binding required for confidential clients.
 
 ### OAuth Callback Issuer Validation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "6.0.310",
+  "version": "6.0.312",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -45,9 +45,9 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@ai-sdk/gateway": "3.0.218",
+    "@ai-sdk/gateway": "3.0.219",
     "@ai-sdk/provider": "3.0.19",
-    "@ai-sdk/provider-utils": "4.0.61"
+    "@ai-sdk/provider-utils": "4.0.62"
   },
   "devDependencies": {
     "@edge-runtime/vm": "^5.0.0",
@@ -58,7 +58,7 @@
     "tsx": "^4.19.2",
     "typescript": "5.8.3",
     "zod": "3.25.76",
-    "@ai-sdk/google": "3.0.136",
+    "@ai-sdk/google": "3.0.137",
     "@ai-sdk/test-server": "1.0.6",
     "@vercel/ai-tsconfig": "0.0.0"
   },

package/src/generate-text/stream-text.ts

@@ -1411,6 +1411,19 @@ class DefaultStreamTextResult<
       },
     });
 
+    // introduce a gate that prevent further tokens from
+    // being emitted after a transform calls stopStream
+    let isRunning = true;
+    stream = stream.pipeThrough(
+      new TransformStream({
+        async transform(chunk, controller) {
+          if (isRunning) {
+            controller.enqueue(chunk);
+          }
+        },
+      }),
+    );
+
     // transform the stream before output parsing
     // to enable replacement of stream segments:
     for (const transform of transforms) {
@@ -1419,6 +1432,7 @@ class DefaultStreamTextResult<
           tools: tools as TOOLS,
           stopStream() {
             stitchableStream.terminate();
+            isRunning = false;
           },
         }),
       );