ai 6.0.311 → 6.0.312
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/dist/index.js +1 -1
- package/dist/index.mjs +1 -1
- package/dist/internal/index.js +1 -1
- package/dist/internal/index.mjs +1 -1
- package/docs/03-ai-sdk-core/16-mcp-tools.mdx +29 -2
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# ai
|
|
2
2
|
|
|
3
|
+
## 6.0.312
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [1183cc4]
|
|
8
|
+
- Updated dependencies [ae8a8d4]
|
|
9
|
+
- Updated dependencies [93e9720]
|
|
10
|
+
- Updated dependencies [d726591]
|
|
11
|
+
- @ai-sdk/provider-utils@4.0.62
|
|
12
|
+
- @ai-sdk/gateway@3.0.219
|
|
13
|
+
|
|
3
14
|
## 6.0.311
|
|
4
15
|
|
|
5
16
|
### Patch Changes
|
package/dist/index.js
CHANGED
|
@@ -1335,7 +1335,7 @@ function detectMediaType({
|
|
|
1335
1335
|
var import_provider_utils3 = require("@ai-sdk/provider-utils");
|
|
1336
1336
|
|
|
1337
1337
|
// src/version.ts
|
|
1338
|
-
var VERSION = true ? "6.0.
|
|
1338
|
+
var VERSION = true ? "6.0.312" : "0.0.0-test";
|
|
1339
1339
|
|
|
1340
1340
|
// src/util/download/download.ts
|
|
1341
1341
|
var download = async ({
|
package/dist/index.mjs
CHANGED
|
@@ -1225,7 +1225,7 @@ import {
|
|
|
1225
1225
|
} from "@ai-sdk/provider-utils";
|
|
1226
1226
|
|
|
1227
1227
|
// src/version.ts
|
|
1228
|
-
var VERSION = true ? "6.0.
|
|
1228
|
+
var VERSION = true ? "6.0.312" : "0.0.0-test";
|
|
1229
1229
|
|
|
1230
1230
|
// src/util/download/download.ts
|
|
1231
1231
|
var download = async ({
|
package/dist/internal/index.js
CHANGED
|
@@ -164,7 +164,7 @@ function detectMediaType({
|
|
|
164
164
|
var import_provider_utils2 = require("@ai-sdk/provider-utils");
|
|
165
165
|
|
|
166
166
|
// src/version.ts
|
|
167
|
-
var VERSION = true ? "6.0.
|
|
167
|
+
var VERSION = true ? "6.0.312" : "0.0.0-test";
|
|
168
168
|
|
|
169
169
|
// src/util/download/download.ts
|
|
170
170
|
var download = async ({
|
package/dist/internal/index.mjs
CHANGED
|
@@ -156,6 +156,33 @@ tokens are invalid.
|
|
|
156
156
|
|
|
157
157
|
### OAuth Authorization Server Validation
|
|
158
158
|
|
|
159
|
+
Pre-registered confidential clients must be bound to their authorization server
|
|
160
|
+
before starting OAuth. Set `issuer` on the credentials returned by
|
|
161
|
+
`clientInformation()` to the issuer of the server that registered the client:
|
|
162
|
+
|
|
163
|
+
```typescript
|
|
164
|
+
clientInformation() {
|
|
165
|
+
return {
|
|
166
|
+
client_id: process.env.OAUTH_CLIENT_ID!,
|
|
167
|
+
client_secret: process.env.OAUTH_CLIENT_SECRET!,
|
|
168
|
+
issuer: 'https://accounts.example.com',
|
|
169
|
+
};
|
|
170
|
+
}
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
The issuer must exactly match the discovered issuer. The SDK rejects a mismatch
|
|
174
|
+
before redirecting or sending credentials, even if a stored authorization flow
|
|
175
|
+
pin names the discovered server. Dynamic client registration attaches this
|
|
176
|
+
binding automatically.
|
|
177
|
+
|
|
178
|
+
Existing complete authorization server bindings on credentials, stored tokens,
|
|
179
|
+
or `authorizationServerInformation()` are also supported. Without a binding,
|
|
180
|
+
a pre-registered client secret or custom `addClientAuthentication` handler is
|
|
181
|
+
rejected, even when `validateAuthorizationServerURL` accepts the selected server.
|
|
182
|
+
Approving a server does not establish that the credentials belong to it.
|
|
183
|
+
Do not derive the credential issuer from the MCP server's metadata; configure it
|
|
184
|
+
from the client's registration.
|
|
185
|
+
|
|
159
186
|
When using MCP OAuth in server-side applications, the MCP server can advertise
|
|
160
187
|
the OAuth authorization server to use. If you connect to MCP servers outside
|
|
161
188
|
your control, implement `validateAuthorizationServerURL` on your
|
|
@@ -183,8 +210,8 @@ const myOAuthClientProvider = {
|
|
|
183
210
|
```
|
|
184
211
|
|
|
185
212
|
This hook is called before the SDK fetches authorization server metadata, so a
|
|
186
|
-
rejected URL is not requested.
|
|
187
|
-
|
|
213
|
+
rejected URL is not requested. The hook is an optional additional restriction;
|
|
214
|
+
it does not replace the credential binding required for confidential clients.
|
|
188
215
|
|
|
189
216
|
### OAuth Callback Issuer Validation
|
|
190
217
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "ai",
|
|
3
|
-
"version": "6.0.
|
|
3
|
+
"version": "6.0.312",
|
|
4
4
|
"description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"sideEffects": false,
|
|
@@ -45,9 +45,9 @@
|
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@opentelemetry/api": "^1.9.0",
|
|
48
|
-
"@ai-sdk/gateway": "3.0.
|
|
48
|
+
"@ai-sdk/gateway": "3.0.219",
|
|
49
49
|
"@ai-sdk/provider": "3.0.19",
|
|
50
|
-
"@ai-sdk/provider-utils": "4.0.
|
|
50
|
+
"@ai-sdk/provider-utils": "4.0.62"
|
|
51
51
|
},
|
|
52
52
|
"devDependencies": {
|
|
53
53
|
"@edge-runtime/vm": "^5.0.0",
|
|
@@ -58,7 +58,7 @@
|
|
|
58
58
|
"tsx": "^4.19.2",
|
|
59
59
|
"typescript": "5.8.3",
|
|
60
60
|
"zod": "3.25.76",
|
|
61
|
-
"@ai-sdk/google": "3.0.
|
|
61
|
+
"@ai-sdk/google": "3.0.137",
|
|
62
62
|
"@ai-sdk/test-server": "1.0.6",
|
|
63
63
|
"@vercel/ai-tsconfig": "0.0.0"
|
|
64
64
|
},
|