ai 7.0.114 → 7.0.117

package/docs/03-ai-sdk-harnesses/05-harness-adapters.mdx

@@ -38,10 +38,10 @@ The AI SDK includes the following harness adapters:
 | [Claude Code](/providers/ai-sdk-harnesses/claude-code)       | Sandbox bridge   | <Check />    | <Check />     | <Check />         | <Check />              | <Check />                    |
 | [Cline](/providers/ai-sdk-harnesses/cline)                   | Host process     | <Check />    | <Check />     | <Check />         | <Check />              | <Check />                    |
 | [Codex](/providers/ai-sdk-harnesses/codex)                   | Sandbox bridge   | <Check />    | <Check />     | <Check />         | <Cross />              | <Cross />                    |
-| [Cursor](/providers/ai-sdk-harnesses/cursor)                 | Sandbox via ACP  | <Check />    | <Check />     | <Cross />         | <Check />              | <Cross />                    |
+| [Cursor](/providers/ai-sdk-harnesses/cursor)                 | Sandbox via ACP  | <Check />    | <Check />     | <Cross />         | <Cross />              | <Cross />                    |
 | [Deep Agents](/providers/ai-sdk-harnesses/deepagents)        | Sandbox bridge   | <Check />    | <Check />     | <Check />         | <Check />              | <Check /> via auto-rejection |
 | [fx](/providers/ai-sdk-harnesses/fx)                         | Sandbox via ACP  | <Check />    | <Check />     | <Cross />         | <Check />              | <Cross />                    |
-| [GitHub Copilot](/providers/ai-sdk-harnesses/github-copilot) | Sandbox via ACP  | <Check />    | <Check />     | <Cross />         | <Check />              | <Cross />                    |
-| [Grok Build](/providers/ai-sdk-harnesses/grok-build)         | Sandbox via ACP  | <Check />    | <Check />     | <Check />         | <Check />              | <Cross />                    |
+| [GitHub Copilot](/providers/ai-sdk-harnesses/github-copilot) | Sandbox via ACP  | <Check />    | <Check />     | <Cross />         | <Cross />              | <Cross />                    |
+| [Grok Build](/providers/ai-sdk-harnesses/grok-build)         | Sandbox via ACP  | <Check />    | <Check />     | <Check />         | <Cross />              | <Cross />                    |
 | [OpenCode](/providers/ai-sdk-harnesses/opencode)             | Sandbox bridge   | <Check />    | <Check />     | <Check />         | <Check />              | <Check /> via auto-rejection |
 | [Pi](/providers/ai-sdk-harnesses/pi)                         | Host process     | <Check />    | <Check />     | <Cross />         | <Check />              | <Check />                    |

package/docs/03-ai-sdk-harnesses/06-workflow-utilities.mdx

@@ -23,7 +23,7 @@ before following the examples.
 <InstallPackages packages="@ai-sdk/workflow-harness workflow" />
 
 In addition to the workflow specific packages, install the core harness package,
-a harness adapter, and a sandbox provider as shown in
+a harness adapter, and a sandbox adapter as shown in
 [HarnessAgent](/docs/ai-sdk-harnesses/harness-agent).
 
 ## Configuring the Harness Agent
@@ -35,15 +35,10 @@ semantic agent steps, set `stopWhen` to `isStepCount(1)` so one call to
 ```ts filename='harness-workflow/agent.ts' highlight="13-17"
 import { HarnessAgent } from '@ai-sdk/harness/agent';
 import { claudeCode } from '@ai-sdk/harness-claude-code';
-import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
 import { isStepCount } from 'ai';
 
 export const agent = new HarnessAgent({
   harness: claudeCode,
-  sandbox: createVercelSandbox({
-    runtime: 'node24',
-    ports: [4000],
-  }),
   instructions: 'You are a helpful coding assistant.',
   /*
    * Only needed for semantic agent-step workflows.
@@ -62,7 +57,7 @@ the shared agent with the highlighted `stopWhen` option shown above, then call
 ### Defining the Agent Step
 
 Keep the Workflow step in its own module and import the agent dynamically inside
-the step body. This keeps the agent, sandbox provider, and other Node.js
+the step body. This keeps the agent, sandbox adapter, and other Node.js
 dependencies out of the workflow bundle.
 
 ```ts filename='harness-workflow/agent-step.ts'
@@ -77,10 +72,25 @@ export async function agentStep(
   'use step';
 
   const { agent } = await import('./agent');
+  const {
+    createVercelNetworkSandboxSession,
+    resumeVercelNetworkSandboxSession,
+  } = await import('@ai-sdk/sandbox-vercel');
+  const sandboxId = `harness-${state.sessionId}`;
+  const isFirstStep = state.resumeFrom == null && state.continueFrom == null;
+  const sandboxSession = isFirstStep
+    ? await createVercelNetworkSandboxSession({
+        sandboxId,
+        runtime: 'node24',
+        ports: [4000],
+        template: await agent.getSandboxTemplate(),
+      })
+    : await resumeVercelNetworkSandboxSession({ sandboxId });
 
   return runHarnessAgentStep({
     agent,
     state,
+    sandboxSession,
   });
 }
 ```
@@ -165,7 +175,9 @@ export async function POST(request: Request) {
 }
 ```
 
-The `sessionId` gives the sandbox a stable identity across workflow runs. Keep
+The workflow state `sessionId` identifies the harness session. The step derives
+`sandboxId` from it before first creating the sandbox and uses that same ID to
+reattach on later steps. The state does not serialize a live sandbox. Keep
 `agent.ts`, `agent-step.ts`, `workflow.ts`, and the route in separate modules so
 the workflow bundle does not include Node-heavy agent, sandbox, or framework
 dependencies.
@@ -194,10 +206,25 @@ export async function timeSliceStep(
   'use step';
 
   const { agent } = await import('./agent');
+  const {
+    createVercelNetworkSandboxSession,
+    resumeVercelNetworkSandboxSession,
+  } = await import('@ai-sdk/sandbox-vercel');
+  const sandboxId = `harness-${state.sessionId}`;
+  const isFirstStep = state.resumeFrom == null && state.continueFrom == null;
+  const sandboxSession = isFirstStep
+    ? await createVercelNetworkSandboxSession({
+        sandboxId,
+        runtime: 'node24',
+        ports: [4000],
+        template: await agent.getSandboxTemplate(),
+      })
+    : await resumeVercelNetworkSandboxSession({ sandboxId });
 
   return runHarnessAgentTimeSlice({
     agent,
     state,
+    sandboxSession,
   });
 }
 ```
@@ -281,11 +308,18 @@ export async function POST(request: Request) {
 }
 ```
 
-The `sessionId` gives the sandbox a stable identity across workflow runs. Keep
+The workflow state `sessionId` identifies the harness session. The step derives
+`sandboxId` from it; otherwise, you must persist `sandboxSession.id` separately
+to reattach across steps. Keep
 `agent.ts`, `time-slice-step.ts`, `workflow.ts`, and the route in separate
 modules so the workflow bundle does not include Node-heavy agent, sandbox, or
 framework dependencies.
 
+`destroyOnFinish` destroys the harness session, but never the supplied sandbox.
+The caller can explicitly call `sandboxSession.destroy()` on the network
+session when no later step needs to reattach. Never destroy it at a
+time-slice boundary where a subsequent step must resume it.
+
 ## Resume Persistence
 
 Workflow automatically persists the `HarnessWorkflowState` returned by each

package/docs/03-ai-sdk-harnesses/07-ui.mdx

@@ -82,53 +82,53 @@ Define the `HarnessAgent` on the server:
 ```ts filename='app/api/chat/agent.ts'
 import { HarnessAgent } from '@ai-sdk/harness/agent';
 import { claudeCode } from '@ai-sdk/harness-claude-code';
-import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
 
 export const agent = new HarnessAgent({
   harness: claudeCode,
-  sandbox: createVercelSandbox({
-    runtime: 'node24',
-    ports: [4000],
-  }),
   instructions: 'You are a helpful coding assistant.',
 });
 ```
 
 ## Session Store
 
-Persist only the opaque resume state returned by `session.detach()`. If the
+Persist the opaque resume state returned by `session.detach()`. If the
 turn paused for approval or was otherwise interrupted, that resume state carries
 the continuation state internally. The chat id can also be the harness
-`sessionId`, which gives the sandbox a stable identity across requests and
-processes.
+`sessionId`. Here we derive a stable `sandboxId` from that known chat id. If
+you do not derive one, persist the returned `sandboxSession.id` separately.
 
 ```ts filename='app/api/chat/session-store.ts'
-import type {
-  HarnessAgentResumeSessionState,
-  HarnessAgentSession,
-} from '@ai-sdk/harness/agent';
+import type { HarnessAgentResumeSessionState } from '@ai-sdk/harness/agent';
+import {
+  createVercelNetworkSandboxSession,
+  resumeVercelNetworkSandboxSession,
+} from '@ai-sdk/sandbox-vercel';
 
 const states: Record<string, HarnessAgentResumeSessionState | undefined> = {};
 
-type SessionFactory = {
-  createSession(options?: {
-    sessionId?: string;
-    resumeFrom?: HarnessAgentResumeSessionState;
-  }): Promise<HarnessAgentSession>;
-};
-
 export async function resumeOrCreateSession({
   agent,
   chatId,
 }: {
-  agent: SessionFactory;
+  agent: typeof import('./agent').agent;
   chatId: string;
 }) {
   const resumeFrom = states[chatId];
-
-  return agent.createSession(
-    resumeFrom ? { sessionId: chatId, resumeFrom } : { sessionId: chatId },
-  );
+  const sandboxId = `harness-${chatId}`;
+  const sandboxSession = resumeFrom
+    ? await resumeVercelNetworkSandboxSession({ sandboxId })
+    : await createVercelNetworkSandboxSession({
+        sandboxId,
+        runtime: 'node24',
+        ports: [4000],
+        template: await agent.getSandboxTemplate(),
+      });
+  const session = await agent.createSession({
+    sessionId: chatId,
+    resumeFrom,
+    sandboxSession,
+  });
+  return { session, sandboxSession };
 }
 
 export async function detachAndPersist({
@@ -136,13 +136,15 @@ export async function detachAndPersist({
   session,
 }: {
   chatId: string;
-  session: HarnessAgentSession;
+  session: Awaited<ReturnType<typeof resumeOrCreateSession>>['session'];
 }) {
   states[chatId] = await session.detach();
 }
 ```
 
-Use durable storage instead of an in-memory map in production.
+Use durable storage instead of an in-memory map in production. The creator
+always creates a new sandbox and fails on a conflicting `sandboxId`; only the
+resume function reattaches an existing one.
 
 ## Route
 
@@ -177,7 +179,7 @@ export async function POST(request: Request) {
   return createUIMessageStreamResponse({
     stream: createUIMessageStream({
       execute: async ({ writer }) => {
-        const session = await resumeOrCreateSession({ agent, chatId });
+        const { session } = await resumeOrCreateSession({ agent, chatId });
         const result = await agent.stream({ session, messages });
 
         writer.merge(
@@ -212,9 +214,10 @@ sandbox warm for the next request. Bridge-backed adapters can usually reattach
 or replay efficiently. If the turn is unfinished, `detach()` includes the turn
 continuation state in the returned resume state.
 
-Use `session.stop()` when you want to save resume state and stop the runtime and
-sandbox after each turn. The next request resumes from persisted state and
-continues any unfinished turn before accepting a new prompt.
+`session.stop()` saves resume state and stops the harness runtime, but does not
+stop a supplied sandbox. The caller owns that network session and should call
+its `destroy()` method when the chat ends, not while a later request needs to
+reattach. Preserve the chosen `sandboxId` across processes.
 
 ## Rendering Harness Parts
 

package/docs/03-ai-sdk-harnesses/08-terminal-ui.mdx

@@ -19,15 +19,11 @@ session for the lifetime of the terminal UI.
 ```ts filename='tui.ts'
 import { HarnessAgent, type HarnessAgentSession } from '@ai-sdk/harness/agent';
 import { codex } from '@ai-sdk/harness-codex';
-import { createVercelSandbox } from '@ai-sdk/sandbox-vercel';
+import { createVercelNetworkSandboxSession } from '@ai-sdk/sandbox-vercel';
 import { runAgentTUI, type AgentTUIAgent } from '@ai-sdk/tui';
 
 const agent = new HarnessAgent({
   harness: codex,
-  sandbox: createVercelSandbox({
-    runtime: 'node24',
-    ports: [4000],
-  }),
 });
 
 function createTUIAgent({
@@ -56,7 +52,12 @@ function createTUIAgent({
   } as AgentTUIAgent;
 }
 
-const session = await agent.createSession();
+const sandboxSession = await createVercelNetworkSandboxSession({
+  runtime: 'node24',
+  ports: [4000],
+  template: await agent.getSandboxTemplate(),
+});
+const session = await agent.createSession({ sandboxSession });
 
 try {
   await runAgentTUI({
@@ -67,6 +68,7 @@ try {
   });
 } finally {
   await session.destroy();
+  await sandboxSession.destroy();
 }
 ```
 

package/docs/04-ai-sdk-ui/01-overview.mdx

@@ -9,7 +9,7 @@ AI SDK UI is designed to help you build interactive chat, completion, and assist
 
 AI SDK UI provides robust abstractions that simplify the complex tasks of managing chat streams and UI updates on the frontend, enabling you to develop dynamic AI-driven interfaces more efficiently. With three main hooks — **`useChat`**, **`useCompletion`**, and **`useObject`** — you can incorporate real-time chat capabilities, text completions, streamed JSON, and interactive assistant features into your app.
 
-- **[`useChat`](/docs/ai-sdk-ui/chatbot)** offers real-time streaming of chat messages, abstracting state management for inputs, messages, loading, and errors, allowing for seamless integration into any UI design.
+- **[`useChat`](/docs/ai-sdk-ui/chatbot)** offers real-time streaming of chat messages and manages message, loading, and error state. Manage input state in your component for seamless integration into any UI design.
 - **[`useCompletion`](/docs/ai-sdk-ui/completion)** enables you to handle text completions in your applications, managing the prompt input and automatically updating the UI as new completions are streamed.
 - **[`useObject`](/docs/ai-sdk-ui/object-generation)** is a hook that allows you to consume streamed JSON objects, providing a simple way to handle and display structured data in your application.
 

package/docs/04-ai-sdk-ui/02-chatbot.mdx

@@ -1009,10 +1009,12 @@ These are available as `reasoning-file` parts (`ReasoningFileUIPart`) with
 Some providers such as [Perplexity](/providers/ai-sdk-providers/perplexity#sources) and
 [Google](/providers/ai-sdk-providers/google#sources) include sources in the response.
 
-Currently sources are limited to web pages that ground the response.
-You can forward them to the client with the `sendSources` option:
+You can forward sources to the client with the `sendSources` option. This example uses the Perplexity Agent API's `fast` preset to search the web. Install `@ai-sdk/perplexity` and set `PERPLEXITY_API_KEY` in your environment:
 
-```ts filename="app/api/chat/route.ts" highlight="20"
+<InstallPackages packages="@ai-sdk/perplexity" />
+
+```ts filename="app/api/chat/route.ts" highlight="21"
+import { perplexity } from '@ai-sdk/perplexity';
 import {
   convertToModelMessages,
   createUIMessageStreamResponse,
@@ -1025,7 +1027,7 @@ export async function POST(req: Request) {
   const { messages }: { messages: UIMessage[] } = await req.json();
 
   const result = streamText({
-    model: 'perplexity/sonar-pro',
+    model: perplexity('fast'),
     messages: await convertToModelMessages(messages),
   });
 
@@ -1051,7 +1053,7 @@ messages.map(message => (
     {message.parts
       .filter(part => part.type === 'source-url')
       .map(part => (
-        <span key={`source-${part.id}`}>
+        <span key={`source-${part.sourceId}`}>
           [
           <a href={part.url} target="_blank">
             {part.title ?? new URL(part.url).hostname}
@@ -1064,8 +1066,8 @@ messages.map(message => (
     {message.parts
       .filter(part => part.type === 'source-document')
       .map(part => (
-        <span key={`source-${part.id}`}>
-          [<span>{part.title ?? `Document ${part.id}`}</span>]
+        <span key={`source-${part.sourceId}`}>
+          [<span>{part.title ?? `Document ${part.sourceId}`}</span>]
         </span>
       ))}
   </div>

package/docs/04-ai-sdk-ui/08-object-generation.mdx

@@ -5,7 +5,10 @@ description: Learn how to use the useObject hook.
 
 # Object Generation
 
-<Note>`useObject` is only available in React, Svelte, and Vue.</Note>
+<Note>
+  `useObject` is available in React, Svelte, Vue, and the SolidJS community
+  integration. Angular provides the equivalent `StructuredObject` service.
+</Note>
 
 The [`useObject`](/docs/reference/ai-sdk-ui/use-object) hook allows you to create interfaces that represent a structured JSON object that is being streamed.
 

package/docs/06-advanced/04-caching.mdx

@@ -30,6 +30,7 @@ const redis = new Redis({
 });
 
 export const cacheMiddleware: LanguageModelV4Middleware = {
+  specificationVersion: 'v4',
   wrapGenerate: async ({ doGenerate, params }) => {
     const cacheKey = JSON.stringify(params);
 
@@ -117,7 +118,7 @@ export const cacheMiddleware: LanguageModelV4Middleware = {
   replayed from the cache on later requests.
 </Note>
 
-`LanguageModelV4Middleware` has two methods: `wrapGenerate` and `wrapStream`. `wrapGenerate` is called when using [`generateText`](/docs/reference/ai-sdk-core/generate-text), while `wrapStream` is called when using [`streamText`](/docs/reference/ai-sdk-core/stream-text).
+`LanguageModelV4Middleware` has the `wrapGenerate` and `wrapStream` wrapping methods, plus the optional `transformParams` method. `wrapGenerate` is called when using [`generateText`](/docs/reference/ai-sdk-core/generate-text), while `wrapStream` is called when using [`streamText`](/docs/reference/ai-sdk-core/stream-text).
 
 For `wrapGenerate`, you can cache the response directly. Instead, for `wrapStream`, you cache an array of the stream parts, which can then be used with [`simulateReadableStream`](/docs/ai-sdk-core/testing#simulate-ui-message-stream-responses) function to create a simulated `ReadableStream` that returns the cached response. In this way, the cached response is returned chunk-by-chunk as if it were being generated by the model. You can control the initial delay and delay between chunks by adjusting the `initialDelayInMs` and `chunkDelayInMs` parameters of `simulateReadableStream`.
 

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -45,6 +45,45 @@ When the SDK fetches a URL taken from a provider response, it:
 
 A blocked URL surfaces as a `DownloadError`.
 
+## Fetching untrusted URLs directly
+
+For custom integrations using `@ai-sdk/provider-utils`, use `fetchUntrustedUrl`
+when the URL comes from a response or other untrusted input. It validates URLs
+and redirects and withholds credentials and unknown custom headers on the first
+request unless the URL matches a configured origin:
+
+```ts
+import { fetchUntrustedUrl } from '@ai-sdk/provider-utils';
+
+const response = await fetchUntrustedUrl({
+  url: result.downloadUrl,
+  headers: {
+    authorization: `Bearer ${apiKey}`,
+    accept: 'image/*',
+  },
+  credentialedOrigin: providerBaseURL,
+});
+```
+
+Here, `Authorization` is sent only when the initial URL has the same origin as
+`providerBaseURL`. Otherwise, only allowlisted metadata such as `Accept`,
+`Range`, and `User-Agent` is sent. A cross-origin redirect drops all caller
+headers except `User-Agent`, and credentials are never reattached on later hops.
+
+`credentialedOrigin` must come from your configuration, never from the response
+URL. It does not disable URL validation. For a configured private endpoint, pass
+`trustedOrigin` as well; if `credentialedOrigin` is omitted, `fetchUntrustedUrl`
+uses `trustedOrigin` as the origin allowed to receive credentials. Extra protocol
+metadata can be allowed with `untrustedFirstHopHeaders: ['x-protocol-version']`.
+Only list headers that are safe to disclose to any destination; use a configured
+origin for credentials.
+
+The existing `fetchWithValidatedRedirects` helper preserves its first-request
+behavior: it sanitizes risky headers but still forwards authentication and
+custom headers. Switch to `fetchUntrustedUrl` to opt into first-request
+credential isolation. Existing calls to `getFromApi` also retain their behavior;
+pass `credentialedOrigin` when fetching response-supplied URLs with credentials.
+
 ## Self-hosted and local endpoints
 
 URLs that are same-origin with the provider endpoint **you configured** (e.g. a

package/docs/07-reference/01-ai-sdk-core/01-generate-text.mdx

@@ -1071,7 +1071,7 @@ To see `generateText` in action, check out [these examples](#examples).
               name: 'Output.json()',
               type: 'Output',
               description:
-                'Output specification for unstructured JSON generation. When the model generates a text response, it will return a JSON object.',
+                'Output specification for unstructured JSON generation. When the model generates a text response, it will return any valid JSON value.',
               properties: [
                 {
                   type: 'Options',

package/docs/07-reference/02-ai-sdk-ui/03-use-object.mdx

@@ -5,7 +5,10 @@ description: API reference for the useObject hook.
 
 # `useObject()`
 
-<Note>`useObject` is only available in React, Svelte, and Vue.</Note>
+<Note>
+  `useObject` is available in React, Svelte, Vue, and the SolidJS community
+  integration. Angular provides the equivalent `StructuredObject` service.
+</Note>
 
 Allows you to consume text streams that represent a JSON object and parse them into a complete object based on a schema.
 You can use it together with [`streamText`](/docs/reference/ai-sdk-core/stream-text) and [`Output.object()`](/docs/reference/ai-sdk-core/output#output-object) in the backend.

package/docs/07-reference/03-ai-sdk-rsc/01-stream-ui.mdx

@@ -36,6 +36,7 @@ To see `streamUI` in action, check out [these examples](#examples).
     },
     {
       name: 'instructions',
+      isOptional: true,
       type: 'Instructions',
       description:
         'Instructions to use that specify the behavior of the model.'

package/docs/07-reference/03-ai-sdk-rsc/02-create-ai.mdx

@@ -40,7 +40,7 @@ Creates a client-server context provider that can be used to wrap parts of your
     },
     {
       name: 'onGetUIState',
-      type: '() => UIState',
+      type: '() => Promise<UIState | undefined>',
       description: 'is called during SSR to compare and update UI state.',
     },
     {

package/docs/07-reference/03-ai-sdk-rsc/03-create-streamable-ui.mdx

@@ -72,7 +72,7 @@ Create a stream that sends UI from the server to the client. On the client side,
     },
     {
       name: 'error',
-      type: '(Error) => void',
+      type: '(any) => StreamableUIWrapper',
       description:
         'Signals that there is an error in the UI stream. It will be thrown on the client side and caught by the nearest error boundary component.',
     },

package/docs/07-reference/06-ai-sdk-tui/01-run-agent-tui.mdx

@@ -191,17 +191,21 @@ await runAgentTUI({
 ## Example with Sandbox
 
 ```ts
-import { createJustBashSandbox } from '@ai-sdk/sandbox-just-bash';
+import { createJustBashNetworkSandboxSession } from '@ai-sdk/sandbox-just-bash';
 
-const sandboxSession = await createJustBashSandbox({
+const sandboxSession = await createJustBashNetworkSandboxSession({
   cwd: '/home/user',
-}).createSession();
-
-await runAgentTUI({
-  title: 'Sandbox Assistant',
-  agent,
-  sandbox: sandboxSession.restricted(),
 });
+
+try {
+  await runAgentTUI({
+    title: 'Sandbox Assistant',
+    agent,
+    sandbox: sandboxSession.restricted(),
+  });
+} finally {
+  await sandboxSession.destroy();
+}
 ```
 
 The sandbox is forwarded to every `agent.stream()` call as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.114",
+  "version": "7.0.117",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.92",
+    "@ai-sdk/gateway": "4.0.95",
     "@ai-sdk/provider": "4.0.18",
-    "@ai-sdk/provider-utils": "5.0.47"
+    "@ai-sdk/provider-utils": "5.0.49"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.94",
-    "@ai-sdk/deepseek": "3.0.52",
-    "@ai-sdk/google": "4.0.80",
-    "@ai-sdk/groq": "4.0.48",
-    "@ai-sdk/huggingface": "2.0.55",
-    "@ai-sdk/moonshotai": "3.0.56",
-    "@ai-sdk/openai": "4.0.75",
-    "@ai-sdk/test-server": "2.0.1",
-    "@ai-sdk/xai": "5.0.8",
+    "@ai-sdk/amazon-bedrock": "5.0.97",
+    "@ai-sdk/deepseek": "3.0.54",
+    "@ai-sdk/google": "4.0.82",
+    "@ai-sdk/groq": "4.0.50",
+    "@ai-sdk/huggingface": "2.0.57",
+    "@ai-sdk/moonshotai": "3.0.58",
+    "@ai-sdk/openai": "4.0.78",
+    "@ai-sdk/test-server": "2.0.2",
+    "@ai-sdk/xai": "5.0.10",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",

package/src/prompt/file-part-data.ts

@@ -24,7 +24,10 @@ type ConvertResult = {
   mediaType: string | undefined;
 };
 
-function convertUrlToFilePartData(url: URL): ConvertResult {
+function convertUrlToFilePartData(
+  url: URL,
+  originalUrl?: string,
+): ConvertResult {
   if (url.protocol === 'data:') {
     const { mediaType, base64Content } = splitDataUrl(url.toString());
 
@@ -38,7 +41,10 @@ function convertUrlToFilePartData(url: URL): ConvertResult {
     return { data: { type: 'data', data: base64Content }, mediaType };
   }
 
-  return { data: { type: 'url', url }, mediaType: undefined };
+  return {
+    data: { type: 'url', url, ...(originalUrl != null ? { originalUrl } : {}) },
+    mediaType: undefined,
+  };
 }
 
 function convertUrlStringToFilePartData(content: string): ConvertResult {
@@ -98,7 +104,7 @@ export function convertToLanguageModelV4FilePart(
         }
         return convertInlineDataToFilePartData(content.data);
       case 'url':
-        return convertUrlToFilePartData(content.url);
+        return convertUrlToFilePartData(content.url, content.originalUrl);
       case 'reference':
         return {
           data: { type: 'reference', reference: content.reference },

package/src/util/download/download.ts

@@ -3,7 +3,7 @@ import {
   DownloadError,
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
-  fetchWithValidatedRedirects,
+  fetchUntrustedUrl,
   withUserAgentSuffix,
   getRuntimeEnvironmentUserAgent,
 } from '@ai-sdk/provider-utils';
@@ -36,7 +36,7 @@ export const download = async ({
       getRuntimeEnvironmentUserAgent(),
     );
 
-    const response = await fetchWithValidatedRedirects({
+    const response = await fetchUntrustedUrl({
       url: urlText,
       headers,
       abortSignal,