ai 7.0.164 → 7.0.166

package/docs/03-ai-sdk-core/16-mcp-tools.mdx

@@ -220,7 +220,11 @@ If they no longer match, leave the newer tokens in storage. The SDK retries
 authorization and reads the stored tokens again.
 
 The SDK also provides this context when invalidating stored tokens that lack an
-authorization server pin. Other invalidations can omit the context.
+authorization server pin. These tokens must be cleared before the SDK saves a new
+client registration or authorization server pin. If the invalidation hook is
+missing or refresh tokens remain in storage, authorization stops with an error;
+clear the stored tokens and start authorization again. Other invalidations can
+omit the context.
 
 If an authorization-code exchange returns `invalid_grant`, the SDK propagates
 the error without invalidating stored credentials or retrying the rejected code.

package/docs/03-ai-sdk-core/32-decisions.mdx

@@ -239,14 +239,16 @@ to retain its experimental `decisionModel` method.
 descriptions can be strings, JSON objects, or JSON arrays. Descriptions can also
 be `null` when the provider supports it.
 
-For Choice, Score, and Boolean, `instructions` may be omitted or `null`. A Boolean
+For every question type, `instructions` may be omitted or `null` when supported
+by the provider. Boolean `criteria` may also be `null`. A Boolean
 question without instructions must describe at least one of its `true` or `false`
-criteria. Box questions always require instructions. Provider APIs can impose
+criteria. Provider APIs can impose
 additional requirements; see the provider's documentation.
 
-Score rubrics require at least one level in Core. Perplexity accepts a single
-level, which returns score `0` with probability `1`; other providers may require
-more levels. See [Perplexity's examples](/providers/ai-sdk-providers/perplexity#single-level-score-rubrics).
+Score rubrics require at least one level in Core. TypeSafe and Perplexity accept
+a single level, which returns score `0` with probability `1`; other providers may
+require more levels. See the [TypeSafe provider documentation](/providers/ai-sdk-providers/typesafe-ai)
+and [Perplexity's examples](/providers/ai-sdk-providers/perplexity#single-level-score-rubrics).
 
 Functions, class instances, cycles, undefined values inside JSON content, and
 nonfinite numbers are not JSON-compatible.
@@ -277,6 +279,9 @@ their API probabilities. Provider-specific confidence statistics belong
 in `providerMetadata`. TypeSafe exposes its separate Choice/Score/Box confidence
 statistic at `result.providerMetadata?.typesafe?.confidence`, keyed by question
 ID. It is not the selected option's probability or a portable confidence measure.
+TypeSafe Score legends are available at
+`result.providerMetadata?.typesafe?.legend`, also keyed by question ID, with
+structured descriptions preserved.
 Perplexity exposes Choice/Score confidence at
 `result.providerMetadata?.perplexity?.confidence` and Score legends at
 `result.providerMetadata?.perplexity?.legend`, also keyed by question ID.

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -32,6 +32,10 @@ When the SDK fetches a URL taken from a provider response, it:
   `.internal` hostnames. Non-`http(s)` schemes are rejected too.
 - **Re-validates every redirect hop** — a URL that passes but then redirects to
   an internal address is blocked; the redirect is never followed blindly.
+- **Rejects HTTPS downgrades on server-side downloads** — a redirect from HTTPS
+  to HTTP is blocked before requesting the insecure target, even when that target
+  matches `trustedOrigin`. Initial HTTP URLs and HTTP-to-HTTPS upgrades remain
+  supported.
 - **Validates DNS at connection time on Node.js** — every resolved address is
   checked, and the socket is pinned to the validated DNS result so DNS
   rebinding cannot introduce a different address between validation and

package/docs/07-reference/01-ai-sdk-core/14-decide.mdx

@@ -43,15 +43,15 @@ described below.
 Instructions and criterion descriptions accept strings, JSON objects, or JSON
 arrays.
 
-| Type      | Instructions            | Criteria                                                                                                            |
-| --------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| `choice`  | Optional; may be `null` | Required nonempty map of option names to descriptions                                                               |
-| `score`   | Optional; may be `null` | Required nonempty array of levels, indexed from zero                                                                |
-| `boolean` | Optional; may be `null` | Optional object with `true` and/or `false` descriptions; at least one must be non-null when instructions are absent |
-| `box`     | Required and non-null   | None                                                                                                                |
+| Type      | Instructions            | Criteria                                                                                                                       |
+| --------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `choice`  | Optional; may be `null` | Required nonempty map of option names to descriptions                                                                          |
+| `score`   | Optional; may be `null` | Required nonempty array of levels, indexed from zero                                                                           |
+| `boolean` | Optional; may be `null` | Optional object or `null`, with `true` and/or `false` descriptions; at least one must be non-null when instructions are absent |
+| `box`     | Optional; may be `null` | None                                                                                                                           |
 
 Criterion descriptions may be `null` in the shared type, but providers can impose
-stricter limits. Perplexity requires non-null Score levels and accepts 1–10 levels;
+stricter limits. TypeSafe and Perplexity require non-null Score levels and accept 1–10 levels;
 a single level yields score `0` and probability `1`. Other providers may require
 at least two levels. Optional instructions also remain subject to the provider's
 API contract.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.164",
+  "version": "7.0.166",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.137",
-    "@ai-sdk/provider": "4.0.36",
-    "@ai-sdk/provider-utils": "5.0.75"
+    "@ai-sdk/gateway": "4.0.139",
+    "@ai-sdk/provider": "4.0.37",
+    "@ai-sdk/provider-utils": "5.0.76"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.134",
-    "@ai-sdk/deepseek": "3.0.80",
-    "@ai-sdk/google": "4.0.113",
-    "@ai-sdk/groq": "4.0.77",
-    "@ai-sdk/huggingface": "2.0.86",
-    "@ai-sdk/moonshotai": "3.0.86",
-    "@ai-sdk/openai": "4.0.110",
+    "@ai-sdk/amazon-bedrock": "5.0.135",
+    "@ai-sdk/deepseek": "3.0.81",
+    "@ai-sdk/google": "4.0.114",
+    "@ai-sdk/groq": "4.0.78",
+    "@ai-sdk/huggingface": "2.0.87",
+    "@ai-sdk/moonshotai": "3.0.87",
+    "@ai-sdk/openai": "4.0.111",
     "@ai-sdk/test-server": "2.0.4",
-    "@ai-sdk/xai": "5.0.39",
+    "@ai-sdk/xai": "5.0.40",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",

package/src/generate-text/generate-text.ts

@@ -1213,8 +1213,8 @@ async function generateTextInternal<
                 const result = await executeLanguageModelCallInTelemetryContext(
                   {
                     ...languageModelCallStartEvent,
-                    execute: async () =>
-                      await stepModel.doGenerate({
+                    execute: async () => {
+                      const result = await stepModel.doGenerate({
                         ...stepCallSettings,
                         tools: stepTools,
                         toolChoice: stepToolChoice,
@@ -1223,24 +1223,26 @@ async function generateTextInternal<
                         providerOptions: stepProviderOptions,
                         abortSignal: mergedAbortSignal,
                         headers: headersWithUserAgent,
-                      }),
+                      });
+                      return {
+                        ...result,
+                        ...(result.request && {
+                          request: sanitizeRequestMetadata(result.request),
+                        }),
+                      };
+                    },
                   },
                 );
 
-                const responseData = {
-                  id: result.response?.id ?? generateId(),
-                  timestamp: result.response?.timestamp ?? new Date(),
-                  modelId: result.response?.modelId ?? stepModel.modelId,
-                  headers: result.response?.headers,
-                  body: result.response?.body,
-                };
-
                 return {
                   ...result,
-                  ...(result.request != null
-                    ? { request: sanitizeRequestMetadata(result.request) }
-                    : {}),
-                  response: responseData,
+                  response: {
+                    id: result.response?.id ?? generateId(),
+                    timestamp: result.response?.timestamp ?? new Date(),
+                    modelId: result.response?.modelId ?? stepModel.modelId,
+                    headers: result.response?.headers,
+                    body: result.response?.body,
+                  },
                 };
               });
               const responseTimeMs = now() - stepStartTimestampMs;

package/src/generate-text/stream-language-model-call.ts

@@ -360,11 +360,11 @@ export async function streamLanguageModelCall<
   const {
     stream: languageModelStream,
     response,
-    request: rawRequest,
+    request,
   } = await executeLanguageModelCallInTelemetryContext({
     ...languageModelCallStartEvent,
-    execute: async () =>
-      await resolvedModel.doStream({
+    execute: async () => {
+      const result = await resolvedModel.doStream({
         ...callSettings,
         tools: stepTools,
         toolChoice: stepToolChoice,
@@ -374,11 +374,16 @@ export async function streamLanguageModelCall<
         abortSignal,
         headers,
         includeRawChunks,
-      }),
+      });
+      return {
+        ...result,
+        ...(result.request && {
+          request: sanitizeRequestMetadata(result.request),
+        }),
+      };
+    },
   });
 
-  const request = sanitizeRequestMetadata(rawRequest);
-
   const standardizedStream = languageModelStream.pipeThrough(
     createLanguageModelV4StreamPartToLanguageModelStreamPartTransform({
       tools,

package/src/telemetry/filter-telemetry-event.ts

@@ -95,6 +95,7 @@ export function filterTelemetryEvent<EVENT>(
       ranking: [],
       answers: {},
       segments: [],
+      words: [],
     });
     if (filtered.toolOutput != null) {
       filtered.toolOutput = {