ai 7.0.18 → 7.0.19

package/docs/02-getting-started/09-coding-agents.mdx

@@ -33,22 +33,7 @@ Once you've installed the `ai` package, you already have the full AI SDK documen
 
 Install the `ai` package if you haven't already:
 
-<div className="my-4">
-  <Tabs items={['pnpm', 'npm', 'yarn', 'bun']}>
-    <Tab>
-      <Snippet text="pnpm add ai" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="npm install ai" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="yarn add ai" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="bun add ai" dark />
-    </Tab>
-  </Tabs>
-</div>
+<InstallPackages packages="ai" />
 
 After installation, your agent can reference the bundled source code and documentation at paths like:
 
@@ -70,22 +55,7 @@ AI SDK DevTools gives you full visibility into your AI SDK calls during developm
 
 Install the DevTools package:
 
-<div className="my-4">
-  <Tabs items={['pnpm', 'npm', 'yarn', 'bun']}>
-    <Tab>
-      <Snippet text="pnpm add @ai-sdk/devtools" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="npm install @ai-sdk/devtools" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="yarn add @ai-sdk/devtools" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="bun add @ai-sdk/devtools" dark />
-    </Tab>
-  </Tabs>
-</div>
+<InstallPackages packages="@ai-sdk/devtools" />
 
 ### Register the integration
 

package/docs/03-ai-sdk-core/16-mcp-tools.mdx

@@ -518,6 +518,50 @@ Your handler must return an object with an `action` field that can be one of:
 - `'decline'`: User chose not to provide the information.
 - `'cancel'`: User cancelled the operation entirely.
 
+## Detecting tool-definition drift ("rug pull")
+
+An MCP server sends tool definitions (name, description, input schema) when your
+app first connects, and you typically review and approve them at that point.
+Nothing in the protocol prevents the server from later serving a _different_
+definition for the same tool name — for example a description carrying injected
+instructions, or an input schema widened with an extra field. Because the SDK
+uses whatever tools you pass on each call, a mutated definition returned by a
+later `mcpClient.tools()` fetch would be used without any comparison to what was
+approved. This is the MCP ["rug pull"](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)
+class of attack.
+
+The AI SDK provides two functions to pin the approved definitions and detect
+changes. `fingerprintTools` digests the server-controlled, security-relevant
+fields of each tool (string `description`, resolved input schema, and `title`)
+into a stable map of tool name to digest. `detectToolDrift` diffs two such maps.
+Your app owns baseline storage and the response to drift (block, force
+re-approval, or alert):
+
+```typescript
+import { fingerprintTools, detectToolDrift } from 'ai';
+
+// Trust time (first connect, human-reviewed): capture and persist the baseline.
+const baseline = await fingerprintTools(await mcpClient.tools());
+
+// Every later fetch, before handing tools to generateText:
+const tools = await mcpClient.tools();
+const drift = detectToolDrift(await fingerprintTools(tools), baseline);
+
+if (drift.changed.length || drift.added.length) {
+  // A pinned definition changed, or a new tool appeared. Block, re-approve,
+  // or alert per your policy — do not silently pass `tools` to the model.
+}
+```
+
+<Note>
+  This detects mutation of a tool's description, input schema, or title — the
+  prompt-injection and schema-widening vectors. It cannot detect a
+  behavior/endpoint swap where the name, description, and schema are all
+  unchanged, because the tool runs remotely on the MCP server and that change is
+  invisible to the client. Core stays unopinionated: it does not persist
+  baselines or block calls — those are your app's responsibility.
+</Note>
+
 ## Examples
 
 You can see MCP in action in the following examples:

package/docs/03-ai-sdk-core/30-embeddings.mdx

@@ -219,21 +219,21 @@ const embeddingModelWithDefaults = wrapEmbeddingModel({
 
 Several providers offer embedding models:
 
-| Provider                                                                      | Model                           | Embedding Dimensions | Multimodal          |
-| ----------------------------------------------------------------------------- | ------------------------------- | -------------------- | ------------------- |
-| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-3-large`        | 3072                 | <Cross size={18} /> |
-| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-3-small`        | 1536                 | <Cross size={18} /> |
-| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-ada-002`        | 1536                 | <Cross size={18} /> |
-| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-001`          | 3072                 | <Cross size={18} /> |
-| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-2`            | 3072                 | <Check size={18} /> |
-| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-2-preview`    | 3072                 | <Check size={18} /> |
-| [Mistral](/providers/ai-sdk-providers/mistral#embedding-models)               | `mistral-embed`                 | 1024                 | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-v3.0`            | 1024                 | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-v3.0`       | 1024                 | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-light-v3.0`      | 384                  | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-light-v3.0` | 384                  | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-v2.0`            | 4096                 | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-light-v2.0`      | 1024                 | <Cross size={18} /> |
-| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-v2.0`       | 768                  | <Cross size={18} /> |
-| [Amazon Bedrock](/providers/ai-sdk-providers/amazon-bedrock#embedding-models) | `amazon.titan-embed-text-v1`    | 1536                 | <Cross size={18} /> |
-| [Amazon Bedrock](/providers/ai-sdk-providers/amazon-bedrock#embedding-models) | `amazon.titan-embed-text-v2:0`  | 1024                 | <Cross size={18} /> |
+| Provider                                                                      | Model                           | Embedding Dimensions | Multimodal |
+| ----------------------------------------------------------------------------- | ------------------------------- | -------------------- | ---------- |
+| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-3-large`        | 3072                 | <Cross />  |
+| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-3-small`        | 1536                 | <Cross />  |
+| [OpenAI](/providers/ai-sdk-providers/openai#embedding-models)                 | `text-embedding-ada-002`        | 1536                 | <Cross />  |
+| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-001`          | 3072                 | <Cross />  |
+| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-2`            | 3072                 | <Check />  |
+| [Google](/providers/ai-sdk-providers/google#embedding-models)                 | `gemini-embedding-2-preview`    | 3072                 | <Check />  |
+| [Mistral](/providers/ai-sdk-providers/mistral#embedding-models)               | `mistral-embed`                 | 1024                 | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-v3.0`            | 1024                 | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-v3.0`       | 1024                 | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-light-v3.0`      | 384                  | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-light-v3.0` | 384                  | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-v2.0`            | 4096                 | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-english-light-v2.0`      | 1024                 | <Cross />  |
+| [Cohere](/providers/ai-sdk-providers/cohere#embedding-models)                 | `embed-multilingual-v2.0`       | 768                  | <Cross />  |
+| [Amazon Bedrock](/providers/ai-sdk-providers/amazon-bedrock#embedding-models) | `amazon.titan-embed-text-v1`    | 1536                 | <Cross />  |
+| [Amazon Bedrock](/providers/ai-sdk-providers/amazon-bedrock#embedding-models) | `amazon.titan-embed-text-v2:0`  | 1024                 | <Cross />  |

package/docs/03-ai-sdk-core/38-video-generation.mdx

@@ -194,11 +194,11 @@ const { video } = await generateVideo({
 });
 ```
 
-### Reference Images
+### Reference Inputs
 
 Some video models support reference-to-video generation, where you provide one or
-more reference images that the model incorporates into the generated video. Use the `inputReferences` option to pass
-these images in a provider-agnostic way:
+more reference images or videos that the model incorporates into the generated video. Use the `inputReferences` option to pass
+these inputs in a provider-agnostic way:
 
 ```tsx highlight={"5-8"}
 const { video } = await generateVideo({
@@ -211,6 +211,25 @@ const { video } = await generateVideo({
 });
 ```
 
+For URL-based video references, use the object form with an explicit `mediaType`:
+
+```tsx highlight={"5-10"}
+const { video } = await generateVideo({
+  model: __VIDEO_MODEL__,
+  prompt: 'Match the motion in the reference clip',
+  inputReferences: [
+    {
+      data: 'https://example.com/reference.mp4',
+      mediaType: 'video/mp4',
+    },
+  ],
+});
+```
+
+Providers route each reference by its media type (image vs. video) and emit a
+warning when a reference kind is unsupported (for example, providers that accept
+only image references warn and ignore a video reference).
+
 ### Providing a Seed
 
 You can provide a seed to the `experimental_generateVideo` function to control the output of the video generation process.

package/docs/03-ai-sdk-harnesses/02-harness-agent.mdx

@@ -13,34 +13,7 @@ results while a preconfigured harness powers these results.
 
 Install the core harness package, a harness adapter, and a sandbox provider:
 
-<div className="my-4">
-  <Tabs items={['pnpm', 'npm', 'yarn', 'bun']}>
-    <Tab>
-      <Snippet
-        text="pnpm add @ai-sdk/harness @ai-sdk/harness-claude-code @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="npm install @ai-sdk/harness @ai-sdk/harness-claude-code @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="yarn add @ai-sdk/harness @ai-sdk/harness-claude-code @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="bun add @ai-sdk/harness @ai-sdk/harness-claude-code @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-  </Tabs>
-</div>
+<InstallPackages packages="@ai-sdk/harness @ai-sdk/harness-claude-code @ai-sdk/sandbox-vercel" />
 
 Bridge-backed harnesses such as Claude Code and Codex require using real network sandbox
 like `@ai-sdk/sandbox-vercel`. Host-runtime harnesses such as Pi can also run with

package/docs/03-ai-sdk-harnesses/05-harness-adapters.mdx

@@ -28,10 +28,10 @@ The AI SDK includes the following harness adapters:
 
 ## Adapter Capabilities
 
-| Adapter                                                | Runtime location | Custom tools        | Custom skills       | Built-in tool approval | Built-in tool filtering                |
-| ------------------------------------------------------ | ---------------- | ------------------- | ------------------- | ---------------------- | -------------------------------------- |
-| [Claude Code](/providers/ai-sdk-harnesses/claude-code) | Sandbox bridge   | <Check size={18} /> | <Check size={18} /> | <Check size={18} />    | <Check size={18} />                    |
-| [Codex](/providers/ai-sdk-harnesses/codex)             | Sandbox bridge   | <Check size={18} /> | <Check size={18} /> | <Cross size={18} />    | <Cross size={18} />                    |
-| [Deep Agents](/providers/ai-sdk-harnesses/deepagents)  | Sandbox bridge   | <Check size={18} /> | <Check size={18} /> | <Check size={18} />    | <Check size={18} /> via auto-rejection |
-| [OpenCode](/providers/ai-sdk-harnesses/opencode)       | Sandbox bridge   | <Check size={18} /> | <Check size={18} /> | <Check size={18} />    | <Check size={18} /> via auto-rejection |
-| [Pi](/providers/ai-sdk-harnesses/pi)                   | Host process     | <Check size={18} /> | <Check size={18} /> | <Check size={18} />    | <Check size={18} />                    |
+| Adapter                                                | Runtime location | Custom tools | Custom skills | Built-in tool approval | Built-in tool filtering      |
+| ------------------------------------------------------ | ---------------- | ------------ | ------------- | ---------------------- | ---------------------------- |
+| [Claude Code](/providers/ai-sdk-harnesses/claude-code) | Sandbox bridge   | <Check />    | <Check />     | <Check />              | <Check />                    |
+| [Codex](/providers/ai-sdk-harnesses/codex)             | Sandbox bridge   | <Check />    | <Check />     | <Cross />              | <Cross />                    |
+| [Deep Agents](/providers/ai-sdk-harnesses/deepagents)  | Sandbox bridge   | <Check />    | <Check />     | <Check />              | <Check /> via auto-rejection |
+| [OpenCode](/providers/ai-sdk-harnesses/opencode)       | Sandbox bridge   | <Check />    | <Check />     | <Check />              | <Check /> via auto-rejection |
+| [Pi](/providers/ai-sdk-harnesses/pi)                   | Host process     | <Check />    | <Check />     | <Check />              | <Check />                    |

package/docs/03-ai-sdk-harnesses/06-workflow-utilities.mdx

@@ -18,22 +18,7 @@ integration.
 
 ## Installation
 
-<div className="my-4">
-  <Tabs items={['pnpm', 'npm', 'yarn', 'bun']}>
-    <Tab>
-      <Snippet text="pnpm add @ai-sdk/workflow-harness workflow" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="npm install @ai-sdk/workflow-harness workflow" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="yarn add @ai-sdk/workflow-harness workflow" dark />
-    </Tab>
-    <Tab>
-      <Snippet text="bun add @ai-sdk/workflow-harness workflow" dark />
-    </Tab>
-  </Tabs>
-</div>
+<InstallPackages packages="@ai-sdk/workflow-harness workflow" />
 
 Install the core harness package, a harness adapter, and a sandbox provider as
 shown in [HarnessAgent](/docs/ai-sdk-harnesses/harness-agent).

package/docs/03-ai-sdk-harnesses/08-terminal-ui.mdx

@@ -12,34 +12,7 @@ session for the lifetime of the terminal UI.
 
 ## Installation
 
-<div className="my-4">
-  <Tabs items={['pnpm', 'npm', 'yarn', 'bun']}>
-    <Tab>
-      <Snippet
-        text="pnpm add @ai-sdk/tui @ai-sdk/harness @ai-sdk/harness-codex @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="npm install @ai-sdk/tui @ai-sdk/harness @ai-sdk/harness-codex @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="yarn add @ai-sdk/tui @ai-sdk/harness @ai-sdk/harness-codex @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-    <Tab>
-      <Snippet
-        text="bun add @ai-sdk/tui @ai-sdk/harness @ai-sdk/harness-codex @ai-sdk/sandbox-vercel"
-        dark
-      />
-    </Tab>
-  </Tabs>
-</div>
+<InstallPackages packages="@ai-sdk/tui @ai-sdk/harness @ai-sdk/harness-codex @ai-sdk/sandbox-vercel" />
 
 ## Example
 

package/docs/04-ai-sdk-ui/01-overview.mdx

@@ -24,11 +24,11 @@ Here is a comparison of the supported functions across these frameworks:
 
 |                                                                 | [useChat](/docs/reference/ai-sdk-ui/use-chat) | [useCompletion](/docs/reference/ai-sdk-ui/use-completion) | [useObject](/docs/reference/ai-sdk-ui/use-object) | [MCP Apps](/docs/ai-sdk-core/mcp-apps) |
 | --------------------------------------------------------------- | --------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------- | -------------------------------------- |
-| React `@ai-sdk/react`                                           | <Check size={18} />                           | <Check size={18} />                                       | <Check size={18} />                               | <Check size={18} />                    |
-| Vue.js `@ai-sdk/vue`                                            | <Check size={18} />                           | <Check size={18} />                                       | <Check size={18} />                               | <Cross size={18} />                    |
-| Svelte `@ai-sdk/svelte`                                         | <Check size={18} /> Chat                      | <Check size={18} /> Completion                            | <Check size={18} /> StructuredObject              | <Cross size={18} />                    |
-| Angular `@ai-sdk/angular`                                       | <Check size={18} /> Chat                      | <Check size={18} /> Completion                            | <Check size={18} /> StructuredObject              | <Cross size={18} />                    |
-| [SolidJS](https://github.com/kodehort/ai-sdk-solid) (community) | <Check size={18} />                           | <Check size={18} />                                       | <Check size={18} />                               | <Cross size={18} />                    |
+| React `@ai-sdk/react`                                           | <Check />                                     | <Check />                                                 | <Check />                                         | <Check />                              |
+| Vue.js `@ai-sdk/vue`                                            | <Check />                                     | <Check />                                                 | <Check />                                         | <Cross />                              |
+| Svelte `@ai-sdk/svelte`                                         | <Check /> Chat                                | <Check /> Completion                                      | <Check /> StructuredObject                        | <Cross />                              |
+| Angular `@ai-sdk/angular`                                       | <Check /> Chat                                | <Check /> Completion                                      | <Check /> StructuredObject                        | <Cross />                              |
+| [SolidJS](https://github.com/kodehort/ai-sdk-solid) (community) | <Check />                                     | <Check />                                                 | <Check />                                         | <Cross />                              |
 
 ## Framework Examples
 

package/docs/07-reference/01-ai-sdk-core/13-generate-video.mdx

@@ -118,9 +118,10 @@ console.log(videos);
     },
     {
       name: 'inputReferences',
-      type: 'Array<DataContent>',
+      type: 'Array<DataContent | { data: DataContent; mediaType?: string }>',
       isOptional: true,
-      description: 'Reference image inputs for reference-to-video generation.',
+      description:
+        'Reference image or video inputs for reference-to-video generation. Use the object form with an explicit mediaType for URL-based video references. Providers route each reference by its media type and warn when a reference kind is unsupported.',
     },
     {
       name: 'generateAudio',

package/docs/07-reference/02-ai-sdk-ui/index.mdx

@@ -87,11 +87,11 @@ Here is a comparison of the supported functions across these frameworks:
 
 |                                                                 | [useChat](/docs/reference/ai-sdk-ui/use-chat) | [useCompletion](/docs/reference/ai-sdk-ui/use-completion) | [useObject](/docs/reference/ai-sdk-ui/use-object) | [MCP Apps](/docs/ai-sdk-core/mcp-apps) |
 | --------------------------------------------------------------- | --------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------- | -------------------------------------- |
-| React `@ai-sdk/react`                                           | <Check size={18} />                           | <Check size={18} />                                       | <Check size={18} />                               | <Check size={18} />                    |
-| Vue.js `@ai-sdk/vue`                                            | <Check size={18} /> Chat                      | <Check size={18} />                                       | <Check size={18} />                               | <Cross size={18} />                    |
-| Svelte `@ai-sdk/svelte`                                         | <Check size={18} /> Chat                      | <Check size={18} /> Completion                            | <Check size={18} /> StructuredObject              | <Cross size={18} />                    |
-| Angular `@ai-sdk/angular`                                       | <Check size={18} /> Chat                      | <Check size={18} /> Completion                            | <Check size={18} /> StructuredObject              | <Cross size={18} />                    |
-| [SolidJS](https://github.com/kodehort/ai-sdk-solid) (community) | <Check size={18} />                           | <Check size={18} />                                       | <Check size={18} />                               | <Cross size={18} />                    |
+| React `@ai-sdk/react`                                           | <Check />                                     | <Check />                                                 | <Check />                                         | <Check />                              |
+| Vue.js `@ai-sdk/vue`                                            | <Check /> Chat                                | <Check />                                                 | <Check />                                         | <Cross />                              |
+| Svelte `@ai-sdk/svelte`                                         | <Check /> Chat                                | <Check /> Completion                                      | <Check /> StructuredObject                        | <Cross />                              |
+| Angular `@ai-sdk/angular`                                       | <Check /> Chat                                | <Check /> Completion                                      | <Check /> StructuredObject                        | <Cross />                              |
+| [SolidJS](https://github.com/kodehort/ai-sdk-solid) (community) | <Check />                                     | <Check />                                                 | <Check />                                         | <Cross />                              |
 
 <Note>
   [Contributions](https://github.com/vercel/ai/blob/main/CONTRIBUTING.md) are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.18",
+  "version": "7.0.19",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,9 +42,9 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.14",
-    "@ai-sdk/provider": "4.0.2",
-    "@ai-sdk/provider-utils": "5.0.6"
+    "@ai-sdk/gateway": "4.0.15",
+    "@ai-sdk/provider": "4.0.3",
+    "@ai-sdk/provider-utils": "5.0.7"
   },
   "devDependencies": {
     "@edge-runtime/vm": "^5.0.0",

package/src/generate-text/collect-tool-approvals.ts

@@ -36,8 +36,19 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
     };
   }
 
-  // gather tool calls and prepare lookup
-  const toolCallsByToolCallId: Record<string, TypedToolCall<TOOLS>> = {};
+  // gather tool calls and prepare lookup.
+  //
+  // These maps are keyed by client-supplied ids (`toolCallId`, `approvalId`)
+  // from the message history. Using `Object.create(null)` gives them no
+  // prototype, so an id that matches an inherited object property (e.g.
+  // `toString`, `constructor`, `__proto__`) is treated as absent instead of
+  // resolving to a prototype value and slipping past the `== null` guards
+  // below (which would otherwise skip the InvalidToolApproval /
+  // ToolCallNotFound checks).
+  const toolCallsByToolCallId: Record<
+    string,
+    TypedToolCall<TOOLS>
+  > = Object.create(null);
   for (const message of messages) {
     if (message.role === 'assistant' && typeof message.content !== 'string') {
       const content = message.content;
@@ -51,7 +62,7 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
 
   // gather approval responses and prepare lookup
   const toolApprovalRequestsByApprovalId: Record<string, ToolApprovalRequest> =
-    {};
+    Object.create(null);
   for (const message of messages) {
     if (message.role === 'assistant' && typeof message.content !== 'string') {
       const content = message.content;
@@ -64,7 +75,9 @@ export function collectToolApprovals<TOOLS extends ToolSet>({
   }
 
   // gather tool results from the last tool message
-  const toolResults: Record<string, TypedToolResult<TOOLS>> = {};
+  const toolResults: Record<string, TypedToolResult<TOOLS>> = Object.create(
+    null,
+  );
   for (const part of lastMessage.content) {
     if (part.type === 'tool-result') {
       toolResults[part.toolCallId] = part as TypedToolResult<TOOLS>;

package/src/generate-text/execute-tool-call.ts

@@ -13,6 +13,7 @@ import {
   type TimeoutConfiguration,
 } from '../prompt/request-options';
 import type { TelemetryDispatcher } from '../telemetry/telemetry';
+import { getOwn } from '../util/get-own';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
 import { notify } from '../util/notify';
 import { now } from '../util/now';
@@ -83,7 +84,7 @@ export async function executeToolCall<TOOLS extends ToolSet>({
   | undefined
 > {
   const { toolName, toolCallId, input } = toolCall;
-  const tool = tools?.[toolName];
+  const tool = getOwn(tools, toolName);
 
   if (!isExecutableTool(tool)) {
     return undefined;
@@ -91,7 +92,7 @@ export async function executeToolCall<TOOLS extends ToolSet>({
 
   const context = await validateToolContext({
     toolName,
-    context: toolsContext?.[toolName as keyof typeof toolsContext],
+    context: getOwn(toolsContext, toolName),
     contextSchema: tool.contextSchema,
   });
 

package/src/generate-text/execute-tools-from-stream.ts

@@ -9,6 +9,7 @@ import type {
 } from '@ai-sdk/provider-utils';
 import type { TimeoutConfiguration } from '../prompt/request-options';
 import type { Telemetry, TelemetryDispatcher } from '../telemetry/telemetry';
+import { getOwn } from '../util/get-own';
 import { executeToolCall } from './execute-tool-call';
 import { resolveToolApproval } from './resolve-tool-approval';
 import type { LanguageModelStreamPart } from './stream-language-model-call';
@@ -95,7 +96,7 @@ export function executeToolsFromStream<
               return;
             }
 
-            const tool = tools?.[chunk.toolName];
+            const tool = getOwn(tools, chunk.toolName);
 
             if (tool == null) {
               // ignore tool calls for tools that are not available,

package/src/generate-text/generate-text.ts

@@ -50,6 +50,7 @@ import {
   type LanguageModelUsage,
 } from '../types/usage';
 import type { DownloadFunction } from '../util/download/download-function';
+import { getOwn } from '../util/get-own';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
 import { mergeObjects } from '../util/merge-objects';
 import { now as originalNow } from '../util/now';
@@ -717,7 +718,7 @@ export async function generateText<
           const modelOutput = await createToolModelOutput({
             toolCallId: output.toolCallId,
             input: output.input,
-            tool: tools?.[output.toolName],
+            tool: getOwn(tools, output.toolName),
             output:
               output.type === 'tool-result' ? output.output : output.error,
             errorMode: output.type === 'tool-error' ? 'text' : 'none',
@@ -1040,7 +1041,7 @@ export async function generateText<
                   continue; // ignore invalid tool calls
                 }
 
-                const tool = tools?.[toolCall.toolName];
+                const tool = getOwn(tools, toolCall.toolName);
 
                 if (tool == null) {
                   // ignore tool calls for tools that are not available,
@@ -1234,7 +1235,7 @@ export async function generateText<
               // the client tool's result is sent back.
               for (const toolCall of stepToolCalls) {
                 if (!toolCall.providerExecuted) continue;
-                const tool = tools?.[toolCall.toolName];
+                const tool = getOwn(tools, toolCall.toolName);
                 if (tool?.type === 'provider' && tool.supportsDeferredResults) {
                   // Check if this tool call already has a result in the current response
                   const hasResultInResponse = currentModelResponse.content.some(
@@ -1699,7 +1700,7 @@ function asContent<TOOLS extends ToolSet>({
         // result may be deferred to a later turn. In this case, there's no matching tool-call
         // in the current response.
         if (toolCall == null) {
-          const tool = tools?.[part.toolName];
+          const tool = getOwn(tools, part.toolName);
           const supportsDeferredResults =
             tool?.type === 'provider' && tool.supportsDeferredResults;
 

package/src/generate-text/index.ts

@@ -80,6 +80,7 @@ export type {
   ToolApprovalConfiguration,
   ToolApprovalStatus,
 } from './tool-approval-configuration';
+export { detectToolDrift, fingerprintTools } from './tool-fingerprint';
 export type { ToolApprovalRequestOutput } from './tool-approval-request-output';
 export type { ToolApprovalResponseOutput } from './tool-approval-response-output';
 export type {

package/src/generate-text/invoke-tool-callbacks-from-stream.ts

@@ -1,4 +1,6 @@
 import type { Context, ModelMessage, ToolSet } from '@ai-sdk/provider-utils';
+import { createIdMap } from '../util/create-id-map';
+import { getOwn } from '../util/get-own';
 import type { LanguageModelStreamPart } from './stream-language-model-call';
 
 export function invokeToolCallbacksFromStream<
@@ -19,7 +21,7 @@ export function invokeToolCallbacksFromStream<
 }): ReadableStream<LanguageModelStreamPart<TOOLS>> {
   if (tools == null) return stream;
 
-  const ongoingToolCallToolNames: Record<string, string> = {};
+  const ongoingToolCallToolNames: Record<string, string> = createIdMap();
 
   return stream.pipeThrough(
     new TransformStream({
@@ -30,7 +32,7 @@ export function invokeToolCallbacksFromStream<
           case 'tool-input-start': {
             ongoingToolCallToolNames[chunk.id] = chunk.toolName;
 
-            const tool = tools?.[chunk.toolName];
+            const tool = getOwn(tools, chunk.toolName);
             if (tool?.onInputStart != null) {
               await tool.onInputStart({
                 toolCallId: chunk.id,
@@ -45,7 +47,7 @@ export function invokeToolCallbacksFromStream<
 
           case 'tool-input-delta': {
             const toolName = ongoingToolCallToolNames[chunk.id];
-            const tool = tools?.[toolName];
+            const tool = getOwn(tools, toolName);
 
             if (tool?.onInputDelta != null) {
               await tool.onInputDelta({
@@ -62,7 +64,7 @@ export function invokeToolCallbacksFromStream<
 
           case 'tool-call': {
             const toolName = ongoingToolCallToolNames[chunk.toolCallId];
-            const tool = tools?.[toolName];
+            const tool = getOwn(tools, toolName);
 
             delete ongoingToolCallToolNames[chunk.toolCallId];
 

package/src/generate-text/parse-tool-call.ts

@@ -11,6 +11,7 @@ import { InvalidToolInputError } from '../error/invalid-tool-input-error';
 import { NoSuchToolError } from '../error/no-such-tool-error';
 import { ToolCallRepairError } from '../error/tool-call-repair-error';
 import type { Instructions } from '../prompt';
+import { getOwn } from '../util/get-own';
 import type { DynamicToolCall, TypedToolCall } from './tool-call';
 import type { ToolCallRepairFunction } from './tool-call-repair-function';
 import type { ToolInputRefinement } from './tool-input-refinement';
@@ -66,7 +67,7 @@ export async function parseToolCall<TOOLS extends ToolSet>({
           toolCall,
           tools,
           inputSchema: async ({ toolName }) => {
-            const { inputSchema } = tools[toolName];
+            const inputSchema = getOwn(tools, toolName)?.inputSchema;
             return await asSchema(inputSchema).jsonSchema;
           },
           instructions,
@@ -95,7 +96,7 @@ export async function parseToolCall<TOOLS extends ToolSet>({
     // use parsed input when possible
     const parsedInput = await safeParseJSON({ text: toolCall.input });
     const input = parsedInput.success ? parsedInput.value : toolCall.input;
-    const tool = tools?.[toolCall.toolName];
+    const tool = getOwn(tools, toolCall.toolName);
 
     // TODO AI SDK 6: special invalid tool call parts
     return {
@@ -121,7 +122,7 @@ async function refineParsedToolCallInput<TOOLS extends ToolSet>({
   toolCall: TypedToolCall<TOOLS>;
   refineToolInput: ToolInputRefinement<TOOLS> | undefined;
 }): Promise<TypedToolCall<TOOLS>> {
-  const refine = refineToolInput?.[toolCall.toolName];
+  const refine = getOwn(refineToolInput, toolCall.toolName);
 
   if (refine == null) {
     return toolCall;
@@ -169,7 +170,7 @@ async function doParseToolCall<TOOLS extends ToolSet>({
 }): Promise<TypedToolCall<TOOLS>> {
   const toolName = toolCall.toolName as keyof TOOLS & string;
 
-  const tool = tools[toolName];
+  const tool = getOwn(tools, toolName);
 
   if (tool == null) {
     // provider-executed dynamic tools are not part of our list of tools: