ai 7.0.34 → 7.0.36

package/src/generate-text/stream-text.ts

@@ -34,6 +34,7 @@ import { prepareTools } from '../prompt/prepare-tools';
 import type { Prompt } from '../prompt/prompt';
 import {
   getChunkTimeoutMs,
+  getFirstChunkTimeoutMs,
   getStepTimeoutMs,
   getTotalTimeoutMs,
   type RequestOptions,
@@ -157,28 +158,29 @@ const originalGenerateCallId = createIdGenerator({
   size: 24,
 });
 
-// chunk types that count as model output; used to distinguish empty
-// incomplete streams from incomplete streams with partial results.
-// exhaustive so that new chunk types must be classified explicitly:
+// Chunk types that contain semantic model output. This classification is used
+// for first-content and inter-content timeouts as well as to distinguish empty
+// incomplete streams from incomplete streams with partial results. It is
+// exhaustive so that new chunk types must be classified explicitly.
 const isOutputChunkType = {
   file: true,
-  custom: true,
-  source: true,
-  'text-start': true,
-  'text-end': true,
+  custom: false,
+  source: false,
+  'text-start': false,
+  'text-end': false,
   'text-delta': true,
-  'reasoning-start': true,
-  'reasoning-end': true,
+  'reasoning-start': false,
+  'reasoning-end': false,
   'reasoning-delta': true,
   'reasoning-file': true,
-  'tool-input-start': true,
-  'tool-input-end': true,
+  'tool-input-start': false,
+  'tool-input-end': false,
   'tool-input-delta': true,
-  'tool-approval-request': true,
-  'tool-approval-response': true,
+  'tool-approval-request': false,
+  'tool-approval-response': false,
   'tool-call': true,
-  'tool-result': true,
-  'tool-error': true,
+  'tool-result': false,
+  'tool-error': false,
   'tool-execution-end': false,
   'model-call-start': false,
   'model-call-response-metadata': false,
@@ -187,6 +189,26 @@ const isOutputChunkType = {
   raw: false,
 } as const satisfies Record<ExecuteToolsStreamPart['type'], boolean>;
 
+function isOutputChunk(chunk: ExecuteToolsStreamPart): boolean {
+  if (!isOutputChunkType[chunk.type]) {
+    return false;
+  }
+
+  switch (chunk.type) {
+    case 'text-delta':
+    case 'reasoning-delta':
+      return chunk.text.length > 0;
+    case 'tool-input-delta':
+      return chunk.delta.length > 0;
+    case 'file':
+    case 'reasoning-file':
+    case 'tool-call':
+      return true;
+    default:
+      return false;
+  }
+}
+
 export type StreamTextInclude = {
   /**
    * Whether to retain the request body in step results.
@@ -716,9 +738,12 @@ export function streamText<
   }): StreamTextResult<TOOLS, RUNTIME_CONTEXT, OUTPUT> {
   const totalTimeoutMs = getTotalTimeoutMs(timeout);
   const stepTimeoutMs = getStepTimeoutMs(timeout);
+  const firstChunkTimeoutMs = getFirstChunkTimeoutMs(timeout);
   const chunkTimeoutMs = getChunkTimeoutMs(timeout);
   const stepAbortController =
     stepTimeoutMs != null ? new AbortController() : undefined;
+  const firstChunkAbortController =
+    firstChunkTimeoutMs != null ? new AbortController() : undefined;
   const chunkAbortController =
     chunkTimeoutMs != null ? new AbortController() : undefined;
   const resolvedOnStart = onStart ?? experimental_onStart;
@@ -742,10 +767,13 @@ export function streamText<
       abortSignal,
       totalTimeoutMs,
       stepAbortController?.signal,
+      firstChunkAbortController?.signal,
       chunkAbortController?.signal,
     ),
     stepTimeoutMs,
     stepAbortController,
+    firstChunkTimeoutMs,
+    firstChunkAbortController,
     chunkTimeoutMs,
     chunkAbortController,
     instructions,
@@ -930,6 +958,10 @@ class DefaultStreamTextResult<
 
   private readonly addStream: (
     stream: ReadableStream<TextStreamPart<TOOLS>>,
+    callbacks?: {
+      onError?: (error: unknown) => void;
+      onCancel?: () => void;
+    },
   ) => void;
 
   private readonly closeStream: () => void;
@@ -951,6 +983,8 @@ class DefaultStreamTextResult<
     abortSignal,
     stepTimeoutMs,
     stepAbortController,
+    firstChunkTimeoutMs,
+    firstChunkAbortController,
     chunkTimeoutMs,
     chunkAbortController,
     instructions,
@@ -1000,6 +1034,8 @@ class DefaultStreamTextResult<
     abortSignal: AbortSignal | undefined;
     stepTimeoutMs: number | undefined;
     stepAbortController: AbortController | undefined;
+    firstChunkTimeoutMs: number | undefined;
+    firstChunkAbortController: AbortController | undefined;
     chunkTimeoutMs: number | undefined;
     chunkAbortController: AbortController | undefined;
     toolsContext: InferToolSetContext<TOOLS>;
@@ -1771,7 +1807,32 @@ class DefaultStreamTextResult<
           timeoutMs: stepTimeoutMs,
         });
 
-        // Set up chunk timeout tracking (will be reset on each chunk)
+        // The first-content timeout is armed when the provider response stream
+        // starts and is cleared by the first semantic output chunk.
+        let firstChunkTimeoutId: ReturnType<typeof setTimeout> | undefined =
+          undefined;
+
+        function startFirstChunkTimeout() {
+          if (abortSignal?.aborted) {
+            return;
+          }
+
+          firstChunkTimeoutId = setAbortTimeout({
+            abortController: firstChunkAbortController,
+            label: 'First chunk',
+            timeoutMs: firstChunkTimeoutMs,
+          });
+        }
+
+        function clearFirstChunkTimeout() {
+          if (firstChunkTimeoutId != null) {
+            clearTimeout(firstChunkTimeoutId);
+            firstChunkTimeoutId = undefined;
+          }
+        }
+
+        // Chunk timeout tracking starts after semantic output begins and is
+        // reset only by subsequent semantic output chunks.
         let chunkTimeoutId: ReturnType<typeof setTimeout> | undefined =
           undefined;
 
@@ -1799,12 +1860,24 @@ class DefaultStreamTextResult<
           }
         }
 
+        function clearStepTimeouts() {
+          clearStepTimeout();
+          clearFirstChunkTimeout();
+          clearChunkTimeout();
+        }
+
+        function cleanupStepTimeouts() {
+          abortSignal?.removeEventListener('abort', cleanupStepTimeouts);
+          clearStepTimeouts();
+        }
+
         // The step's stream is registered lazily and consumed long after this
-        // function returns, so the step timer must stay armed past setup. When
-        // the merged abort signal fires (any step/chunk/total timeout or caller
-        // abort), drop both step-scoped timers so neither outlives the step.
-        abortSignal?.addEventListener('abort', clearStepTimeout);
-        abortSignal?.addEventListener('abort', clearChunkTimeout);
+        // function returns, so its timers must stay armed past setup. When the
+        // merged abort signal fires, drop all step-scoped timers so none
+        // outlives the step.
+        abortSignal?.addEventListener('abort', cleanupStepTimeouts, {
+          once: true,
+        });
 
         try {
           stepFinish = new DelayedPromise<void>();
@@ -1967,6 +2040,8 @@ class DefaultStreamTextResult<
             ),
           );
 
+          startFirstChunkTimeout();
+
           const streamAfterToolCallbackInvocation =
             invokeToolCallbacksFromStream({
               stream: languageModelStream,
@@ -2076,8 +2151,6 @@ class DefaultStreamTextResult<
                 TextStreamPart<TOOLS>
               >({
                 async transform(chunk, controller): Promise<void> {
-                  resetChunkTimeout();
-
                   if (chunk.type === 'model-call-start') {
                     warnings = chunk.warnings;
                     return; // stream start chunks are sent immediately and do not count as first chunk
@@ -2096,8 +2169,14 @@ class DefaultStreamTextResult<
 
                   const chunkType = chunk.type;
 
-                  if (isOutputChunkType[chunkType]) {
+                  if (isOutputChunk(chunk)) {
+                    if (!hasReceivedOutputChunk) {
+                      // Clear before forwarding the first output so a timeout
+                      // cannot race with already-visible generated content.
+                      clearFirstChunkTimeout();
+                    }
                     hasReceivedOutputChunk = true;
+                    resetChunkTimeout();
                   }
 
                   switch (chunkType) {
@@ -2217,8 +2296,7 @@ class DefaultStreamTextResult<
                       }),
                     });
 
-                    clearStepTimeout();
-                    clearChunkTimeout();
+                    cleanupStepTimeouts();
                     self.closeStream();
                     return;
                   }
@@ -2298,9 +2376,8 @@ class DefaultStreamTextResult<
                     }
                   }
 
-                  // Clear the step and chunk timeouts before the next step is started
-                  clearStepTimeout();
-                  clearChunkTimeout();
+                  // Clear this step's timeouts before the next step is started.
+                  cleanupStepTimeouts();
 
                   if (
                     // Continue if:
@@ -2345,12 +2422,15 @@ class DefaultStreamTextResult<
                 },
               }),
             ),
+            {
+              onError: cleanupStepTimeouts,
+              onCancel: cleanupStepTimeouts,
+            },
           );
         } catch (error) {
           // Setup failed before the stream was registered, so neither the
           // stream's flush nor an abort will clear the timers — clear them here.
-          clearStepTimeout();
-          clearChunkTimeout();
+          cleanupStepTimeouts();
           throw error;
         }
       }
@@ -2678,7 +2758,7 @@ class DefaultStreamTextResult<
       ...init
     }: UIMessageStreamResponseInit & UIMessageStreamOptions<UI_MESSAGE> = {},
   ) {
-    pipeUIMessageStreamToResponse({
+    return pipeUIMessageStreamToResponse({
       response,
       stream: this.toUIMessageStream({
         originalMessages,
@@ -2696,7 +2776,7 @@ class DefaultStreamTextResult<
   }
 
   pipeTextStreamToResponse(response: ServerResponse, init?: ResponseInit) {
-    pipeTextStreamToResponse({
+    return pipeTextStreamToResponse({
       response,
       stream: this.textStream,
       ...init,

package/src/generate-text/tool-approval-signature.ts

@@ -18,11 +18,37 @@ async function importKey(secret: string | Uint8Array): Promise<CryptoKey> {
   );
 }
 
+// Serialize with JSON so the encoding is injective: fields may contain any
+// character (including newlines), and escaping + array structure keeps field
+// boundaries unambiguous. The version prefix provides domain separation.
 function buildPayload(
   approvalId: string,
   toolCallId: string,
   toolName: string,
   inputDigest: string,
+): Uint8Array {
+  return encoder.encode(
+    JSON.stringify([
+      'ai-sdk-tool-approval-v1',
+      approvalId,
+      toolCallId,
+      toolName,
+      inputDigest,
+    ]),
+  );
+}
+
+// Legacy newline-joined payload. Ambiguous when any field contains the `\n`
+// delimiter, which is why it was replaced; only used as a verify-time fallback
+// guarded on delimiter-free fields.
+// TODO(#17494): remove in v8 when backwards compatibility with pre-JSON
+// signatures (approvals signed before the injective format) is no longer
+// needed.
+function buildLegacyPayload(
+  approvalId: string,
+  toolCallId: string,
+  toolName: string,
+  inputDigest: string,
 ): Uint8Array {
   return encoder.encode(
     `${approvalId}\n${toolCallId}\n${toolName}\n${inputDigest}`,
@@ -66,9 +92,35 @@ export async function verifyToolApprovalSignature({
 }): Promise<boolean> {
   const key = await importKey(secret);
   const inputDigest = await hashCanonical(input);
-  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
   const sigBytes = fromBase64url(signature);
-  return crypto.subtle.verify('HMAC', key, sigBytes, payload);
+
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  if (await crypto.subtle.verify('HMAC', key, sigBytes, payload)) {
+    return true;
+  }
+
+  // Backwards compatibility: accept a signature produced by the legacy
+  // newline-joined format, but only when no field contains the `\n` delimiter
+  // — the exact condition that made that format ambiguous. This keeps the
+  // retupling collision closed (the attack requires a newline in a field)
+  // while still verifying benign approvals signed by an older version, e.g. a
+  // pending approval that straddles an upgrade.
+  // TODO(#17494): remove in v8 (drop buildLegacyPayload and this fallback).
+  if (
+    !approvalId.includes('\n') &&
+    !toolCallId.includes('\n') &&
+    !toolName.includes('\n')
+  ) {
+    const legacyPayload = buildLegacyPayload(
+      approvalId,
+      toolCallId,
+      toolName,
+      inputDigest,
+    );
+    return crypto.subtle.verify('HMAC', key, sigBytes, legacyPayload);
+  }
+
+  return false;
 }
 
 export async function maybeSignApproval({

package/src/prompt/index.ts

@@ -10,6 +10,7 @@ export type CallSettings = LanguageModelCallOptions &
 export {
   getTotalTimeoutMs,
   getStepTimeoutMs,
+  getFirstChunkTimeoutMs,
   getChunkTimeoutMs,
   getToolTimeoutMs,
 } from './request-options';

package/src/prompt/request-options.ts

@@ -5,7 +5,8 @@ import type { ToolSet } from '@ai-sdk/provider-utils';
  * - A number representing milliseconds
  * - An object with `totalMs` property for the total timeout in milliseconds
  * - An object with `stepMs` property for the timeout of each step in milliseconds
- * - An object with `chunkMs` property for the timeout between stream chunks (streaming only)
+ * - An object with `firstChunkMs` property for the timeout until the first content chunk of each step (streaming only)
+ * - An object with `chunkMs` property for the timeout between content chunks (streaming only)
  * - An object with `toolMs` property for the default timeout for all tool executions
  * - An object with `tools` property for per-tool timeout overrides using `{toolName}Ms` keys
  */
@@ -14,6 +15,7 @@ export type TimeoutConfiguration<TOOLS extends ToolSet> =
   | {
       totalMs?: number;
       stepMs?: number;
+      firstChunkMs?: number;
       chunkMs?: number;
       toolMs?: number;
       tools?: Partial<Record<`${keyof TOOLS & string}Ms`, number>>;
@@ -52,9 +54,25 @@ export function getStepTimeoutMs(
   return timeout.stepMs;
 }
 
+/**
+ * Extracts the first chunk timeout value in milliseconds from a TimeoutConfiguration.
+ * This timeout is for streaming only - it aborts if no content chunk is received within the specified duration.
+ *
+ * @param timeout - The timeout configuration.
+ * @returns The first chunk timeout in milliseconds, or undefined if no first chunk timeout is configured.
+ */
+export function getFirstChunkTimeoutMs(
+  timeout: TimeoutConfiguration<any> | undefined,
+): number | undefined {
+  if (timeout == null || typeof timeout === 'number') {
+    return undefined;
+  }
+  return timeout.firstChunkMs;
+}
+
 /**
  * Extracts the chunk timeout value in milliseconds from a TimeoutConfiguration.
- * This timeout is for streaming only - it aborts if no new chunk is received within the specified duration.
+ * This timeout is for streaming only - it aborts if no new content chunk is received within the specified duration.
  *
  * @param timeout - The timeout configuration.
  * @returns The chunk timeout in milliseconds, or undefined if no chunk timeout is configured.

package/src/text-stream/pipe-text-stream-to-response.ts

@@ -13,6 +13,7 @@ import { writeToServerResponse } from '../util/write-to-server-response';
  * @param options.statusText - Optional HTTP status text.
  * @param options.headers - Optional response headers.
  * @param options.stream - The text stream to pipe.
+ * @returns A promise that resolves when the stream has been written.
  */
 export function pipeTextStreamToResponse({
   response,
@@ -23,8 +24,8 @@ export function pipeTextStreamToResponse({
 }: {
   response: ServerResponse;
   stream: ReadableStream<string>;
-} & ResponseInit): void {
-  writeToServerResponse({
+} & ResponseInit): Promise<void> {
+  return writeToServerResponse({
     response,
     status,
     statusText,

package/src/ui-message-stream/pipe-ui-message-stream-to-response.ts

@@ -16,6 +16,7 @@ import type { UIMessageStreamResponseInit } from './ui-message-stream-response-i
  * @param options.headers - Additional HTTP headers to include in the response.
  * @param options.stream - The UI message chunk stream to send.
  * @param options.consumeSseStream - Optional callback to consume a copy of the SSE stream independently.
+ * @returns A promise that resolves when the stream has been written.
  */
 export function pipeUIMessageStreamToResponse({
   response,
@@ -27,7 +28,7 @@ export function pipeUIMessageStreamToResponse({
 }: {
   response: ServerResponse;
   stream: ReadableStream<UIMessageChunk>;
-} & UIMessageStreamResponseInit): void {
+} & UIMessageStreamResponseInit): Promise<void> {
   let sseStream = stream.pipeThrough(new JsonToSseTransformStream());
 
   // when the consumeSseStream is provided, we need to tee the stream
@@ -39,7 +40,7 @@ export function pipeUIMessageStreamToResponse({
     consumeSseStream({ stream: stream2 }); // no await (do not block the response)
   }
 
-  writeToServerResponse({
+  return writeToServerResponse({
     response,
     status,
     statusText,

package/src/util/create-stitchable-stream.ts

@@ -8,11 +8,21 @@ import { createResolvablePromise } from './create-resolvable-promise';
  */
 export function createStitchableStream<T>(): {
   stream: ReadableStream<T>;
-  addStream: (innerStream: ReadableStream<T>) => void;
+  addStream: (
+    innerStream: ReadableStream<T>,
+    callbacks?: {
+      onError?: (error: unknown) => void;
+      onCancel?: () => void;
+    },
+  ) => void;
   close: () => void;
   terminate: () => void;
 } {
-  let innerStreamReaders: ReadableStreamDefaultReader<T>[] = [];
+  let innerStreams: Array<{
+    reader: ReadableStreamDefaultReader<T>;
+    onError?: (error: unknown) => void;
+    onCancel?: () => void;
+  }> = [];
   let controller: ReadableStreamDefaultController<T> | null = null;
   let isClosed = false;
   let waitForNewStream = createResolvablePromise<void>();
@@ -21,34 +31,39 @@ export function createStitchableStream<T>(): {
     isClosed = true;
     waitForNewStream.resolve();
 
-    innerStreamReaders.forEach(reader => reader.cancel());
-    innerStreamReaders = [];
+    innerStreams.forEach(({ reader, onCancel }) => {
+      onCancel?.();
+      reader.cancel();
+    });
+    innerStreams = [];
     controller?.close();
   };
 
   const processPull = async () => {
     // Case 1: Outer stream is closed and no more inner streams
-    if (isClosed && innerStreamReaders.length === 0) {
+    if (isClosed && innerStreams.length === 0) {
       controller?.close();
       return;
     }
 
     // Case 2: No inner streams available, but outer stream is open
     // wait for a new inner stream to be added or the outer stream to close
-    if (innerStreamReaders.length === 0) {
+    if (innerStreams.length === 0) {
       waitForNewStream = createResolvablePromise<void>();
       await waitForNewStream.promise;
       return await processPull();
     }
 
+    const currentStream = innerStreams[0];
+
     try {
-      const { value, done } = await innerStreamReaders[0].read();
+      const { value, done } = await currentStream.reader.read();
 
       if (done) {
         // Case 3: Current inner stream is done
-        innerStreamReaders.shift(); // Remove the finished stream
+        innerStreams.shift(); // Remove the finished stream
 
-        if (innerStreamReaders.length === 0 && isClosed) {
+        if (innerStreams.length === 0 && isClosed) {
           // when closed and no more inner streams, stop pulling
           controller?.close();
         } else {
@@ -61,8 +76,9 @@ export function createStitchableStream<T>(): {
       }
     } catch (error) {
       // Case 5: Current inner stream throws an error
+      currentStream.onError?.(error);
       controller?.error(error);
-      innerStreamReaders.shift(); // Remove the errored stream
+      innerStreams.shift(); // Remove the errored stream
       terminate(); // we have errored, terminate all streams
     }
   };
@@ -74,19 +90,29 @@ export function createStitchableStream<T>(): {
       },
       pull: processPull,
       async cancel() {
-        for (const reader of innerStreamReaders) {
+        for (const { reader, onCancel } of innerStreams) {
+          onCancel?.();
           await reader.cancel();
         }
-        innerStreamReaders = [];
+        innerStreams = [];
         isClosed = true;
       },
     }),
-    addStream: (innerStream: ReadableStream<T>) => {
+    addStream: (
+      innerStream: ReadableStream<T>,
+      callbacks?: {
+        onError?: (error: unknown) => void;
+        onCancel?: () => void;
+      },
+    ) => {
       if (isClosed) {
         throw new Error('Cannot add inner stream: outer stream is closed');
       }
 
-      innerStreamReaders.push(innerStream.getReader());
+      innerStreams.push({
+        reader: innerStream.getReader(),
+        ...callbacks,
+      });
       waitForNewStream.resolve();
     },
 
@@ -98,7 +124,7 @@ export function createStitchableStream<T>(): {
       isClosed = true;
       waitForNewStream.resolve();
 
-      if (innerStreamReaders.length === 0) {
+      if (innerStreams.length === 0) {
         controller?.close();
       }
     },

package/src/util/write-to-server-response.ts

@@ -19,7 +19,7 @@ export function writeToServerResponse({
   statusText?: string;
   headers?: Record<string, string | number | string[]>;
   stream: ReadableStream<Uint8Array>;
-}): void {
+}): Promise<void> {
   const statusCode = status ?? 200;
   if (statusText !== undefined) {
     response.writeHead(statusCode, statusText, headers);
@@ -54,5 +54,5 @@ export function writeToServerResponse({
     }
   };
 
-  read();
+  return read();
 }