ai 7.0.88 → 7.0.90

package/dist/internal/index.js

@@ -91,7 +91,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "7.0.88" : "0.0.0-test";
+var VERSION = true ? "7.0.90" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/docs/02-foundations/02-providers-and-models.mdx

@@ -145,6 +145,7 @@ Here are the capabilities of popular models:
 | [OpenAI](/providers/ai-sdk-providers/openai)       | `gpt-5-codex`                               | <Check />   | <Check />         | <Check />  | <Check />      |
 | [OpenAI](/providers/ai-sdk-providers/openai)       | `gpt-5-chat-latest`                         | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-sonnet-5`                           | <Check />   | <Check />         | <Check />  | <Check />      |
+| [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-fable-5-1`                          | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-fable-5`                            | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-opus-4-8`                           | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-opus-4-7`                           | <Check />   | <Check />         | <Check />  | <Check />      |

package/docs/03-agents/07-workflow-agent.mdx

@@ -613,6 +613,21 @@ const agent = new WorkflowAgent({
 });
 ```
 
+Tool input callbacks (`onInputStart`, `onInputDelta`, and
+`onInputAvailable`) are also preserved by `WorkflowAgent`. The model call runs
+inside a durable step, while callback functions remain in the workflow
+context because arbitrary functions cannot cross the step boundary. As a
+result, `WorkflowAgent` records the callback events during the model step and
+replays them in order immediately after that step completes, before tool
+execution and step lifecycle callbacks. They do not run concurrently with
+model generation and cannot provide in-flight cancellation or backpressure.
+Each callback receives its tool's `toolsContext` entry after
+`contextSchema` validation.
+
+For highly fragmented tool inputs, `onInputDelta` replay data is part of the
+durable model-step result. Only configure `onInputDelta` when each generated
+delta is needed; omit it to avoid retaining delta replay data.
+
 The deprecated `experimental_onStart` and `experimental_onStepStart` names
 remain available for backwards compatibility. When both the stable and
 experimental name are provided in the same constructor or `stream()` call, the

package/docs/03-ai-sdk-core/39-file-uploads.mdx

@@ -94,6 +94,31 @@ const { providerReference } = await uploadFile({
 });
 ```
 
+## Streaming Uploads
+
+Providers that support streaming uploads (e.g. OpenAI, xAI) accept a tagged
+`{ type: 'stream', stream }` shape, sending the bytes without buffering the
+full file in memory. Providers without streaming support reject stream data
+with an `UnsupportedFunctionalityError`.
+
+```ts
+const { providerReference } = await uploadFile({
+  api: openai.files(),
+  data: { type: 'stream', stream: fileStream },
+  mediaType: 'application/jsonl',
+  filename: 'batch.jsonl',
+});
+```
+
+The provider consumes the stream: any failed upload — including validation
+failures before a request is made — cancels it, and it must not be reused. Stream data cannot be sniffed, so `mediaType` defaults to
+`application/octet-stream` when omitted, and multipart-based providers default
+the filename to `"blob"`.
+
+Uploads can be cancelled with `abortSignal` and carry request-specific
+`headers`. Results include `byteSize`, `createdAt`, and `expiresAt` (the
+provider-applied retention expiry) when the provider reports them.
+
 ## Provider References
 
 A `ProviderReference` is a `Record<string, string>` that maps provider names to

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -17,6 +17,11 @@ To prevent that, the SDK validates every response-supplied URL before fetching
 it. This happens automatically inside the provider packages — you don't need to
 configure anything.
 
+For authenticated task-status polling, providers can construct the first URL
+from the configured API endpoint. The SDK trusts that configured origin for the
+initial request, but manually follows and validates every redirect away from it.
+MiniMax, Kling AI, and ByteDance video polling use this protected path.
+
 ## What the SDK protects against
 
 When the SDK fetches a URL taken from a provider response, it:
@@ -45,7 +50,8 @@ A blocked URL surfaces as a `DownloadError`.
 URLs that are same-origin with the provider endpoint **you configured** (e.g. a
 custom `baseURL` pointing at a self-hosted or `localhost` deployment) are
 exempt from these checks — they target exactly the host you told the SDK to
-talk to. Any redirect off that origin is still validated.
+talk to. This also applies to task-status polling. Any redirect off that origin
+is still validated before the redirected request is sent.
 
 ## DNS validation across runtimes
 

package/docs/07-reference/01-ai-sdk-core/14-upload-file.mdx

@@ -39,22 +39,35 @@ const { providerReference } = await uploadFile({
     },
     {
       name: 'data',
-      type: 'DataContent',
+      type: 'DataContent | { type: "stream"; stream: ReadableStream<Uint8Array> }',
       description:
-        'The file data to upload. Can be a `Uint8Array`, a base64-encoded string, an `ArrayBuffer`, or a `Buffer`. URLs are not supported — fetch the content first and pass the bytes.',
+        'The file data to upload. Can be a `Uint8Array`, a base64-encoded string, an `ArrayBuffer`, a `Buffer`, or a tagged `{ type: "stream", stream }` shape for providers that support streaming uploads (sent without buffering; other providers reject with an `UnsupportedFunctionalityError`). The provider consumes the stream — any failed upload (including validation failures before a request is made) cancels it, and it must not be reused. URLs are not supported — fetch the content first and pass the bytes.',
     },
     {
       name: 'mediaType',
       type: 'string',
       isOptional: true,
       description:
-        'IANA media type of the file (e.g. `image/png`, `application/pdf`). Auto-detected from the file bytes if not provided.',
+        'IANA media type of the file (e.g. `image/png`, `application/pdf`). Auto-detected from the file bytes if not provided; stream data cannot be sniffed and defaults to `application/octet-stream`.',
     },
     {
       name: 'filename',
       type: 'string',
       isOptional: true,
-      description: 'Filename for the uploaded file.',
+      description:
+        'Filename for the uploaded file. Multipart-based providers default it to `"blob"` when omitted.',
+    },
+    {
+      name: 'abortSignal',
+      type: 'AbortSignal',
+      isOptional: true,
+      description: 'Signal to cancel the upload.',
+    },
+    {
+      name: 'headers',
+      type: 'Record<string, string>',
+      isOptional: true,
+      description: 'Additional HTTP headers to send with the request.',
     },
     {
       name: 'providerOptions',
@@ -76,6 +89,26 @@ const { providerReference } = await uploadFile({
       description:
         'A `Record<string, string>` mapping provider names to provider-specific file identifiers. Pass this as the `data` or `image` field in message content parts.',
     },
+    {
+      name: 'byteSize',
+      type: 'number',
+      isOptional: true,
+      description:
+        'Size of the uploaded file in bytes, if reported by the provider.',
+    },
+    {
+      name: 'createdAt',
+      type: 'Date',
+      isOptional: true,
+      description: 'When the file was created, if reported by the provider.',
+    },
+    {
+      name: 'expiresAt',
+      type: 'Date',
+      isOptional: true,
+      description:
+        'When the provider will delete the file (retention expiry, e.g. from a requested upload TTL), if reported by the provider.',
+    },
     {
       name: 'providerMetadata',
       type: 'ProviderMetadata',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.88",
+  "version": "7.0.90",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.70",
-    "@ai-sdk/provider": "4.0.9",
-    "@ai-sdk/provider-utils": "5.0.34"
+    "@ai-sdk/gateway": "4.0.72",
+    "@ai-sdk/provider": "4.0.10",
+    "@ai-sdk/provider-utils": "5.0.36"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.70",
-    "@ai-sdk/deepseek": "3.0.37",
-    "@ai-sdk/google": "4.0.60",
-    "@ai-sdk/groq": "4.0.35",
-    "@ai-sdk/huggingface": "2.0.41",
-    "@ai-sdk/moonshotai": "3.0.43",
-    "@ai-sdk/openai": "4.0.54",
+    "@ai-sdk/amazon-bedrock": "5.0.72",
+    "@ai-sdk/deepseek": "3.0.39",
+    "@ai-sdk/google": "4.0.62",
+    "@ai-sdk/groq": "4.0.37",
+    "@ai-sdk/huggingface": "2.0.43",
+    "@ai-sdk/moonshotai": "3.0.45",
+    "@ai-sdk/openai": "4.0.56",
     "@ai-sdk/test-server": "2.0.1",
-    "@ai-sdk/xai": "4.0.51",
+    "@ai-sdk/xai": "4.0.53",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",

package/src/upload-file/upload-file-result.ts

@@ -6,6 +6,18 @@ export interface UploadFileResult {
   readonly providerReference: ProviderReference;
   readonly mediaType?: string;
   readonly filename?: string;
+  /**
+   * The size of the uploaded file in bytes, if reported by the provider.
+   */
+  readonly byteSize?: number;
+  /**
+   * When the file was created, if reported by the provider.
+   */
+  readonly createdAt?: Date;
+  /**
+   * When the provider will delete the file (retention expiry), if reported.
+   */
+  readonly expiresAt?: Date;
   readonly providerMetadata?: ProviderMetadata;
   readonly warnings: Array<Warning>;
 }

package/src/upload-file/upload-file.ts

@@ -16,19 +16,31 @@ import type { UploadFileResult } from './upload-file-result';
  * Uploads a file using a files API interface.
  *
  * @param api - The Files API interface to use for uploading.
- * @param data - The file data to upload (tagged `{ type: 'data' | 'text' }`).
+ * @param data - The file data to upload (tagged `{ type: 'data' | 'text' | 'stream' }`).
+ * Stream data is sent without buffering by providers that support streaming
+ * uploads (others reject with `UnsupportedFunctionalityError`); the provider
+ * consumes the stream — any failed upload, including validation failures
+ * before a request is made, cancels it. Do not reuse it.
  * @param mediaType - Optional IANA media type. Auto-detected from file bytes
- * when omitted (falls back to `text/plain` for the `text` variant).
- * @param filename - Optional filename for the uploaded file.
+ * when omitted (falls back to `text/plain` for the `text` variant and
+ * `application/octet-stream` for the `stream` variant, which cannot be sniffed).
+ * @param filename - Optional filename for the uploaded file. Multipart-based
+ * providers default it to `"blob"` when omitted.
+ * @param abortSignal - Optional signal to cancel the upload.
+ * @param headers - Optional additional HTTP headers for the request.
  * @param providerOptions - Additional provider-specific options.
  *
- * @returns A result object containing the provider reference and optional metadata.
+ * @returns A result object containing the provider reference, optional
+ * metadata, and — when reported by the provider — `byteSize`, `createdAt`,
+ * and `expiresAt` (the provider-applied retention expiry).
  */
 export async function uploadFile({
   api,
   data: dataArg,
   mediaType: mediaTypeArg,
   filename,
+  abortSignal,
+  headers,
   providerOptions,
 }: {
   /**
@@ -54,35 +66,55 @@ export async function uploadFile({
       ? { type: 'data', data: dataArg }
       : dataArg;
 
+  // stream data cannot be sniffed without consuming it
   const mediaType =
     mediaTypeArg ??
     (data.type === 'text'
       ? 'text/plain'
-      : (detectMediaType({ data: data.data }) ??
-        (isLikelyText(data.data) ? 'text/plain' : 'application/octet-stream')));
+      : data.type === 'stream'
+        ? 'application/octet-stream'
+        : (detectMediaType({ data: data.data }) ??
+          (isLikelyText(data.data)
+            ? 'text/plain'
+            : 'application/octet-stream')));
 
-  const filesApi: FilesV4 =
-    'uploadFile' in api
-      ? api
-      : typeof api.files === 'function'
-        ? api.files()
-        : (() => {
-            throw new Error(
-              'The provider does not support file uploads. Make sure it exposes a files() method.',
-            );
-          })();
+  let result;
+  try {
+    const filesApi: FilesV4 =
+      'uploadFile' in api
+        ? api
+        : typeof api.files === 'function'
+          ? api.files()
+          : (() => {
+              throw new Error(
+                'The provider does not support file uploads. Make sure it exposes a files() method.',
+              );
+            })();
 
-  const result = await filesApi.uploadFile({
-    data,
-    mediaType,
-    filename,
-    providerOptions,
-  });
+    result = await filesApi.uploadFile({
+      data,
+      mediaType,
+      filename,
+      abortSignal,
+      headers,
+      providerOptions,
+    });
+  } catch (error) {
+    // ownership guarantee: a failed upload releases the stream, even when
+    // the provider rejected before (or without) consuming it
+    if (data.type === 'stream') {
+      await data.stream.cancel(error).catch(() => {});
+    }
+    throw error;
+  }
 
   return new DefaultUploadFileResult({
     providerReference: result.providerReference,
     mediaType: result.mediaType,
     filename: result.filename,
+    byteSize: result.byteSize,
+    createdAt: result.createdAt,
+    expiresAt: result.expiresAt,
     providerMetadata: result.providerMetadata,
     warnings: result.warnings,
   });
@@ -92,6 +124,9 @@ class DefaultUploadFileResult implements UploadFileResult {
   readonly providerReference: ProviderReference;
   readonly mediaType?: string;
   readonly filename?: string;
+  readonly byteSize?: number;
+  readonly createdAt?: Date;
+  readonly expiresAt?: Date;
   readonly providerMetadata?: ProviderMetadata;
   readonly warnings: Array<Warning>;
 
@@ -99,12 +134,18 @@ class DefaultUploadFileResult implements UploadFileResult {
     providerReference: ProviderReference;
     mediaType?: string;
     filename?: string;
+    byteSize?: number;
+    createdAt?: Date;
+    expiresAt?: Date;
     providerMetadata?: ProviderMetadata;
     warnings: Array<Warning>;
   }) {
     this.providerReference = options.providerReference;
     this.mediaType = options.mediaType;
     this.filename = options.filename;
+    this.byteSize = options.byteSize;
+    this.createdAt = options.createdAt;
+    this.expiresAt = options.expiresAt;
     this.providerMetadata = options.providerMetadata;
     this.warnings = options.warnings;
   }