@ai-sdk/provider-utils

b089ce8: Block .internal hostnames in download URL validation.

39a776b: Add a shared encodePathSegment helper and use it to encode provider-returned identifiers in credentialed follow-up request paths.

0c2a9de: Add maxOutputTokens and reasoning to experimental decision calls and forward them to language-model-backed decisions. Language-model adapters keep reasoning disabled when omitted. Native decision providers warn when either setting is unsupported.

200c47f: Avoid retaining oversized backing buffers when reading response bodies, reducing memory usage for responses delivered in small chunks on runtimes such as Deno.

0957554: Add box decision question type with image bounds for TypeSafe AI.

2e89fa4: fix(provider-utils): keep case-sensitive url paths and query values

9667bf2: docs(provider-utils): clarify how ToolApprovalResponse.reason is handled for approved and denied tool calls

81663cc: fix(provider-utils): accept exact criteria labels in decision choice responses

9184a35: Add ordered text, file, and JSON parts to experimental decision state. Support image input in OpenAI Decisions and language model adapters. Gateway retains its existing string and JSON request format and rejects files, as does TypeSafe AI.

Arrays passed directly as state now contain decision state parts. Wrap JSON arrays in an object or a json part.

Normalize all public state forms into an array of parts before calling decision providers. Providers receive text and JSON objects as text and json parts.

Serialize decision file bytes as base64 in OpenTelemetry state attributes. Model-call spans record normalized state parts, while outer spans retain public state inputs.

Preserve native JSON state in TypeSafe AI when state contains one JSON part. Label shared state in language-model decision prompts.

fc1e19e: fix: limit jsonl rows to 64mb during batch result downloads

5094ebd: fix(provider-utils): preserve parallel tool calls when stream labels are missing or reused

268225c: feat(provider): add a portable max reasoning level with native provider mappings, compatibility coercions, and budget-based fallback support.

Compatibility notes:

Release classification: This remains a patch changeset under the repository's explicit release policy, which uses patch releases for both fixes and features. The TypeScript source-compatibility caveat for exhaustive consumers is disclosed above. Maintainers can override this classification with a major label if they decide to align the provider-spec addition with a future AI SDK major release.

2959d35: feat: rename evaluate to decide

59116e6: fix(groq,google): use JSON response tool for structured outputs with tool calling

8c65988: feat(ai): add telemetry to speech generation and transcription, including provider usage propagation and experimental streaming lifecycle callbacks

527a163: fix: validate hostname parts using isValidHostnamePart

ede5b89: chore: migrate package builds from tsup to tsdown

c2511c1: fix: use standards-compliant User-Agent header

e3605f6: Fix streamed tool calls with missing, blank, or repeated IDs.

af9597b: Compile packages for ES2022 runtime target

bc49f78: Preserve original opaque URI strings in tagged file URLs during prompt conversion. Match explicit supported URL MIME types exactly so unsupported subtypes are not forwarded to providers.

fe07867: Fix Google embedMany calls with more than 100 values by keeping per-value multimodal content aligned across automatic batches, including text-only entries. Validate content length before sending requests and validate each batch's provider options after middleware transforms them.

a4b0940: fix(ai): execute manually approved tool inputs produced by schema transforms

Preserve approved inputs during revalidation and reject histories whose reconstructed schema output differs, including signed approvals with missing original input. Validate transformed UI tool inputs against the reconstructed output before returning them as static tool parts.

771e74b: chore: enable dead code lint rules

2973485: fix(provider-utils): detect AVIF and HEIC images with variable ftyp box sizes

a4db5ea: fix(provider-utils): detect AAC audio with ADTS headers

2937ea2: fix(provider-utils): follow validated redirects without waiting for response clone cancellation

0455398: fix(provider-utils): make lazy Undici import visible to deployment tracers

215b25e: Default language-model evaluation adapters to reasoning: 'none', using each provider's existing reasoning mapping. Explicit reasoning settings in providerOptions continue to override the default.

d4d96bf: Add experimental Choice, Score, and Boolean evaluations through openai.evaluationModel() and a shared structured language-model evaluation adapter in @ai-sdk/provider-utils/experimental-evaluation. Preserve exact labels and metadata, validate score bounds, and return prompted Boolean P(true) estimates validated to be in [0, 1]. Boolean estimates are not guaranteed to be calibrated; application code chooses thresholds.

3456e2c: feat(ai): support tool search with direct tool calling

91c2128: feat(ai): add mid conversation tool discovery/updates for code-mode

2cd80b3: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.

2fa5e0e: fix(provider-utils): avoid crashing when DOMException is not a global constructor

c43e4b7: fix(mcp): prevent SSRF in OAuth metadata discovery

813bb36: fix(provider-utils): avoid detecting plain text prefixes as BMP or GIF images

9e1d1b2: chore(provider-utils): fix test that can timeout

a495511: fix(provider-utils): avoid excessive memory usage when base64 encoding byte arrays

6bcc0f8: Update Undici to a version patched for CVE-2026-13697.

5190b67: feat(provider): extend the FilesV4 interface with optional getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSignal/headers call options and a { type: 'stream' } upload data variant; upload results now expose byteSize, createdAt, and expiresAt (also surfaced by the core uploadFile() helper, which now forwards abortSignal/headers); add postMultipartStreamToApi (streaming multipart uploads with deterministic part ordering and failure-path stream teardown), deleteFromApi, and createBinaryStreamResponseHandler to provider-utils

90192f1: Mark transient network errors that occur while reading successful response bodies as retryable.

3e125ba: Allow manual tool approval statuses to include a reason and preserve it across core, model, and UI approval requests. OPA requires-approval decisions now surface their reason to human approvers. UI request chunks serialize the optional reason, while UI messages retain it as approval.requestReason separately from an approver's response reason.

b74971f: Preserve schema-valued additional properties when converting Zod 4 schemas.

e6087c9: fix: handle empty string tool call IDs

7fbfc6d: Preserve streamed download size-limit errors when response cancellation fails.

401a4ba: fix(provider-utils): allow imports in runtimes without a global fetch function

81cd026: Reduce bundle size by making internal Zod v4 imports tree-shakeable.

1937bef: fix(provider-utils): make URL regex checks stateless

2b60826: feat(provider-utils): support Blob request bodies in postToApi

1bec07d: Fix streamed tool calls with non-zero, non-contiguous, reused, or missing indexes.

160ccdb: Reduce bundle size by removing the runtime Zod 3 dependency.

5fc7da5: chore: centralize empty language model usage creation in provider utilities.

93b2acd: chore: centralize response metadata conversion

fa95504: feat(ai): support experimental tool callers in ToolLoopAgent

d8210b6: chore: centralize record type guards in provider-utils

b192878: feat: add experimental_toolCaller routing to generateText for code mode

1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.

6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.

0c464d9: feat(provider-utils): add a typed serialization error

c49380c: feat: add experimental streaming speech translation models (openai.translation('gpt-realtime-translate') over the OpenAI Realtime translations WebSocket and google.translation('gemini-3.5-live-translate-preview') over the Gemini Live API). connectToWebSocket in @ai-sdk/provider-utils now passes close code and reason to onClose (additive, optional parameter).