ai
The AI Toolkit for TypeScript. From the creators of Next.js, the AI SDK is a free open-source library for building AI-powered applications and agents
by vercelTypeScript
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&s=144)
Commit activity
Last 12 weeks · 888 commits
Community health
5 of 6 standards met
87
✓README✓License✓Contributing✓Code of Conduct○Issue Template✓PR Template
Recent PRs & issues
Active · Last activity 9m ago
See all on GitHub →
Description Summary:** 's error schema discards , which is the only place Gemini reports its retry delay. Callers who schedule their own retries therefore cannot read the provider's suggested delay off the typed , and the SDK's own retry layer has nothing to read either. Background Gemini returns 429 without a header. It reports the delay in the JSON body as a entry under : The problem is a plain (non-) Zod object covering only , , and : Zod strips unknown keys, so is dropped before attaches the parsed value as . Two consequences: 1. The retry-header support added in #7247 reads / . Gemini sends neither, so always falls back to exponential backoff even when the API said exactly how long to wait. 2. Callers who do their own scheduling — durable workflow engines, job queues, anything that must hand a delay to an external scheduler rather than block a process — cannot obtain the value from the typed error. This is the same gap raised in #5018 for headers ("the error types themselves don't expose the header value to callers implementing custom retry logic"), but for Google it is worse: there is no header to re-parse in the first place. Current behaviour never contains , regardless of what the API returned: Workaround (works today, but shouldn't be necessary) retains the full raw body, so the delay is recoverable by re-parsing a payload the SDK already parsed: That means going around the typed field and hand-parsing an untyped body, which is easy to get subtly wrong. Expected behaviour Preserve so it reaches . Minimal, backward-compatible change: Going further (optional, and a larger change): could surface the delay to the retry layer the way is surfaced for other providers, so honours it automatically. Google's own Python SDK has the same request open — googleapis/python-genai#1875. Preserving alone would already unblock every caller doing custom scheduling, without waiting on the retry-API design discussion in #4842. Related #5018 — Respect header (header-only; Gemini sends none) #7247 — Rate-limit header support (merged; nothing to read for Gemini) #4842 — Custom retry callback (open, no agreed API) Reproduction Runnable with a stub , no API key needed: Output: AI SDK Version ai: 5.0.118 @ai-sdk/google: 2.0.70 @ai-sdk/provider: 2.0.1 @ai-sdk/provider-utils: 3.0.23 on is unchanged, so current versions are affected too.
Summary Adds to all calls in the MCP OAuth client layer (). The OAuth layer currently relies on the Fetch API default redirect mode (). OAuth token and client registration requests carry sensitive credentials in the request body and must never be transparently forwarded to a different origin via a redirect. Per RFC 9700 / OAuth 2.1 BCP (§5.4, §5.5), clients should treat redirects on token endpoint requests as errors. The transport layer in the same codebase already fails closed on redirects: (L76) and (L45) both pass by default and are covered by tests. This change brings the OAuth layer to the same hardening standard. Changes (metadata discovery): pass (token exchange POST): pass (token refresh POST): pass (dynamic client registration POST): pass Testing No change in the non-redirect path (all call sites otherwise keep their existing options). Redirected responses now raise a fetch error instead of being silently followed. Existing test suites should pass unchanged; consider adding redirect-handling tests for the OAuth layer mirroring the transport-layer coverage.
Adds a community provider docs page at , following the structure of existing tool-based community pages (Supermemory, Nia). provides 13 AI SDK tools: real-time search across Google, YouTube, Reddit, Amazon, Walmart, TikTok and Instagram, plus , which reads any URL as clean Markdown, plain text or raw HTML. Docs-only change; no changeset needed. Updates since the first push: Rebased onto current . Renumbered from to , since is now taken by and . Documents all 13 tools (was 12), including the new , with a search-then-read example. Notes plainly that the package is a curated subset, and points at the MCP server or the JS SDK for the full API surface. Corrected the credit notes and the repository link. Note: the status check fails with a link, which is the preview deployment declining to build from a fork. Nothing in this PR affects it.
Recent fixes
This PR is fully authored by Opus 5 and Sonnet 5 using Claude Code harness. Here's a message from Opus regarding this change Root cause. matched catalog entries with flat equality only ( before this change): . That never inspects the separate field, so a compound id only ever matched a provider that happens to store the whole compound string as its own flat , which is what the routing proxies do. The id is not dropped, it resolves to the wrong provider. returns the full static catalog for every builtin provider with no credential filtering ( into ; the auth-filtered list is the separate , which this resolver never calls). registers its whole model table unconditionally, and that table contains an entry whose flat is literally . So for a user with only xai credentials: is false, the gateway-preference clause short-circuits, and the unrestricted returns the gateway entry, which registers ahead of . Pi then dispatches through a provider the user never configured and fails with "No API key found for vercel-ai-gateway". The fix is one new tier, and its position is the whole subtlety. Resolution order is now: 1. when gateway credentials are present, the flat match (pre-existing) 2. the new provider-scoped match: split on the first , then 3. the unrestricted flat match (pre-existing) The scoped tier deliberately sits after the gateway preference. Gateway and OpenRouter entries legitimately carry another provider's id verbatim as their own flat ( has an entry whose is literally , alongside the native entry with bare ), and when the user has gateway credentials, routing through the gateway is what they asked for. I originally placed the scoped tier first, which regressed exactly that case; the automated review on an earlier commit caught it, and the added tests now pin both directions. Why ordered tiers rather than one predicate. Folding the scoped check into the existing predicate would make a single return whichever entry sits earlier in the catalog array, so a proxy entry could beat the real one by array position. Separate tiers make the outcome deterministic. Two tests assert this in both catalog orderings. Why not delegate to Pi's own . It is a public export from and does the same slash-split, but adopting it would also replace the harness-specific preference tier, and it returns a richer result shape (//) that the adapter does not consume. This keeps the change inside the existing tier structure. Scope.** Matching logic only. #18155 makes an unresolved model id throw instead of being silently dropped; that is a different failure mode from this one (here the id resolves, just to the wrong provider), and it is left to that PR. #18147 and #18153 share the symptom but have a different root cause again ( registering credentials without corresponding catalog entries). No reproduction example was added under : the bug is pure catalog-matching logic covered by the unit tests, and reproducing it end to end would require live xai plus gateway credentials just to surface the symptom. Background I have pi authenticated with xai on my machine. Passing to HarnessAgent apparently routed to vercel-ai-gateway, meanwhile is a valid pi's modelId (). For example is a valid expected syntax for grok-4.3 from xai provider. Summary Compound ids were only matched literally, against a provider's flat . That happens to work for routing proxies like , which store the compound string as their own id, but never for a native provider like , whose entry is + . So silently landed on the gateway entry instead. Added provider-scoped matching so these resolve to the provider the id actually names. End-to-End Verification Added unit tests in for compound and resolution, the gateway and scoped tiers against each other in both catalog orderings, and fallthrough to flat matching. (packages/harness-pi): 126 tests passed. (root): passed. oxfmt and oxlint: clean on both changed files. Checklist [x] All commits are signed (PRs with unsigned commits cannot be merged) [x] Tests have been added / updated (for bug fixes / features) [ ] Documentation has been added / updated (for bug fixes / features) [x] A _patch_ changeset for relevant packages has been added (for bug fixes / features - run in the project root) [x] I have reviewed this pull request (self-review) Related Issues Related to #18155, #18147, #18153 (see the collapsed summary above for how each relates).
Structured data for AI agents
Repository: vercel/ai. Description: The AI Toolkit for TypeScript. From the creators of Next.js, the AI SDK is a free open-source library for building AI-powered applications and agents Stars: 26121, Forks: 4937. Primary language: TypeScript. Languages: TypeScript (82.2%), MDX (17.2%), JavaScript (0.4%), Vue (0%), CSS (0%). Homepage: https://ai-sdk.dev Topics: anthropic, artificial-intelligence, gemini, generative-ai, generative-ui, javascript, language-model, llm, nextjs, openai, react, svelte, typescript, vercel, vue. Latest release: @ai-sdk/xai@3.0.116 (7h ago). Open PRs: 100, open issues: 1654. Last activity: 9m ago. Community health: 87%. Top contributors: lgrammel, github-actions[bot], gr2m, nicoalbanese, aayush-kapoor, shaper, dancer, felixarntz, jaredpalmer, samdenty and others.