Vercel AI SDK 5.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover Vercel AI SDK 5.0 provider configuration, prompts, tool calling, multi-step loops, object generation, chat UI streaming, persistence, MCP, and observability.

Providers, models, and call budgets

• Resolve provider instances, model IDs, API keys, base URLs, and request headers from server configuration, never from a chat request payload.
• Keep provider and gateway credentials out of client bundles, DefaultChatTransport headers, and any browser-side body callback.
• Allowlist the model IDs and providerOptions a caller may reach instead of forwarding a caller-built settings object into a generation call.
• Set maxOutputTokens explicitly, because 5.0 applies no output ceiling of its own and cost scales with whatever the model emits.
• Bound every call with an abortSignal, typically AbortSignal.timeout, since 5.0 has no timeout setting and maxRetries defaults to 2.
• Set temperature deliberately for security-relevant classification, because 5.0 no longer defaults temperature to zero.
• Treat an abort as a cancellation request, and do not assume a client disconnect stops server-side generation; reconcile provider spend and started side effects separately.

Prompts, messages, and validation

• Keep system instructions in server code and never let a client-supplied UIMessage part extend or replace them.
• Run validateUIMessages or safeValidateUIMessages with explicit tools, metadataSchema, and dataSchemas before convertToModelMessages, and treat it as structural