Vercel AI SDK 7.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover Vercel AI SDK 7.0 providers, generation, streaming, tools, structured output, UI messages, persistence, retrieval, and operations.

Providers and configuration

• Construct provider instances, model IDs, credentials, base URLs, headers, and provider options from trusted server configuration.
• Keep provider keys out of client components, browser hooks, public environment variables, UI messages, and stream data parts.
• Allowlist model IDs, provider options, modalities, and output limits instead of accepting a caller-built settings object.
• Set maxRetries explicitly when the SDK default of 2 is unsuitable and count every retry against per-principal spend.
• Pass timeout as totalMs/stepMs plus an abort signal; neither cancellation nor a UI disconnect proves provider-side work stopped.

Generation and instruction boundaries

• Keep system instructions in server code and convert user UI messages into model messages only after validating allowed roles and parts.
• Call validateUIMessages with the expected schemas, but treat it as structural validation only; it performs no user or resource authorization.
• Bound message/history count, attachments, data parts, media bytes, input, output, and reasoning budget before generateText or streamText.
• Apply the baseline URL policy to attachment and tool-result URLs before model conversion; experimental_download can fetch them or forward them to the provider, and custom downloads need their own deadline and byte limits.
• Inspect finish reason