#272 build(deps): bump ai from 7.0.162 to 7.0.165

Sourced from ai's changelog.

7.0.165

Patch Changes

• 883fcde: remove transcription word timings from telemetry when recordOutputs is false
• 6d21e8e: Sanitize provider request URLs before text generation results reach telemetry integrations and tracing subscribers, preventing endpoint credentials from being exposed.
• Updated dependencies [6400cf8]
• Updated dependencies [f608c05]
• Updated dependencies [cab9c1f]
• Updated dependencies [c70adf6]
  • @​ai-sdk/provider-utils@​5.0.76
  • @​ai-sdk/provider@​4.0.37
  • @​ai-sdk/gateway@​4.0.138

7.0.164

Patch Changes

• Updated dependencies [bace553]
• Updated dependencies [6737c77]
• Updated dependencies [bb4e2d0]
  • @​ai-sdk/gateway@​4.0.137

7.0.163

Patch Changes

• 5d18351: fix(ai): detect downloaded audio types from bytes when servers return a generic or non-audio content type such as application/octet-stream

• 8da48db: Respect recordInputs and recordOutputs when delivering telemetry events to integrations and the ai:telemetry channel. Filter nested content and omit raw span results when content recording is disabled, while preserving application results.

• fd7e8a7: Preserve the order of text and complete function calls in streamed Google responses, including standalone thought signatures on empty text or reasoning parts.

  Keep provider metadata on empty text parts when converting results to response messages so it can be passed back in subsequent requests.

  Omit foreign-provider empty signature text when replaying history through Anthropic or Bedrock, preserving Bedrock’s existing native reasoning-history handling.

• 36802d4: Support native URL transcription with an optional provider capability, keeping existing file-generation contracts unchanged. Groq sends HTTP(S) audio URLs through its url parameter without downloading and re-uploading them, avoiding the attachment upload limit. Supplying a custom download function retains local download behavior.

  For telemetry integrations, TranscriptionEndEvent.audio.byteLength and audio.mediaType can now be undefined when a provider fetches the audio URL natively. Check for missing values before using them as a number or string. Downloaded and inline audio continue to report their metadata; streaming transcription metadata is unchanged.

  Strip media fragments before sending URLs to Groq. If Groq rejects a redirect, fall back to the existing secure local downloader and file upload rather than failing previously working URL inputs. Other provider errors are preserved.

• 933dae3: fix (ai): download deprecated file-url and image-url tool result content

  Tool result content parts that use the deprecated file-url and image-url types were converted to file parts with { type: 'url' } data, but they were never passed to the download function. When the model does not support the URL, the provider received a bare URL instead of the file contents, even though the replacement file part with { type: 'url' } data was downloaded and inlined.

  Downloaded legacy URL parts now use the same media type normalization as file

... (truncated)

• 0f3a85f Version Packages (#24672)
• 6d21e8e fix(ai): sanitize request URLs before telemetry observes provider results (#2...
• f608c05 fix(provider-utils): reject HTTPS download downgrades (#24680)
• 883fcde fix(ai): hide transcription words from telemetry when recordOutputs is false ...
• c70adf6 fix(typesafe-ai): align decision API with OpenAPI (#24627)
• 9ae0c49 Version Packages (#24580)
• 68a5001 chore(tsconfig): centralize lib option in base config (#24558)
• bdc3f91 Version Packages (#24424)
• 892af4d feat (provider): server-side realtime extensions for RealtimeModelV4 (#16137)
• 9754014 feat(anthropic): forward streaming ping events by introducing new stream part...
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)