Download

Namespace: Vercel.AI.Util

public static class Download

Downloads a URL with SSRF checks on every redirect hop.

Inheritance: object

View source

Fields

DefaultMaxBytes

public const long DefaultMaxBytes = 2147483648

Default maximum download size: 2 GiB.

Value: long

View source

Properties

Fetch

public static DownloadFetch? Fetch { get; set; }

Fetch used when a call does not pass its own. Read on each download so a replacement is picked up immediately.

Value: DownloadFetch

View source

IsBrowser

public static bool IsBrowser { get; set; }

When true, an opaque redirect is followed natively. Server runtimes leave this false and fail closed.

Value: bool

View source

UserAgent

public static string? UserAgent { get; set; }

User-Agent suffix sent on download requests.

Value: string

View source

Methods

FetchWithValidatedEndpointAsync(string, DownloadRequest?, DownloadFetch?, string?, string)

public static Task<DownloadResponse> FetchWithValidatedEndpointAsync(string url, DownloadRequest? request = null, DownloadFetch? fetch = null, string? trustedOrigin = null, string redirect = "error")

Fetches one validated URL without following redirects. A redirect is rejected by default (error). A caller that passes manual must validate the Location target before it requests another URL.

Parameters

Name	Type	Description
`url`	string	URL to request.
`request`	DownloadRequest	Method, headers, body, and cancellation signal. Its Redirect is replaced by <code class=“paramref”>redirect</code>.
`fetch`	DownloadFetch	Fetch used for the request. Defaults to Fetch, then the built-in fetch.
`trustedOrigin`	string	A developer-configured origin whose requests skip validation. Never derive it from response data.
`redirect`	string	`error` or `manual`.

Returns: Task<DownloadResponse>

Exceptions

Type	Condition
DownloadError	The URL is unsafe.

View source

FetchWithValidatedRedirectsAsync(string, HeaderCollection?, CancellationToken, int, DownloadFetch?, string?)

public static Task<DownloadResponse> FetchWithValidatedRedirectsAsync(string url, HeaderCollection? headers = null, CancellationToken abortSignal = default, int maxRedirects = 10, DownloadFetch? fetch = null, string? trustedOrigin = null)

Fetches a URL and validates every hop with ValidateDownloadUrl(string) before it is requested. Redirects are followed one hop at a time. All caller headers except user-agent are dropped on a redirect that crosses origin. Each hop gets its own copy of the headers.

Parameters

Name	Type	Description
`url`	string	First URL to request.
`headers`	HeaderCollection	Request headers, or `null` to send none.
`abortSignal`	CancellationToken	Cancellation signal passed to every hop.
`maxRedirects`	int	Largest number of redirects to follow.
`fetch`	DownloadFetch	Fetch used for every hop. Defaults to Fetch, then the built-in fetch.
`trustedOrigin`	string	A developer-configured origin, such as a provider base URL, whose hops skip validation. Never derive it from response data.

Returns: Task<DownloadResponse> — The final response. The caller checks Ok and reads the body.

Exceptions

Type	Condition
DownloadError	A hop is unsafe, the redirect limit is exceeded, or a redirect cannot be validated.

View source

GetAsync(Uri, long?, CancellationToken, DownloadFetch?)

public static Task<DownloadResult> GetAsync(Uri url, long? maxBytes = null, CancellationToken abortSignal = default, DownloadFetch? fetch = null)

Downloads <code class=“paramref”>url</code>.

Parameters

Name	Type	Description
`url`	Uri
`maxBytes`	long?
`abortSignal`	CancellationToken
`fetch`	DownloadFetch

Returns: Task<DownloadResult>

View source

ValidateDownloadUrl(string)

public static void ValidateDownloadUrl(string url)

Throws DownloadError when <code class=“paramref”>url</code> is not safe to request.

Parameters

Name	Type	Description
`url`	string

View source