Upgrade AI SDK to v7 with Vercel OIDC authentication support

[erulkey]

Summary

• upgrade ai from 5.0.51 to 7.0.34
• require Node.js 22 locally and in PR checks, matching AI SDK v7's runtime requirement
• remove the three AI_GATEWAY_API_KEY-only preflight checks so AI Gateway can use Vercel's request-scoped OIDC authentication
• update the three stale AI SDK version comments

This deliberately uses 7.0.34 rather than the hours-old 7.0.42 because the repository's dependency release-age policy rejected the latter. The policy was not weakened.

Evidence

Executed on this branch:

• pnpm install --frozen-lockfile — passed with pnpm 9.15.9
• pnpm type-check — passed
• pnpm lint — passed with 0 errors and 24 existing warnings
• pnpm format:check — passed
• pnpm build — passed; existing shiki externalization and baseline-browser-data warnings remain
• live AI Gateway smoke test with AI_GATEWAY_API_KEY explicitly removed and an existing Vercel OIDC credential — title generation, branch-name generation, and commit-message generation all returned valid results

Observed live results:

{
  "auth": "OIDC only",
  "title": "Add vercel sandbox browser test for create commit push",
  "branch": "feature/browser-smoke-test-vercel-sandbox-<random suffix>",
  "commit": "Add browser smoke-test to verify create, commit and push vercel sandbox"
}

References:

• AI Gateway authentication: https://vercel.com/docs/ai-gateway/authentication-and-byok
• Vercel OIDC runtime token behavior: https://vercel.com/docs/oidc/reference

Scope boundary

This PR does not remove PostgreSQL/Drizzle, redesign persistence, change OAuth, replace agent harnesses, or include the broader first-run experiments. Those are being isolated and require their own behavioral evidence before review.

[vercel]

You must have Developer access to commit code to Vercel Labs on Vercel. If you contact an administrator and receive Developer access, commit again to see your changes.

Learn more: https://vercel.com/docs/accounts/team-members-and-roles/access-roles#team-level-roles

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​ai@​7.0.34

View full report