Prioritize internal-whitespace baseURL validation

Co-authored-by: Eric Allam <eric@trigger.dev>

Author: cursoragent

.changeset/curly-radios-visit.md

@@ -10,5 +10,5 @@ Add a new `@trigger.dev/ai` package with:
 - reconnect-aware stream handling on top of Trigger.dev Realtime Streams v2
 - strict `baseURL` normalization/validation (trimming, path-safe slash handling, absolute `http(s)` URLs only, no query/hash/credentials)
 - rejection of internal whitespace characters in normalized `baseURL` values
-- deterministic baseURL validation error ordering for multi-issue inputs (protocol → query/hash → credentials)
+- deterministic baseURL validation error ordering for multi-issue inputs (internal whitespace → protocol → query/hash → credentials)
 - explicit default `baseURL` behavior (`https://api.trigger.dev`) and case-insensitive `HTTP(S)` protocol acceptance

docs/tasks/streams.mdx

@@ -683,12 +683,13 @@ Validation errors use these exact messages:
 - `baseURL must not include username or password credentials`
 
 When multiple issues are present, validation order is deterministic:
-protocol → query/hash → credentials.
+internal whitespace → protocol → query/hash → credentials.
 
 Examples of ordering:
 
 - `ftp://example.com?x=1` → `baseURL must use http or https protocol`
 - `https://user:pass@example.com?x=1` → `baseURL must not include query parameters or hash fragments`
+- `ftp://user:pass@example.com/in valid?x=1` → `baseURL must not contain internal whitespace characters`
 
 For richer TypeScript ergonomics in app code, `@trigger.dev/ai` also exports:
 

packages/ai/CHANGELOG.md

@@ -29,5 +29,5 @@
 - Added explicit validation that `baseURL` excludes internal whitespace characters.
 - Documented that `HTTP://` and `HTTPS://` are accepted (case-insensitive protocol matching).
 - Added deterministic validation ordering for multi-issue baseURL values
-  (protocol → query/hash → credentials).
+  (internal whitespace → protocol → query/hash → credentials).
 - Documented explicit default `baseURL` value (`https://api.trigger.dev`) when omitted.

packages/ai/README.md

@@ -190,12 +190,13 @@ Validation errors use these exact messages:
 - `baseURL must not include username or password credentials`
 
 When multiple issues are present, validation order is deterministic:
-protocol → query/hash → credentials.
+internal whitespace → protocol → query/hash → credentials.
 
 Examples of ordering:
 
 - `ftp://example.com?x=1` → `baseURL must use http or https protocol`
 - `https://user:pass@example.com?x=1` → `baseURL must not include query parameters or hash fragments`
+- `ftp://user:pass@example.com/in valid?x=1` → `baseURL must not contain internal whitespace characters`
 
 ## `ai.tool(...)` example
 

packages/ai/src/chatTransport.test.ts

@@ -874,6 +874,17 @@ describe("TriggerChatTransport", function () {
     }).toThrowError("baseURL must use http or https protocol");
   });
 
+  it("prioritizes internal-whitespace validation over protocol/query/hash/credential validation", function () {
+    expect(function () {
+      new TriggerChatTransport({
+        task: "chat-task",
+        accessToken: "pk_trigger",
+        baseURL: "ftp://user:pass@example.com/in valid?query=1#fragment",
+        stream: "chat-stream",
+      });
+    }).toThrowError("baseURL must not contain internal whitespace characters");
+  });
+
   it("prioritizes query/hash validation over credential validation", function () {
     expect(function () {
       new TriggerChatTransport({
@@ -3404,6 +3415,17 @@ describe("TriggerChatTransport", function () {
     }).toThrowError("baseURL must use http or https protocol");
   });
 
+  it("prioritizes internal-whitespace validation over protocol/query/hash/credential validation in factory", function () {
+    expect(function () {
+      createTriggerChatTransport({
+        task: "chat-task",
+        accessToken: "pk_trigger",
+        baseURL: "ftp://user:pass@example.com/in valid?query=1#fragment",
+        stream: "chat-stream",
+      });
+    }).toThrowError("baseURL must not contain internal whitespace characters");
+  });
+
   it("prioritizes query/hash validation over credential validation in factory", function () {
     expect(function () {
       createTriggerChatTransport({