feat(runtime): adopt Open Responses extension codecs for DeepSeek tools

[me2seeks]

Summary

@ai-sdk/open-responses@2.0.35 now exposes the experimental extension-codec seam implemented by vercel/ai#18900 for vercel/ai#18899. Maka currently remains on 2.0.29 and fails closed for provider-executed tool replay and DeepSeek hosted web search.

Proposed scope

• Upgrade @ai-sdk/open-responses to 2.0.35.
• Register the DeepSeek tool, item, and streaming-event codecs supported by its wire contract.
• Preserve provider-executed call/result ordering and opaque replay data across later requests.
• Enable only capabilities proven by request, response, stream, and replay tests.
• Keep unsupported or non-namespaced DeepSeek extensions disabled rather than passing unknown JSON through.

Acceptance checks

• Mixed client and provider-executed tools retain execution ownership and chronology.
• Non-streaming and streaming hosted-tool results finish normally without entering the client tool loop.
• A later request replays each supported provider item exactly once.
• Unregistered or incompatible provider tools remain fail-closed with an explicit warning.
• Existing OpenAI and generic Open Responses behavior remains unchanged.

Follow-up to #2513 and #2972.

Upstream: vercel/ai#18899, vercel/ai#18900.

[me2seeks]

I’m working on this.

[me2seeks]

Implementation plan after two independent reviews:

1. PR A — dependency baseline only

   • Upgrade @ai-sdk/open-responses to 2.0.35 and refresh the lockfile/notices.
   • Add focused contract coverage for the new experimental registry boundary.
   • Keep DeepSeek hosted search and provider-executed replay fail-closed. No behavior activation.

2. Upstream — explicit safe bare-type registration

   • DeepSeek documents bare web_search, web_search_call, custom_tool_call, and related SSE events, while 2.0.35 accepts only matching <namespace>:<type> registrations.
   • Propose an explicit, allowlisted bare/legacy type seam upstream. Unknown JSON must remain rejected; no generic passthrough.

3. PR B — provider-owned DeepSeek codec

   • After an upstream release provides that seam, register one DeepSeek codec at the model/provider construction boundary.
   • Cover request encoding, non-stream decoding, stream decoding, and exact-once history replay.
   • Do not activate product capability yet.

4. PR C — capability activation

   • Derive hosted-search and provider-executed replay readiness from the same codec capability rather than adapter-wide booleans.
   • Enable only the verified DeepSeek model/wire combinations and remove the corresponding fail-closed paths.

apply_patch remains a later independent slice because its client-executed custom-tool lifecycle differs from provider-hosted WebSearch.

Every PR may contain multiple commits but requires two independent reviews against its exact head:

• correctness review: exact request/response/SSE/replay chronology, ownership, finish semantics, and failure paths;
• architecture review: single codec authority, provider isolation, dependency scope, and no fetch-body/response mutation layer.

Any review fix triggers validation and both reviews again before publication.

[me2seeks]

Upstream prerequisite filed as vercel/ai#19933. It is intentionally generic: explicit codecs for exact documented bare extension discriminators, while unknown JSON remains fail-closed. This is distinct from arbitrary provider-tool passthrough in vercel/ai#10771.