I argued last week that an AI SDK call with no bounds is three CWEs in one missing config object . Fair question back: does anyone actually ship that? So I linted for it. 20,004 source files across 14 public repositories, 474 of which import the Vercel AI SDK, 116 of which contain a real generation call . That 116 is the denominator; everything below is a fraction of it. Bound Files missing it Repositories output cap ( maxOutputTokens ) 103 / 116 12 of 14 ...