ai 6.0.201 → 6.0.202

package/dist/internal/index.js

@@ -152,7 +152,7 @@ function detectMediaType({
 var import_provider_utils2 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "6.0.201" : "0.0.0-test";
+var VERSION = true ? "6.0.202" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/dist/internal/index.mjs

@@ -131,7 +131,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "6.0.201" : "0.0.0-test";
+var VERSION = true ? "6.0.202" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/docs/03-ai-sdk-core/16-mcp-tools.mdx

@@ -124,6 +124,38 @@ transports by providing an `authProvider`.
 
 </Note>
 
+### OAuth Authorization Server Validation
+
+When using MCP OAuth in server-side applications, the MCP server can advertise
+the OAuth authorization server to use. If you connect to MCP servers outside
+your control, implement `validateAuthorizationServerURL` on your
+`authProvider` to allow only the authorization server origins you trust:
+
+```typescript
+const allowedAuthorizationServerOrigins = new Set([
+  'https://accounts.example.com',
+  'https://tenant.auth0.com',
+]);
+
+const myOAuthClientProvider = {
+  // ...other OAuthClientProvider methods
+
+  validateAuthorizationServerURL(serverUrl, authorizationServerUrl) {
+    const origin = new URL(authorizationServerUrl).origin;
+
+    if (!allowedAuthorizationServerOrigins.has(origin)) {
+      throw new Error(
+        `Unexpected OAuth authorization server for ${serverUrl}: ${origin}`,
+      );
+    }
+  },
+};
+```
+
+This hook is called before the SDK fetches authorization server metadata, so a
+rejected URL is not requested. It is optional and does not change existing OAuth
+flows unless you implement it.
+
 ### Closing the MCP Client
 
 After initialization, you should close the MCP client based on your usage pattern:

package/docs/04-ai-sdk-ui/03-chatbot-message-persistence.mdx

@@ -40,6 +40,9 @@ import { existsSync, mkdirSync } from 'fs';
 import { writeFile } from 'fs/promises';
 import path from 'path';
 
+// Treat chat IDs as opaque tokens before using them in file paths.
+const chatIdRegex = /^[A-Za-z0-9_-]+$/;
+
 export async function createChat(): Promise<string> {
   const id = generateId(); // generate a unique chat ID
   await writeFile(getChatFile(id), '[]'); // create an empty chat file
@@ -47,12 +50,27 @@ export async function createChat(): Promise<string> {
 }
 
 function getChatFile(id: string): string {
-  const chatDir = path.join(process.cwd(), '.chats');
+  if (!chatIdRegex.test(id)) {
+    throw new Error('Invalid chat ID');
+  }
+
+  const chatDir = path.resolve(process.cwd(), '.chats');
+  const chatFile = path.resolve(chatDir, `${id}.json`);
+
+  // Defense in depth: keep the resolved file inside the chat directory.
+  if (!chatFile.startsWith(`${chatDir}${path.sep}`)) {
+    throw new Error('Invalid chat ID');
+  }
+
   if (!existsSync(chatDir)) mkdirSync(chatDir, { recursive: true });
-  return path.join(chatDir, `${id}.json`);
+  return chatFile;
 }
 ```
 
+The chat ID can come from the URL or the request body, so validate it as an
+opaque token before using it in a file path. The resolved path check ensures the
+file stays inside the intended `.chats` directory.
+
 ## Loading an existing chat
 
 When the user navigates to the chat page with a chat ID, we need to load the chat messages from storage.

package/docs/07-reference/01-ai-sdk-core/23-create-mcp-client.mdx

@@ -106,7 +106,7 @@ It currently does not support accepting notifications from an MCP server, and cu
                       type: 'OAuthClientProvider',
                       isOptional: true,
                       description:
-                        'Optional OAuth provider for authorization to access protected remote MCP servers.',
+                        'Optional OAuth provider for authorization to access protected remote MCP servers. Implement `validateAuthorizationServerURL` on the provider to allowlist discovered OAuth authorization server URLs before metadata is fetched.',
                     },
                     {
                       name: 'redirect',

package/docs/07-reference/05-ai-sdk-errors/ai-invalid-tool-approval-signature-error.mdx

@@ -0,0 +1,31 @@
+---
+title: AI_InvalidToolApprovalSignatureError
+description: Learn how to fix AI_InvalidToolApprovalSignatureError
+---
+
+# AI_InvalidToolApprovalSignatureError
+
+This error occurs when `experimental_toolApprovalSecret` is configured and a tool approval replayed from the message history has a missing or invalid HMAC signature. The server rejects the approval before the tool executes.
+
+Common causes:
+
+- The approval was fabricated by the client (no signature present)
+- The tool arguments were modified after the approval was signed
+- The server secret changed between issuance and verification (e.g. after key rotation without overlap)
+
+## Properties
+
+- `approvalId`: The approval ID that failed verification
+- `toolCallId`: The tool call ID the approval was for
+
+## Checking for this Error
+
+You can check if an error is an instance of `AI_InvalidToolApprovalSignatureError` using:
+
+```typescript
+import { InvalidToolApprovalSignatureError } from 'ai';
+
+if (InvalidToolApprovalSignatureError.isInstance(error)) {
+  // Handle the error
+}
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "6.0.201",
+  "version": "6.0.202",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -45,9 +45,9 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@ai-sdk/gateway": "3.0.127",
-    "@ai-sdk/provider": "3.0.10",
-    "@ai-sdk/provider-utils": "4.0.27"
+    "@ai-sdk/gateway": "3.0.128",
+    "@ai-sdk/provider-utils": "4.0.28",
+    "@ai-sdk/provider": "3.0.10"
   },
   "devDependencies": {
     "@edge-runtime/vm": "^5.0.0",
@@ -58,8 +58,8 @@
     "tsx": "^4.19.2",
     "typescript": "5.8.3",
     "zod": "3.25.76",
-    "@ai-sdk/test-server": "1.0.5",
-    "@vercel/ai-tsconfig": "0.0.0"
+    "@vercel/ai-tsconfig": "0.0.0",
+    "@ai-sdk/test-server": "1.0.5"
   },
   "peerDependencies": {
     "zod": "^3.25.76 || ^4.1.8"

package/src/error/index.ts

@@ -17,6 +17,7 @@ export {
 export { InvalidArgumentError } from './invalid-argument-error';
 export { InvalidStreamPartError } from './invalid-stream-part-error';
 export { InvalidToolApprovalError } from './invalid-tool-approval-error';
+export { InvalidToolApprovalSignatureError } from './invalid-tool-approval-signature-error';
 export { InvalidToolInputError } from './invalid-tool-input-error';
 export { ToolCallNotFoundForApprovalError } from './tool-call-not-found-for-approval-error';
 export { MissingToolResultsError } from './missing-tool-result-error';

package/src/error/invalid-tool-approval-signature-error.ts

@@ -0,0 +1,35 @@
+import { AISDKError } from '@ai-sdk/provider';
+
+const name = 'AI_InvalidToolApprovalSignatureError';
+const marker = `vercel.ai.error.${name}`;
+const symbol = Symbol.for(marker);
+
+export class InvalidToolApprovalSignatureError extends AISDKError {
+  private readonly [symbol] = true;
+
+  readonly approvalId: string;
+  readonly toolCallId: string;
+
+  constructor({
+    approvalId,
+    toolCallId,
+    reason,
+  }: {
+    approvalId: string;
+    toolCallId: string;
+    reason: string;
+  }) {
+    super({
+      name,
+      message: `Tool approval signature verification failed for approval "${approvalId}" (tool call "${toolCallId}"): ${reason}`,
+    });
+    this.approvalId = approvalId;
+    this.toolCallId = toolCallId;
+  }
+
+  static isInstance(
+    error: unknown,
+  ): error is InvalidToolApprovalSignatureError {
+    return AISDKError.hasMarker(error, marker);
+  }
+}

package/src/generate-text/generate-text.ts

@@ -69,6 +69,8 @@ import { extractTextContent } from './extract-text-content';
 import type { GenerateTextResult } from './generate-text-result';
 import { DefaultGeneratedFile } from './generated-file';
 import { isApprovalNeeded } from './is-approval-needed';
+import { maybeSignApproval } from './tool-approval-signature';
+import { validateApprovedToolApprovals } from './validate-tool-approvals';
 import { text, type Output } from './output';
 import type { InferCompleteOutput } from './output-utils';
 import { parseToolCall } from './parse-tool-call';
@@ -270,6 +272,7 @@ export async function generateText<
   experimental_repairToolCall: repairToolCall,
   experimental_download: download,
   experimental_context,
+  experimental_toolApprovalSecret,
   experimental_include: include,
   _internal: { generateId = originalGenerateId } = {},
   experimental_onStart: onStart,
@@ -411,6 +414,15 @@ export async function generateText<
      */
     experimental_context?: unknown;
 
+    /**
+     * Secret for HMAC-signing tool approval requests. When set, the server
+     * signs each approval request at issuance and verifies the signature when
+     * the approval is replayed, preventing client-forged approvals.
+     *
+     * Experimental (can break in patch releases).
+     */
+    experimental_toolApprovalSecret?: string | Uint8Array;
+
     /**
      * Settings for controlling what data is included in step results.
      * Disabling inclusion can help reduce memory usage when processing
@@ -548,12 +560,32 @@ export async function generateText<
         const initialMessages = initialPrompt.messages;
         const responseMessages: Array<ResponseMessage> = [];
 
-        const { approvedToolApprovals, deniedToolApprovals } =
-          collectToolApprovals<TOOLS>({ messages: initialMessages });
+        const {
+          approvedToolApprovals,
+          deniedToolApprovals: collectedDeniedToolApprovals,
+        } = collectToolApprovals<TOOLS>({ messages: initialMessages });
+
+        // Re-validate approvals reconstructed from the client-supplied message
+        // history before executing them: verify the HMAC signature (when a
+        // secret is configured), re-validate the input against the tool's
+        // schema, and re-resolve whether the tool requires approval.
+        const {
+          approvedToolApprovals: localApprovedToolApprovals,
+          deniedToolApprovals: revalidationDeniedToolApprovals,
+        } = await validateApprovedToolApprovals<TOOLS>({
+          approvedToolApprovals: approvedToolApprovals.filter(
+            toolApproval => !toolApproval.toolCall.providerExecuted,
+          ),
+          tools,
+          messages: initialMessages,
+          experimental_context,
+          toolApprovalSecret: experimental_toolApprovalSecret,
+        });
 
-        const localApprovedToolApprovals = approvedToolApprovals.filter(
-          toolApproval => !toolApproval.toolCall.providerExecuted,
-        );
+        const deniedToolApprovals = [
+          ...collectedDeniedToolApprovals,
+          ...revalidationDeniedToolApprovals,
+        ];
 
         if (
           deniedToolApprovals.length > 0 ||
@@ -926,10 +958,20 @@ export async function generateText<
                   experimental_context,
                 })
               ) {
+                const approvalId = generateId();
+                const signature = await maybeSignApproval({
+                  secret: experimental_toolApprovalSecret,
+                  approvalId,
+                  toolCallId: toolCall.toolCallId,
+                  toolName: toolCall.toolName,
+                  input: toolCall.input,
+                });
+
                 toolApprovalRequests[toolCall.toolCallId] = {
                   type: 'tool-approval-request',
-                  approvalId: generateId(),
+                  approvalId,
                   toolCall,
+                  ...(signature != null ? { signature } : {}),
                 };
               }
             }

package/src/generate-text/run-tools-transformation.ts

@@ -28,6 +28,7 @@ import {
   type GeneratedFile,
 } from './generated-file';
 import { isApprovalNeeded } from './is-approval-needed';
+import { maybeSignApproval } from './tool-approval-signature';
 import { parseToolCall } from './parse-tool-call';
 import type { ToolApprovalRequestOutput } from './tool-approval-request-output';
 import type { TypedToolCall } from './tool-call';
@@ -128,6 +129,7 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
   abortSignal,
   repairToolCall,
   experimental_context,
+  toolApprovalSecret,
   generateId,
   stepNumber,
   model,
@@ -143,6 +145,7 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
   abortSignal: AbortSignal | undefined;
   repairToolCall: ToolCallRepairFunction<TOOLS> | undefined;
   experimental_context: unknown;
+  toolApprovalSecret?: string | Uint8Array;
   generateId: IdGenerator;
   stepNumber?: number;
   model?: { provider: string; modelId: string };
@@ -328,10 +331,20 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
                 experimental_context,
               })
             ) {
+              const approvalId = generateId();
+              const signature = await maybeSignApproval({
+                secret: toolApprovalSecret,
+                approvalId,
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                input: toolCall.input,
+              });
+
               toolResultsStreamController!.enqueue({
                 type: 'tool-approval-request',
-                approvalId: generateId(),
+                approvalId,
                 toolCall,
+                ...(signature != null ? { signature } : {}),
               });
               break;
             }

package/src/generate-text/stream-text.ts

@@ -82,6 +82,7 @@ import { mergeObjects } from '../util/merge-objects';
 import { now as originalNow } from '../util/now';
 import { prepareRetries } from '../util/prepare-retries';
 import { collectToolApprovals } from './collect-tool-approvals';
+import { validateApprovedToolApprovals } from './validate-tool-approvals';
 import type {
   OnFinishEvent,
   OnStartEvent,
@@ -359,6 +360,7 @@ export function streamText<
   experimental_onToolCallStart: onToolCallStart,
   experimental_onToolCallFinish: onToolCallFinish,
   experimental_context,
+  experimental_toolApprovalSecret,
   experimental_include: include,
   _internal: { now = originalNow, generateId = originalGenerateId } = {},
   ...settings
@@ -532,6 +534,15 @@ export function streamText<
      */
     experimental_context?: unknown;
 
+    /**
+     * Secret for HMAC-signing tool approval requests. When set, the server
+     * signs each approval request at issuance and verifies the signature when
+     * the approval is replayed, preventing client-forged approvals.
+     *
+     * Experimental (can break in patch releases).
+     */
+    experimental_toolApprovalSecret?: string | Uint8Array;
+
     /**
      * Settings for controlling what data is included in step results.
      * Disabling inclusion can help reduce memory usage when processing
@@ -608,6 +619,7 @@ export function streamText<
     now,
     generateId,
     experimental_context,
+    experimental_toolApprovalSecret,
     download,
     include,
   });
@@ -792,6 +804,7 @@ class DefaultStreamTextResult<
     onToolCallStart,
     onToolCallFinish,
     experimental_context,
+    experimental_toolApprovalSecret,
     download,
     include,
   }: {
@@ -828,6 +841,7 @@ class DefaultStreamTextResult<
       | undefined;
     originalAbortSignal: AbortSignal | undefined;
     experimental_context: unknown;
+    experimental_toolApprovalSecret: string | Uint8Array | undefined;
     download: DownloadFunction | undefined;
     include: { requestBody?: boolean } | undefined;
 
@@ -1402,12 +1416,29 @@ class DefaultStreamTextResult<
           deniedToolApprovals.length > 0 ||
           approvedToolApprovals.length > 0
         ) {
-          const localApprovedToolApprovals = approvedToolApprovals.filter(
-            toolApproval => !toolApproval.toolCall.providerExecuted,
-          );
-          const localDeniedToolApprovals = deniedToolApprovals.filter(
-            toolApproval => !toolApproval.toolCall.providerExecuted,
-          );
+          // Re-validate approvals reconstructed from the client-supplied
+          // message history before executing them: verify the HMAC signature
+          // (when a secret is configured), re-validate the input against the
+          // tool's schema, and re-resolve whether the tool requires approval.
+          const {
+            approvedToolApprovals: localApprovedToolApprovals,
+            deniedToolApprovals: revalidationDeniedToolApprovals,
+          } = await validateApprovedToolApprovals<TOOLS>({
+            approvedToolApprovals: approvedToolApprovals.filter(
+              toolApproval => !toolApproval.toolCall.providerExecuted,
+            ),
+            tools,
+            messages: initialMessages,
+            experimental_context,
+            toolApprovalSecret: experimental_toolApprovalSecret,
+          });
+
+          const localDeniedToolApprovals = [
+            ...deniedToolApprovals.filter(
+              toolApproval => !toolApproval.toolCall.providerExecuted,
+            ),
+            ...revalidationDeniedToolApprovals,
+          ];
 
           const deniedProviderExecutedToolApprovals =
             deniedToolApprovals.filter(
@@ -1728,6 +1759,7 @@ class DefaultStreamTextResult<
               repairToolCall,
               abortSignal,
               experimental_context,
+              toolApprovalSecret: experimental_toolApprovalSecret,
               generateId,
               stepNumber: recordedSteps.length,
               model: stepModelInfo,
@@ -2688,6 +2720,9 @@ class DefaultStreamTextResult<
                 type: 'tool-approval-request',
                 approvalId: part.approvalId,
                 toolCallId: part.toolCall.toolCallId,
+                ...(part.signature != null
+                  ? { signature: part.signature }
+                  : {}),
               });
               break;
             }

package/src/generate-text/to-response-messages.ts

@@ -113,6 +113,7 @@ export async function toResponseMessages<TOOLS extends ToolSet>({
           type: 'tool-approval-request',
           approvalId: part.approvalId,
           toolCallId: part.toolCall.toolCallId,
+          ...(part.signature != null ? { signature: part.signature } : {}),
         });
         break;
     }

package/src/generate-text/tool-approval-request-output.ts

@@ -18,4 +18,9 @@ export type ToolApprovalRequestOutput<TOOLS extends ToolSet> = {
    * Tool call that the approval request is for.
    */
   toolCall: TypedToolCall<TOOLS>;
+
+  /**
+   * HMAC-SHA256 signature binding this approval request to its tool call.
+   */
+  signature?: string;
 };

package/src/generate-text/tool-approval-signature.ts

@@ -0,0 +1,125 @@
+import {
+  convertBase64ToUint8Array,
+  convertUint8ArrayToBase64,
+} from '@ai-sdk/provider-utils';
+
+const encoder = new TextEncoder();
+
+function canonicalJSON(value: unknown): string {
+  if (value === null || value === undefined) {
+    return JSON.stringify(value);
+  }
+  if (typeof value !== 'object') {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJSON).join(',')}]`;
+  }
+  const keys = Object.keys(value as Record<string, unknown>).sort();
+  const entries = keys.map(
+    k =>
+      `${JSON.stringify(k)}:${canonicalJSON((value as Record<string, unknown>)[k])}`,
+  );
+  return `{${entries.join(',')}}`;
+}
+
+function toBase64url(bytes: Uint8Array): string {
+  return convertUint8ArrayToBase64(bytes)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+}
+
+function fromBase64url(str: string): Uint8Array {
+  return convertBase64ToUint8Array(str);
+}
+
+async function importKey(secret: string | Uint8Array): Promise<CryptoKey> {
+  const keyData = typeof secret === 'string' ? encoder.encode(secret) : secret;
+  return crypto.subtle.importKey(
+    'raw',
+    keyData,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify'],
+  );
+}
+
+async function hashInput(input: unknown): Promise<string> {
+  const canonical = canonicalJSON(input);
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    encoder.encode(canonical),
+  );
+  return toBase64url(new Uint8Array(digest));
+}
+
+function buildPayload(
+  approvalId: string,
+  toolCallId: string,
+  toolName: string,
+  inputDigest: string,
+): Uint8Array {
+  return encoder.encode(
+    `${approvalId}\n${toolCallId}\n${toolName}\n${inputDigest}`,
+  );
+}
+
+export async function signToolApproval({
+  secret,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<string> {
+  const key = await importKey(secret);
+  const inputDigest = await hashInput(input);
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  const sig = await crypto.subtle.sign('HMAC', key, payload);
+  return toBase64url(new Uint8Array(sig));
+}
+
+export async function verifyToolApprovalSignature({
+  secret,
+  signature,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array;
+  signature: string;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<boolean> {
+  const key = await importKey(secret);
+  const inputDigest = await hashInput(input);
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  const sigBytes = fromBase64url(signature);
+  return crypto.subtle.verify('HMAC', key, sigBytes, payload);
+}
+
+export async function maybeSignApproval({
+  secret,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array | undefined;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<string | undefined> {
+  if (secret == null) return undefined;
+  return signToolApproval({ secret, approvalId, toolCallId, toolName, input });
+}