ai 6.0.201 → 6.0.203

package/src/error/invalid-tool-approval-signature-error.ts

@@ -0,0 +1,35 @@
+import { AISDKError } from '@ai-sdk/provider';
+
+const name = 'AI_InvalidToolApprovalSignatureError';
+const marker = `vercel.ai.error.${name}`;
+const symbol = Symbol.for(marker);
+
+export class InvalidToolApprovalSignatureError extends AISDKError {
+  private readonly [symbol] = true;
+
+  readonly approvalId: string;
+  readonly toolCallId: string;
+
+  constructor({
+    approvalId,
+    toolCallId,
+    reason,
+  }: {
+    approvalId: string;
+    toolCallId: string;
+    reason: string;
+  }) {
+    super({
+      name,
+      message: `Tool approval signature verification failed for approval "${approvalId}" (tool call "${toolCallId}"): ${reason}`,
+    });
+    this.approvalId = approvalId;
+    this.toolCallId = toolCallId;
+  }
+
+  static isInstance(
+    error: unknown,
+  ): error is InvalidToolApprovalSignatureError {
+    return AISDKError.hasMarker(error, marker);
+  }
+}

package/src/generate-text/generate-text.ts

@@ -69,6 +69,8 @@ import { extractTextContent } from './extract-text-content';
 import type { GenerateTextResult } from './generate-text-result';
 import { DefaultGeneratedFile } from './generated-file';
 import { isApprovalNeeded } from './is-approval-needed';
+import { maybeSignApproval } from './tool-approval-signature';
+import { validateApprovedToolApprovals } from './validate-tool-approvals';
 import { text, type Output } from './output';
 import type { InferCompleteOutput } from './output-utils';
 import { parseToolCall } from './parse-tool-call';
@@ -270,6 +272,7 @@ export async function generateText<
   experimental_repairToolCall: repairToolCall,
   experimental_download: download,
   experimental_context,
+  experimental_toolApprovalSecret,
   experimental_include: include,
   _internal: { generateId = originalGenerateId } = {},
   experimental_onStart: onStart,
@@ -411,6 +414,15 @@ export async function generateText<
      */
     experimental_context?: unknown;
 
+    /**
+     * Secret for HMAC-signing tool approval requests. When set, the server
+     * signs each approval request at issuance and verifies the signature when
+     * the approval is replayed, preventing client-forged approvals.
+     *
+     * Experimental (can break in patch releases).
+     */
+    experimental_toolApprovalSecret?: string | Uint8Array;
+
     /**
      * Settings for controlling what data is included in step results.
      * Disabling inclusion can help reduce memory usage when processing
@@ -548,12 +560,32 @@ export async function generateText<
         const initialMessages = initialPrompt.messages;
         const responseMessages: Array<ResponseMessage> = [];
 
-        const { approvedToolApprovals, deniedToolApprovals } =
-          collectToolApprovals<TOOLS>({ messages: initialMessages });
+        const {
+          approvedToolApprovals,
+          deniedToolApprovals: collectedDeniedToolApprovals,
+        } = collectToolApprovals<TOOLS>({ messages: initialMessages });
+
+        // Re-validate approvals reconstructed from the client-supplied message
+        // history before executing them: verify the HMAC signature (when a
+        // secret is configured), re-validate the input against the tool's
+        // schema, and re-resolve whether the tool requires approval.
+        const {
+          approvedToolApprovals: localApprovedToolApprovals,
+          deniedToolApprovals: revalidationDeniedToolApprovals,
+        } = await validateApprovedToolApprovals<TOOLS>({
+          approvedToolApprovals: approvedToolApprovals.filter(
+            toolApproval => !toolApproval.toolCall.providerExecuted,
+          ),
+          tools,
+          messages: initialMessages,
+          experimental_context,
+          toolApprovalSecret: experimental_toolApprovalSecret,
+        });
 
-        const localApprovedToolApprovals = approvedToolApprovals.filter(
-          toolApproval => !toolApproval.toolCall.providerExecuted,
-        );
+        const deniedToolApprovals = [
+          ...collectedDeniedToolApprovals,
+          ...revalidationDeniedToolApprovals,
+        ];
 
         if (
           deniedToolApprovals.length > 0 ||
@@ -926,10 +958,20 @@ export async function generateText<
                   experimental_context,
                 })
               ) {
+                const approvalId = generateId();
+                const signature = await maybeSignApproval({
+                  secret: experimental_toolApprovalSecret,
+                  approvalId,
+                  toolCallId: toolCall.toolCallId,
+                  toolName: toolCall.toolName,
+                  input: toolCall.input,
+                });
+
                 toolApprovalRequests[toolCall.toolCallId] = {
                   type: 'tool-approval-request',
-                  approvalId: generateId(),
+                  approvalId,
                   toolCall,
+                  ...(signature != null ? { signature } : {}),
                 };
               }
             }

package/src/generate-text/run-tools-transformation.ts

@@ -28,6 +28,7 @@ import {
   type GeneratedFile,
 } from './generated-file';
 import { isApprovalNeeded } from './is-approval-needed';
+import { maybeSignApproval } from './tool-approval-signature';
 import { parseToolCall } from './parse-tool-call';
 import type { ToolApprovalRequestOutput } from './tool-approval-request-output';
 import type { TypedToolCall } from './tool-call';
@@ -128,6 +129,7 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
   abortSignal,
   repairToolCall,
   experimental_context,
+  toolApprovalSecret,
   generateId,
   stepNumber,
   model,
@@ -143,6 +145,7 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
   abortSignal: AbortSignal | undefined;
   repairToolCall: ToolCallRepairFunction<TOOLS> | undefined;
   experimental_context: unknown;
+  toolApprovalSecret?: string | Uint8Array;
   generateId: IdGenerator;
   stepNumber?: number;
   model?: { provider: string; modelId: string };
@@ -328,10 +331,20 @@ export function runToolsTransformation<TOOLS extends ToolSet>({
                 experimental_context,
               })
             ) {
+              const approvalId = generateId();
+              const signature = await maybeSignApproval({
+                secret: toolApprovalSecret,
+                approvalId,
+                toolCallId: toolCall.toolCallId,
+                toolName: toolCall.toolName,
+                input: toolCall.input,
+              });
+
               toolResultsStreamController!.enqueue({
                 type: 'tool-approval-request',
-                approvalId: generateId(),
+                approvalId,
                 toolCall,
+                ...(signature != null ? { signature } : {}),
               });
               break;
             }

package/src/generate-text/stream-text.ts

@@ -75,6 +75,7 @@ import {
   type AsyncIterableStream,
 } from '../util/async-iterable-stream';
 import { consumeStream } from '../util/consume-stream';
+import { createIdMap } from '../util/create-id-map';
 import { createStitchableStream } from '../util/create-stitchable-stream';
 import type { DownloadFunction } from '../util/download/download-function';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
@@ -82,6 +83,7 @@ import { mergeObjects } from '../util/merge-objects';
 import { now as originalNow } from '../util/now';
 import { prepareRetries } from '../util/prepare-retries';
 import { collectToolApprovals } from './collect-tool-approvals';
+import { validateApprovedToolApprovals } from './validate-tool-approvals';
 import type {
   OnFinishEvent,
   OnStartEvent,
@@ -359,6 +361,7 @@ export function streamText<
   experimental_onToolCallStart: onToolCallStart,
   experimental_onToolCallFinish: onToolCallFinish,
   experimental_context,
+  experimental_toolApprovalSecret,
   experimental_include: include,
   _internal: { now = originalNow, generateId = originalGenerateId } = {},
   ...settings
@@ -532,6 +535,15 @@ export function streamText<
      */
     experimental_context?: unknown;
 
+    /**
+     * Secret for HMAC-signing tool approval requests. When set, the server
+     * signs each approval request at issuance and verifies the signature when
+     * the approval is replayed, preventing client-forged approvals.
+     *
+     * Experimental (can break in patch releases).
+     */
+    experimental_toolApprovalSecret?: string | Uint8Array;
+
     /**
      * Settings for controlling what data is included in step results.
      * Disabling inclusion can help reduce memory usage when processing
@@ -608,6 +620,7 @@ export function streamText<
     now,
     generateId,
     experimental_context,
+    experimental_toolApprovalSecret,
     download,
     include,
   });
@@ -792,6 +805,7 @@ class DefaultStreamTextResult<
     onToolCallStart,
     onToolCallFinish,
     experimental_context,
+    experimental_toolApprovalSecret,
     download,
     include,
   }: {
@@ -828,6 +842,7 @@ class DefaultStreamTextResult<
       | undefined;
     originalAbortSignal: AbortSignal | undefined;
     experimental_context: unknown;
+    experimental_toolApprovalSecret: string | Uint8Array | undefined;
     download: DownloadFunction | undefined;
     include: { requestBody?: boolean } | undefined;
 
@@ -881,7 +896,7 @@ class DefaultStreamTextResult<
         text: string;
         providerMetadata: ProviderMetadata | undefined;
       }
-    > = {};
+    > = createIdMap();
 
     let activeReasoningContent: Record<
       string,
@@ -890,7 +905,7 @@ class DefaultStreamTextResult<
         text: string;
         providerMetadata: ProviderMetadata | undefined;
       }
-    > = {};
+    > = createIdMap();
 
     const eventProcessor = new TransformStream<
       EnrichedStreamPart<TOOLS, InferPartialOutput<OUTPUT>>,
@@ -1055,8 +1070,8 @@ class DefaultStreamTextResult<
         if (part.type === 'start-step') {
           // reset the recorded data when a new step starts:
           recordedContent = [];
-          activeReasoningContent = {};
-          activeTextContent = {};
+          activeReasoningContent = createIdMap();
+          activeTextContent = createIdMap();
 
           recordedRequest = part.request;
           recordedWarnings = part.warnings;
@@ -1402,12 +1417,29 @@ class DefaultStreamTextResult<
           deniedToolApprovals.length > 0 ||
           approvedToolApprovals.length > 0
         ) {
-          const localApprovedToolApprovals = approvedToolApprovals.filter(
-            toolApproval => !toolApproval.toolCall.providerExecuted,
-          );
-          const localDeniedToolApprovals = deniedToolApprovals.filter(
-            toolApproval => !toolApproval.toolCall.providerExecuted,
-          );
+          // Re-validate approvals reconstructed from the client-supplied
+          // message history before executing them: verify the HMAC signature
+          // (when a secret is configured), re-validate the input against the
+          // tool's schema, and re-resolve whether the tool requires approval.
+          const {
+            approvedToolApprovals: localApprovedToolApprovals,
+            deniedToolApprovals: revalidationDeniedToolApprovals,
+          } = await validateApprovedToolApprovals<TOOLS>({
+            approvedToolApprovals: approvedToolApprovals.filter(
+              toolApproval => !toolApproval.toolCall.providerExecuted,
+            ),
+            tools,
+            messages: initialMessages,
+            experimental_context,
+            toolApprovalSecret: experimental_toolApprovalSecret,
+          });
+
+          const localDeniedToolApprovals = [
+            ...deniedToolApprovals.filter(
+              toolApproval => !toolApproval.toolCall.providerExecuted,
+            ),
+            ...revalidationDeniedToolApprovals,
+          ];
 
           const deniedProviderExecutedToolApprovals =
             deniedToolApprovals.filter(
@@ -1728,6 +1760,7 @@ class DefaultStreamTextResult<
               repairToolCall,
               abortSignal,
               experimental_context,
+              toolApprovalSecret: experimental_toolApprovalSecret,
               generateId,
               stepNumber: recordedSteps.length,
               model: stepModelInfo,
@@ -2468,7 +2501,7 @@ class DefaultStreamTextResult<
     sendSources = false,
     sendStart = true,
     sendFinish = true,
-    onError = getErrorMessage,
+    onError = () => 'An error occurred.', // prevent leaking server error details to the client by default
   }: UIMessageStreamOptions<UI_MESSAGE> = {}): AsyncIterableStream<
     InferUIMessageChunk<UI_MESSAGE>
   > {
@@ -2688,6 +2721,9 @@ class DefaultStreamTextResult<
                 type: 'tool-approval-request',
                 approvalId: part.approvalId,
                 toolCallId: part.toolCall.toolCallId,
+                ...(part.signature != null
+                  ? { signature: part.signature }
+                  : {}),
               });
               break;
             }

package/src/generate-text/to-response-messages.ts

@@ -113,6 +113,7 @@ export async function toResponseMessages<TOOLS extends ToolSet>({
           type: 'tool-approval-request',
           approvalId: part.approvalId,
           toolCallId: part.toolCall.toolCallId,
+          ...(part.signature != null ? { signature: part.signature } : {}),
         });
         break;
     }

package/src/generate-text/tool-approval-request-output.ts

@@ -18,4 +18,9 @@ export type ToolApprovalRequestOutput<TOOLS extends ToolSet> = {
    * Tool call that the approval request is for.
    */
   toolCall: TypedToolCall<TOOLS>;
+
+  /**
+   * HMAC-SHA256 signature binding this approval request to its tool call.
+   */
+  signature?: string;
 };

package/src/generate-text/tool-approval-signature.ts

@@ -0,0 +1,125 @@
+import {
+  convertBase64ToUint8Array,
+  convertUint8ArrayToBase64,
+} from '@ai-sdk/provider-utils';
+
+const encoder = new TextEncoder();
+
+function canonicalJSON(value: unknown): string {
+  if (value === null || value === undefined) {
+    return JSON.stringify(value);
+  }
+  if (typeof value !== 'object') {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJSON).join(',')}]`;
+  }
+  const keys = Object.keys(value as Record<string, unknown>).sort();
+  const entries = keys.map(
+    k =>
+      `${JSON.stringify(k)}:${canonicalJSON((value as Record<string, unknown>)[k])}`,
+  );
+  return `{${entries.join(',')}}`;
+}
+
+function toBase64url(bytes: Uint8Array): string {
+  return convertUint8ArrayToBase64(bytes)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+}
+
+function fromBase64url(str: string): Uint8Array {
+  return convertBase64ToUint8Array(str);
+}
+
+async function importKey(secret: string | Uint8Array): Promise<CryptoKey> {
+  const keyData = typeof secret === 'string' ? encoder.encode(secret) : secret;
+  return crypto.subtle.importKey(
+    'raw',
+    keyData,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify'],
+  );
+}
+
+async function hashInput(input: unknown): Promise<string> {
+  const canonical = canonicalJSON(input);
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    encoder.encode(canonical),
+  );
+  return toBase64url(new Uint8Array(digest));
+}
+
+function buildPayload(
+  approvalId: string,
+  toolCallId: string,
+  toolName: string,
+  inputDigest: string,
+): Uint8Array {
+  return encoder.encode(
+    `${approvalId}\n${toolCallId}\n${toolName}\n${inputDigest}`,
+  );
+}
+
+export async function signToolApproval({
+  secret,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<string> {
+  const key = await importKey(secret);
+  const inputDigest = await hashInput(input);
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  const sig = await crypto.subtle.sign('HMAC', key, payload);
+  return toBase64url(new Uint8Array(sig));
+}
+
+export async function verifyToolApprovalSignature({
+  secret,
+  signature,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array;
+  signature: string;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<boolean> {
+  const key = await importKey(secret);
+  const inputDigest = await hashInput(input);
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  const sigBytes = fromBase64url(signature);
+  return crypto.subtle.verify('HMAC', key, sigBytes, payload);
+}
+
+export async function maybeSignApproval({
+  secret,
+  approvalId,
+  toolCallId,
+  toolName,
+  input,
+}: {
+  secret: string | Uint8Array | undefined;
+  approvalId: string;
+  toolCallId: string;
+  toolName: string;
+  input: unknown;
+}): Promise<string | undefined> {
+  if (secret == null) return undefined;
+  return signToolApproval({ secret, approvalId, toolCallId, toolName, input });
+}

package/src/generate-text/validate-tool-approvals.ts

@@ -0,0 +1,124 @@
+import {
+  asSchema,
+  safeValidateTypes,
+  type ModelMessage,
+} from '@ai-sdk/provider-utils';
+import { InvalidToolApprovalSignatureError } from '../error/invalid-tool-approval-signature-error';
+import { InvalidToolInputError } from '../error/invalid-tool-input-error';
+import type { CollectedToolApprovals } from './collect-tool-approvals';
+import { isApprovalNeeded } from './is-approval-needed';
+import { verifyToolApprovalSignature } from './tool-approval-signature';
+import type { ToolSet } from './tool-set';
+
+/**
+ * Re-validates approved tool approvals reconstructed from client-supplied
+ * message history before they are executed. Checks the HMAC signature (when
+ * `experimental_toolApprovalSecret` is configured), re-validates the tool-call
+ * input against the tool's input schema, and re-resolves whether the tool
+ * actually requires approval.
+ *
+ * Approvals that fail signature or schema validation throw (fail-closed).
+ * Approvals for tools that no longer require approval are moved to the denied
+ * list, since the server would never have issued an approval request for them.
+ */
+export async function validateApprovedToolApprovals<TOOLS extends ToolSet>({
+  approvedToolApprovals,
+  tools,
+  messages,
+  experimental_context,
+  toolApprovalSecret,
+}: {
+  approvedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+  tools: TOOLS | undefined;
+  messages: ModelMessage[];
+  experimental_context: unknown;
+  toolApprovalSecret?: string | Uint8Array;
+}): Promise<{
+  approvedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+  deniedToolApprovals: Array<CollectedToolApprovals<TOOLS>>;
+}> {
+  const approved: Array<CollectedToolApprovals<TOOLS>> = [];
+  const denied: Array<CollectedToolApprovals<TOOLS>> = [];
+
+  for (const approval of approvedToolApprovals) {
+    const { toolCall, approvalRequest } = approval;
+    const tool = tools?.[toolCall.toolName];
+
+    if (toolApprovalSecret != null) {
+      if (approvalRequest.signature == null) {
+        throw new InvalidToolApprovalSignatureError({
+          approvalId: approvalRequest.approvalId,
+          toolCallId: toolCall.toolCallId,
+          reason: 'missing signature',
+        });
+      }
+
+      const valid = await verifyToolApprovalSignature({
+        secret: toolApprovalSecret,
+        signature: approvalRequest.signature,
+        approvalId: approvalRequest.approvalId,
+        toolCallId: toolCall.toolCallId,
+        toolName: toolCall.toolName,
+        input: toolCall.input,
+      });
+
+      if (!valid) {
+        throw new InvalidToolApprovalSignatureError({
+          approvalId: approvalRequest.approvalId,
+          toolCallId: toolCall.toolCallId,
+          reason: 'invalid signature',
+        });
+      }
+    }
+
+    // Re-validate the (client-supplied) input against the tool's input schema
+    // for tools that are executed on the server.
+    if (
+      tool != null &&
+      typeof tool.execute === 'function' &&
+      tool.inputSchema != null
+    ) {
+      const validation = await safeValidateTypes({
+        value: toolCall.input,
+        schema: asSchema(tool.inputSchema),
+      });
+
+      if (!validation.success) {
+        throw new InvalidToolInputError({
+          toolName: toolCall.toolName,
+          toolInput: JSON.stringify(toolCall.input),
+          cause: validation.error,
+        });
+      }
+    }
+
+    // Re-resolve whether the tool requires approval. A tool that does not
+    // require approval would never have had an approval request issued by the
+    // server, so any approval for it is fabricated and is denied.
+    const approvalNeeded =
+      tool != null &&
+      (await isApprovalNeeded({
+        tool,
+        toolCall,
+        messages,
+        experimental_context,
+      }));
+
+    if (approvalNeeded) {
+      approved.push(approval);
+    } else {
+      denied.push({
+        ...approval,
+        approvalResponse: {
+          ...approval.approvalResponse,
+          approved: false,
+          reason:
+            approval.approvalResponse.reason ??
+            `Tool "${toolCall.toolName}" does not require approval`,
+        },
+      });
+    }
+  }
+
+  return { approvedToolApprovals: approved, deniedToolApprovals: denied };
+}

package/src/middleware/extract-json-middleware.ts

@@ -3,6 +3,7 @@ import type {
   LanguageModelV3StreamPart,
 } from '@ai-sdk/provider';
 import type { LanguageModelMiddleware } from '../types/language-model-middleware';
+import { createIdMap } from '../util/create-id-map';
 
 /**
  * Default transform function that strips markdown code fences from text.
@@ -68,7 +69,7 @@ export function extractJsonMiddleware(options?: {
           buffer: string;
           prefixStripped: boolean;
         }
-      > = {};
+      > = createIdMap();
 
       const SUFFIX_BUFFER_SIZE = 12;
 

package/src/middleware/extract-reasoning-middleware.ts

@@ -3,6 +3,7 @@ import type {
   LanguageModelV3StreamPart,
 } from '@ai-sdk/provider';
 import type { LanguageModelMiddleware } from '../types/language-model-middleware';
+import { createIdMap } from '../util/create-id-map';
 import { getPotentialStartIndex } from '../util/get-potential-start-index';
 
 /**
@@ -92,7 +93,7 @@ export function extractReasoningMiddleware({
           idCounter: number;
           textId: string;
         }
-      > = {};
+      > = createIdMap();
 
       let delayedTextStart: LanguageModelV3StreamPart | undefined;
 

package/src/ui/convert-to-model-messages.ts

@@ -196,6 +196,9 @@ export async function convertToModelMessages<UI_MESSAGE extends UIMessage>(
                       type: 'tool-approval-request' as const,
                       approvalId: part.approval.id,
                       toolCallId: part.toolCallId,
+                      ...(part.approval.signature != null
+                        ? { signature: part.approval.signature }
+                        : {}),
                     });
                   }
 

package/src/ui/process-ui-message-stream.ts

@@ -675,7 +675,12 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
             case 'tool-approval-request': {
               const toolInvocation = getToolInvocation(chunk.toolCallId);
               toolInvocation.state = 'approval-requested';
-              toolInvocation.approval = { id: chunk.approvalId };
+              toolInvocation.approval = {
+                id: chunk.approvalId,
+                ...(chunk.signature != null
+                  ? { signature: chunk.signature }
+                  : {}),
+              };
               write();
               break;
             }