ai 7.0.18 → 7.0.19

package/src/generate-text/resolve-tool-approval.ts

@@ -9,6 +9,7 @@ import type {
   ToolApprovalConfiguration,
   ToolApprovalStatus,
 } from './tool-approval-configuration';
+import { getOwn } from '../util/get-own';
 import type { TypedToolCall } from './tool-call';
 import { validateToolContext } from './validate-tool-context';
 
@@ -75,13 +76,17 @@ export async function resolveToolApproval<
   }
 
   const toolName = toolCall.toolName;
-  const tool = tools?.[toolName];
+  // `toolName` can be client-controlled, so look tools/approvals up by own
+  // property only: a name that matches an inherited object property (e.g.
+  // `constructor`, `toString`) resolves to "no such tool"/"unconfigured"
+  // instead of a value on `Object.prototype`.
+  const tool = getOwn(tools, toolName);
 
   // assume that the input has been validated and matches the tool's input schema
   const input = toolCall.input as InferToolInput<TOOLS[keyof TOOLS]>;
 
   // user-defined per-tool approval
-  const userDefinedToolApprovalStatus = toolApproval?.[toolName];
+  const userDefinedToolApprovalStatus = getOwn(toolApproval, toolName);
   if (userDefinedToolApprovalStatus != null) {
     const approvalStatus: ToolApprovalStatus | undefined =
       typeof userDefinedToolApprovalStatus === 'function'
@@ -90,8 +95,7 @@ export async function resolveToolApproval<
             messages,
             toolContext: await validateToolContext({
               toolName,
-              context:
-                toolsContext?.[toolName as keyof InferToolSetContext<TOOLS>],
+              context: getOwn(toolsContext, toolName),
               contextSchema: tool?.contextSchema,
             }),
             runtimeContext,
@@ -113,8 +117,7 @@ export async function resolveToolApproval<
           messages,
           context: await validateToolContext({
             toolName,
-            context:
-              toolsContext?.[toolName as keyof InferToolSetContext<TOOLS>],
+            context: getOwn(toolsContext, toolName),
             contextSchema: tool?.contextSchema,
           }),
         })

package/src/generate-text/stream-language-model-call.ts

@@ -16,6 +16,7 @@ import {
 } from '@ai-sdk/provider-utils';
 import { ToolCallNotFoundForApprovalError } from '../error/tool-call-not-found-for-approval-error';
 import { resolveLanguageModel } from '../model/resolve-model';
+import { getOwn } from '../util/get-own';
 import type { Instructions, Prompt } from '../prompt';
 import { convertToLanguageModelPrompt } from '../prompt/convert-to-language-model-prompt';
 import type { LanguageModelCallOptions } from '../prompt/language-model-call-options';
@@ -715,7 +716,7 @@ function createLanguageModelV4StreamPartToLanguageModelStreamPartTransform<
         }
 
         case 'tool-input-start': {
-          const tool = tools?.[chunk.toolName];
+          const tool = getOwn(tools, chunk.toolName);
 
           controller.enqueue({
             ...chunk,

package/src/generate-text/stream-text.ts

@@ -74,6 +74,7 @@ import { consumeStream } from '../util/consume-stream';
 import { createIdMap } from '../util/create-id-map';
 import { createStitchableStream } from '../util/create-stitchable-stream';
 import type { DownloadFunction } from '../util/download/download-function';
+import { getOwn } from '../util/get-own';
 import { mergeAbortSignals } from '../util/merge-abort-signals';
 import { mergeObjects } from '../util/merge-objects';
 import { notify } from '../util/notify';
@@ -1694,7 +1695,7 @@ class DefaultStreamTextResult<
                 output: await createToolModelOutput({
                   toolCallId: output.toolCallId,
                   input: output.input,
-                  tool: tools?.[output.toolName],
+                  tool: getOwn(tools, output.toolName),
                   output:
                     output.type === 'tool-result'
                       ? output.output
@@ -2240,7 +2241,7 @@ class DefaultStreamTextResult<
                   // the client tool's result is sent back.
                   for (const toolCall of stepToolCalls) {
                     if (toolCall.providerExecuted !== true) continue;
-                    const tool = tools?.[toolCall.toolName];
+                    const tool = getOwn(tools, toolCall.toolName);
                     if (
                       tool?.type === 'provider' &&
                       tool.supportsDeferredResults

package/src/generate-text/to-response-messages.ts

@@ -5,6 +5,7 @@ import type {
   ToolModelMessage,
 } from '../prompt';
 import { createToolModelOutput } from '../prompt/create-tool-model-output';
+import { getOwn } from '../util/get-own';
 import type { ContentPart } from './content-part';
 import type { ToolSet } from '@ai-sdk/provider-utils';
 
@@ -97,7 +98,7 @@ export async function toResponseMessages<TOOLS extends ToolSet>({
         const output = await createToolModelOutput({
           toolCallId: part.toolCallId,
           input: part.input,
-          tool: tools?.[part.toolName],
+          tool: getOwn(tools, part.toolName),
           output: part.output,
           errorMode: 'none',
         });
@@ -114,7 +115,7 @@ export async function toResponseMessages<TOOLS extends ToolSet>({
         const output = await createToolModelOutput({
           toolCallId: part.toolCallId,
           input: part.input,
-          tool: tools?.[part.toolName],
+          tool: getOwn(tools, part.toolName),
           output: part.error,
           errorMode: 'json',
         });
@@ -189,7 +190,7 @@ export async function toResponseMessages<TOOLS extends ToolSet>({
     const output = await createToolModelOutput({
       toolCallId: part.toolCallId,
       input: part.input,
-      tool: tools?.[part.toolName],
+      tool: getOwn(tools, part.toolName),
       output: part.type === 'tool-result' ? part.output : part.error,
       errorMode: part.type === 'tool-error' ? 'text' : 'none',
     });

package/src/generate-text/tool-approval-signature.ts

@@ -1,35 +1,8 @@
-import {
-  convertBase64ToUint8Array,
-  convertUint8ArrayToBase64,
-} from '@ai-sdk/provider-utils';
+import { convertBase64ToUint8Array } from '@ai-sdk/provider-utils';
+import { hashCanonical, toBase64url } from '../util/canonical-hash';
 
 const encoder = new TextEncoder();
 
-function canonicalJSON(value: unknown): string {
-  if (value === null || value === undefined) {
-    return JSON.stringify(value);
-  }
-  if (typeof value !== 'object') {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJSON).join(',')}]`;
-  }
-  const keys = Object.keys(value as Record<string, unknown>).sort();
-  const entries = keys.map(
-    k =>
-      `${JSON.stringify(k)}:${canonicalJSON((value as Record<string, unknown>)[k])}`,
-  );
-  return `{${entries.join(',')}}`;
-}
-
-function toBase64url(bytes: Uint8Array): string {
-  return convertUint8ArrayToBase64(bytes)
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/g, '');
-}
-
 function fromBase64url(str: string): Uint8Array {
   return convertBase64ToUint8Array(str);
 }
@@ -45,15 +18,6 @@ async function importKey(secret: string | Uint8Array): Promise<CryptoKey> {
   );
 }
 
-async function hashInput(input: unknown): Promise<string> {
-  const canonical = canonicalJSON(input);
-  const digest = await crypto.subtle.digest(
-    'SHA-256',
-    encoder.encode(canonical),
-  );
-  return toBase64url(new Uint8Array(digest));
-}
-
 function buildPayload(
   approvalId: string,
   toolCallId: string,
@@ -79,7 +43,7 @@ export async function signToolApproval({
   input: unknown;
 }): Promise<string> {
   const key = await importKey(secret);
-  const inputDigest = await hashInput(input);
+  const inputDigest = await hashCanonical(input);
   const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
   const sig = await crypto.subtle.sign('HMAC', key, payload);
   return toBase64url(new Uint8Array(sig));
@@ -101,7 +65,7 @@ export async function verifyToolApprovalSignature({
   input: unknown;
 }): Promise<boolean> {
   const key = await importKey(secret);
-  const inputDigest = await hashInput(input);
+  const inputDigest = await hashCanonical(input);
   const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
   const sigBytes = fromBase64url(signature);
   return crypto.subtle.verify('HMAC', key, sigBytes, payload);

package/src/generate-text/tool-fingerprint.ts

@@ -0,0 +1,76 @@
+import { asSchema, type ToolSet } from '@ai-sdk/provider-utils';
+import { hashCanonical } from '../util/canonical-hash';
+
+/**
+ * Tag a tool description for hashing. A function description is developer-owned
+ * (evaluated per call from local context), not a server-controlled "rug pull"
+ * vector, so only its presence is pinned, not its identity. The tagged shape
+ * keeps a literal string equal to some placeholder from ever hashing like a
+ * function.
+ */
+function tagDescription(description: unknown) {
+  if (typeof description === 'string') {
+    return { type: 'string', value: description } as const;
+  }
+  if (description == null) {
+    return { type: 'none' } as const;
+  }
+  return { type: 'function' } as const;
+}
+
+/**
+ * Fingerprint the server-controlled, security-relevant fields of each tool in a
+ * `ToolSet`: `description` (string form only), the resolved input JSON schema,
+ * and `title`. Returns a map of tool name to a stable digest.
+ *
+ * Capture a baseline at trust time (first connect, human-reviewed) and compare
+ * later fetches with {@link detectToolDrift} to catch MCP tool-definition drift
+ * ("rug pull"). Baseline storage and the drift response are the app's concern.
+ */
+export async function fingerprintTools(
+  tools: ToolSet,
+): Promise<Record<string, string>> {
+  const entries = await Promise.all(
+    Object.keys(tools).map(async name => {
+      const tool = tools[name];
+      const digest = await hashCanonical({
+        description: tagDescription(tool.description),
+        inputSchema: await asSchema(tool.inputSchema).jsonSchema,
+        title: tool.title,
+      });
+      return [name, digest] as const;
+    }),
+  );
+  return Object.fromEntries(entries);
+}
+
+/**
+ * Pure diff of two fingerprint maps produced by {@link fingerprintTools}.
+ * `added`/`removed` are tools present in only one map; `changed` are tools whose
+ * pinned definition differs. Uses own-property lookups so a tool literally named
+ * `constructor` or `toString` diffs correctly.
+ */
+export function detectToolDrift(
+  current: Record<string, string>,
+  baseline: Record<string, string>,
+): { added: string[]; removed: string[]; changed: string[] } {
+  const added: string[] = [];
+  const removed: string[] = [];
+  const changed: string[] = [];
+
+  for (const name of Object.keys(current)) {
+    if (!Object.hasOwn(baseline, name)) {
+      added.push(name);
+    } else if (current[name] !== baseline[name]) {
+      changed.push(name);
+    }
+  }
+
+  for (const name of Object.keys(baseline)) {
+    if (!Object.hasOwn(current, name)) {
+      removed.push(name);
+    }
+  }
+
+  return { added, removed, changed };
+}

package/src/generate-text/validate-tool-approvals.ts

@@ -9,6 +9,7 @@ import {
 } from '@ai-sdk/provider-utils';
 import { InvalidToolApprovalSignatureError } from '../error/invalid-tool-approval-signature-error';
 import { InvalidToolInputError } from '../error/invalid-tool-input-error';
+import { getOwn } from '../util/get-own';
 import type { CollectedToolApprovals } from './collect-tool-approvals';
 import { resolveToolApproval } from './resolve-tool-approval';
 import { verifyToolApprovalSignature } from './tool-approval-signature';
@@ -47,7 +48,11 @@ export async function validateApprovedToolApprovals<
 
   for (const approval of approvedToolApprovals) {
     const { toolCall, approvalRequest } = approval;
-    const tool = tools?.[toolCall.toolName];
+    // Look up the tool by own property only: `toolName` comes from
+    // client-supplied history, so a name matching an inherited object property
+    // (e.g. `constructor`, `toString`) must resolve to "no such tool" rather
+    // than a prototype value that would silently skip input validation below.
+    const tool = getOwn(tools, toolCall.toolName);
 
     if (toolApprovalSecret != null) {
       if (approvalRequest.signature == null) {

package/src/generate-video/generate-video.ts

@@ -28,7 +28,6 @@ import { prepareRetries } from '../util/prepare-retries';
 import { VERSION } from '../version';
 import type { GenerateVideoResult } from './generate-video-result';
 import { splitDataUrl } from '../prompt/split-data-url';
-import { convertDataContentToUint8Array } from '../prompt/data-content';
 
 export type GenerateVideoPrompt =
   | string
@@ -49,7 +48,7 @@ export type GenerateVideoPrompt =
  * @param fps - Frames per second for the video.
  * @param seed - Seed for the video generation.
  * @param frameImages - Role-tagged image inputs for image-to-video and first-last-frame generation.
- * @param inputReferences - Reference image inputs for reference-to-video generation.
+ * @param inputReferences - Reference image or video inputs for reference-to-video generation.
  * @param generateAudio - Whether the model should generate audio alongside the video.
  * @param providerOptions - Additional provider-specific options that are passed through to the provider
  * as body parameters.
@@ -141,9 +140,26 @@ export async function experimental_generateVideo({
   }>;
 
   /**
-   * Reference image inputs for reference-to-video generation.
+   * Reference inputs for reference-to-video generation.
+   *
+   * Each entry may be a plain image/video ({@link DataContent}), or an object
+   * form that carries an explicit `mediaType`.
    */
-  inputReferences?: Array<DataContent>;
+  inputReferences?: Array<
+    | DataContent
+    | {
+        /**
+         * The reference image or video.
+         */
+        data: DataContent;
+
+        /**
+         * The media type of the reference (e.g. 'image/png',
+         * 'video/mp4').
+         */
+        mediaType?: string;
+      }
+  >;
 
   /**
    * Whether the model should generate audio alongside the video.
@@ -201,16 +217,19 @@ export async function experimental_generateVideo({
 
   const normalizedFrameImages:
     | Array<Experimental_VideoModelV4FrameImage>
-    | undefined = frameImages?.map(frame => ({
-    image: normalizeImageData(frame.image),
-    frameType: frame.frameType,
-  }));
+    | undefined = frameImages?.flatMap(frame => {
+    const normalizedImage = normalizeImageData(frame.image);
+    return normalizedImage != null
+      ? [{ image: normalizedImage, frameType: frame.frameType }]
+      : [];
+  });
 
   const normalizedInputReferences:
     | Array<Experimental_VideoModelV4File>
-    | undefined = inputReferences?.map(reference =>
-    normalizeImageData(reference),
-  );
+    | undefined = inputReferences?.flatMap(reference => {
+    const normalized = normalizeReferenceData(reference);
+    return normalized != null ? [normalized] : [];
+  });
 
   const effectiveInputReferences =
     normalizedFrameImages != null && normalizedFrameImages.length > 0
@@ -426,13 +445,24 @@ function normalizePrompt(promptArg: GenerateVideoPrompt): {
   };
 }
 
+function detectFileMediaType(
+  data: Uint8Array,
+  restrictToImages: boolean,
+): string {
+  const detected = restrictToImages
+    ? detectMediaType({ data, topLevelType: 'image' })
+    : detectMediaType({ data });
+  return detected ?? 'image/png';
+}
+
 /**
  * Normalizes a {@link DataContent} image into a {@link Experimental_VideoModelV4File}.
  * Accepts a URL string, a data URL, a base64 string, or binary image data.
  */
 function normalizeImageData(
   dataContent: DataContent,
-): Experimental_VideoModelV4File {
+  { restrictToImages = true }: { restrictToImages?: boolean } = {},
+): Experimental_VideoModelV4File | undefined {
   if (typeof dataContent === 'string') {
     if (
       dataContent.startsWith('http://') ||
@@ -446,28 +476,73 @@ function normalizeImageData(
 
     if (dataContent.startsWith('data:')) {
       const { mediaType, base64Content } = splitDataUrl(dataContent);
+      const data = convertBase64ToUint8Array(base64Content ?? '');
       return {
         type: 'file',
-        mediaType: mediaType ?? 'image/png',
-        data: convertBase64ToUint8Array(base64Content ?? ''),
+        mediaType: mediaType ?? detectFileMediaType(data, restrictToImages),
+        data,
       };
     }
 
     const bytes = convertBase64ToUint8Array(dataContent);
     return {
       type: 'file',
-      mediaType:
-        detectMediaType({ data: bytes, topLevelType: 'image' }) ?? 'image/png',
+      mediaType: detectFileMediaType(bytes, restrictToImages),
       data: bytes,
     };
   }
 
-  const bytes = convertDataContentToUint8Array(dataContent);
+  if (dataContent instanceof Uint8Array || dataContent instanceof ArrayBuffer) {
+    const bytes =
+      dataContent instanceof Uint8Array
+        ? dataContent
+        : new Uint8Array(dataContent);
+    return {
+      type: 'file',
+      mediaType: detectFileMediaType(bytes, restrictToImages),
+      data: bytes,
+    };
+  }
+
+  return undefined;
+}
+
+/**
+ * Normalizes a reference input into a {@link Experimental_VideoModelV4File},
+ * accepting either a plain {@link DataContent} or the object form that carries
+ * an explicit `mediaType`.
+ */
+function normalizeReferenceData(
+  reference:
+    | DataContent
+    | {
+        data: DataContent;
+        mediaType?: string;
+      },
+): Experimental_VideoModelV4File | undefined {
+  const isObjectForm =
+    typeof reference === 'object' &&
+    reference != null &&
+    !(reference instanceof Uint8Array) &&
+    !(reference instanceof ArrayBuffer) &&
+    'data' in reference;
+
+  if (!isObjectForm) {
+    return normalizeImageData(reference as DataContent, {
+      restrictToImages: false,
+    });
+  }
+
+  const normalized = normalizeImageData(reference.data, {
+    restrictToImages: false,
+  });
+  if (normalized == null) {
+    return normalized;
+  }
+
   return {
-    type: 'file',
-    mediaType:
-      detectMediaType({ data: bytes, topLevelType: 'image' }) ?? 'image/png',
-    data: bytes,
+    ...normalized,
+    ...(reference.mediaType != null ? { mediaType: reference.mediaType } : {}),
   };
 }
 

package/src/ui/convert-to-model-messages.ts

@@ -11,6 +11,7 @@ import {
 } from '@ai-sdk/provider-utils';
 import { createToolModelOutput } from '../prompt/create-tool-model-output';
 import { MessageConversionError } from '../prompt/message-conversion-error';
+import { getOwn } from '../util/get-own';
 import {
   getToolName,
   isCustomContentUIPart,
@@ -256,7 +257,7 @@ export async function convertToModelMessages<UI_MESSAGE extends UIMessage>(
                           part.state === 'output-error'
                             ? part.errorText
                             : part.output,
-                        tool: options?.tools?.[toolName],
+                        tool: getOwn(options?.tools, toolName),
                         errorMode:
                           part.state === 'output-error' ? 'json' : 'none',
                       }),
@@ -375,7 +376,7 @@ export async function convertToModelMessages<UI_MESSAGE extends UIMessage>(
                             toolPart.state === 'output-error'
                               ? toolPart.errorText
                               : toolPart.output,
-                          tool: options?.tools?.[toolName],
+                          tool: getOwn(options?.tools, toolName),
                           errorMode:
                             toolPart.state === 'output-error' ? 'text' : 'none',
                         }),

package/src/ui/process-ui-message-stream.ts

@@ -731,6 +731,9 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
                 approved: chunk.approved,
                 ...(chunk.reason != null ? { reason: chunk.reason } : {}),
                 ...(approval.isAutomatic === true ? { isAutomatic: true } : {}),
+                ...(approval.signature != null
+                  ? { signature: approval.signature }
+                  : {}),
               };
               if (chunk.providerExecuted != null) {
                 toolInvocation.providerExecuted = chunk.providerExecuted;

package/src/ui/validate-ui-messages.ts

@@ -9,6 +9,7 @@ import {
 import { z } from 'zod/v4';
 import { InvalidArgumentError } from '../error';
 import { jsonValueSchema } from '../types/json-value';
+import { getOwn } from '../util/get-own';
 import { providerMetadataSchema } from '../types/provider-metadata';
 import type {
   DataUIPart,
@@ -456,7 +457,7 @@ export async function safeValidateUIMessages<UI_MESSAGE extends UIMessage>({
               InferUIMessageTools<UI_MESSAGE>
             >;
             const toolName = toolPart.type.slice(5);
-            const tool = tools[toolName];
+            const tool = getOwn(tools, toolName);
 
             if (
               !tool &&

package/src/util/canonical-hash.ts

@@ -0,0 +1,44 @@
+import { convertUint8ArrayToBase64 } from '@ai-sdk/provider-utils';
+
+const encoder = new TextEncoder();
+
+/**
+ * Deterministic JSON serialization: object keys are sorted so that two
+ * structurally-equal values always produce the same string regardless of key
+ * insertion order. Used as the input to content hashing.
+ */
+export function canonicalJSON(value: unknown): string {
+  if (value === null || value === undefined) {
+    return JSON.stringify(value);
+  }
+  if (typeof value !== 'object') {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJSON).join(',')}]`;
+  }
+  const keys = Object.keys(value as Record<string, unknown>).sort();
+  const entries = keys.map(
+    k =>
+      `${JSON.stringify(k)}:${canonicalJSON((value as Record<string, unknown>)[k])}`,
+  );
+  return `{${entries.join(',')}}`;
+}
+
+export function toBase64url(bytes: Uint8Array): string {
+  return convertUint8ArrayToBase64(bytes)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+}
+
+/**
+ * Canonical SHA-256 digest (base64url) of an arbitrary JSON-serializable value.
+ */
+export async function hashCanonical(value: unknown): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    encoder.encode(canonicalJSON(value)),
+  );
+  return toBase64url(new Uint8Array(digest));
+}

package/src/util/get-own.ts

@@ -0,0 +1,18 @@
+/**
+ * Reads a property by an untrusted key, ignoring inherited prototype members.
+ *
+ * Tool sets, tool contexts, and similar lookup objects are indexed by names
+ * that can come from model output or client-supplied message history. Plain
+ * bracket access (`obj[name]`) resolves names such as `constructor`,
+ * `toString`, or `__proto__` to values on `Object.prototype`, which would slip
+ * past the `== null` / `!value` guards that treat an unknown name as "not
+ * present". This helper returns `undefined` unless `key` is an own property.
+ */
+export function getOwn<T extends object>(
+  obj: T | undefined | null,
+  key: string,
+): T[keyof T] | undefined {
+  return obj != null && Object.hasOwn(obj, key)
+    ? obj[key as keyof T]
+    : undefined;
+}