ai 7.0.35 → 7.0.36

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # ai
 
+## 7.0.36
+
+### Patch Changes
+
+- 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload
+
+  The tool approval signature (`experimental_toolApprovalSecret`) built its HMAC
+  payload by joining fields with `\n`. Because fields such as `toolName` and
+  `toolCallId` can themselves contain a newline, distinct field tuples could
+  serialize to identical bytes, allowing a signed approval to verify against a
+  different tuple. The payload is now serialized with `JSON.stringify` (with a
+  versioned domain-separation prefix), which escapes delimiter/control characters
+  and makes the encoding injective.
+
+  Verification remains backwards compatible: a signature in the old format still
+  verifies, but only when no field contains the `\n` delimiter (the condition
+  that made the old format ambiguous), so a pending approval that straddles an
+  upgrade is not rejected while the collision stays closed.
+
 ## 7.0.35
 
 ### Patch Changes

package/dist/index.js

@@ -1089,7 +1089,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "7.0.35" : "0.0.0-test";
+var VERSION = true ? "7.0.36" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -4853,6 +4853,17 @@ async function importKey(secret) {
   );
 }
 function buildPayload(approvalId, toolCallId, toolName, inputDigest) {
+  return encoder2.encode(
+    JSON.stringify([
+      "ai-sdk-tool-approval-v1",
+      approvalId,
+      toolCallId,
+      toolName,
+      inputDigest
+    ])
+  );
+}
+function buildLegacyPayload(approvalId, toolCallId, toolName, inputDigest) {
   return encoder2.encode(
     `${approvalId}
 ${toolCallId}
@@ -4883,9 +4894,21 @@ async function verifyToolApprovalSignature({
 }) {
   const key = await importKey(secret);
   const inputDigest = await hashCanonical(input);
-  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
   const sigBytes = fromBase64url(signature);
-  return crypto.subtle.verify("HMAC", key, sigBytes, payload);
+  const payload = buildPayload(approvalId, toolCallId, toolName, inputDigest);
+  if (await crypto.subtle.verify("HMAC", key, sigBytes, payload)) {
+    return true;
+  }
+  if (!approvalId.includes("\n") && !toolCallId.includes("\n") && !toolName.includes("\n")) {
+    const legacyPayload = buildLegacyPayload(
+      approvalId,
+      toolCallId,
+      toolName,
+      inputDigest
+    );
+    return crypto.subtle.verify("HMAC", key, sigBytes, legacyPayload);
+  }
+  return false;
 }
 async function maybeSignApproval({
   secret,