ai 7.0.85 → 7.0.87

package/docs/03-agents/06-tool-approvals.mdx

@@ -319,9 +319,12 @@ Every serverless instance that might handle a request needs the same secret, sin
 - The secret is never sent to the client or included in the stream
 
 <Note>
-  `experimental_toolApprovalSecret` is not yet supported on `WorkflowAgent`. For
-  durable workflows, the workflow runtime provides its own persistence layer
-  that can be used to verify approvals.
+  `WorkflowAgent` also supports `experimental_toolApprovalSecret`. It signs in
+  a workflow step before writing the durable approval request. Pass an
+  environment variable reference, such as
+  `{ environmentVariable: 'TOOL_APPROVAL_SECRET' }`, so the raw secret is read
+  only inside signing and verification steps. Only the signature is persisted
+  and sent to the client.
 </Note>
 
 ## Related APIs

package/docs/03-agents/07-workflow-agent.mdx

@@ -354,6 +354,49 @@ const agent = new WorkflowAgent({
 
 Because the workflow is durable, the approval request survives process restarts — the user can approve hours later and the agent will resume.
 
+### Signed Tool Approvals
+
+Client-supplied message history can be modified before it is replayed to the
+workflow. For tools that perform sensitive operations, configure
+`experimental_toolApprovalSecret` to authenticate approval requests:
+
+```ts highlight="4"
+const agent = new WorkflowAgent({
+  model: 'anthropic/claude-sonnet-4-6',
+  experimental_toolApprovalSecret: {
+    environmentVariable: 'TOOL_APPROVAL_SECRET',
+  },
+  tools: {
+    bookFlight: tool({
+      description: 'Book a flight',
+      inputSchema: z.object({ flightId: z.string() }),
+      needsApproval: true,
+      execute: bookFlightStep,
+    }),
+  },
+});
+```
+
+The agent HMAC-signs the approval ID, tool call ID, tool name, and validated
+input. When approved message history is replayed, a missing or invalid
+signature prevents the tool from executing. The signature is preserved through
+the durable model-call stream, `createModelCallToUIChunkTransform()`,
+`addToolApprovalResponse()`, and `convertToModelMessages()`.
+
+Use a high-entropy secret of at least 32 bytes and make the same secret
+available to every worker that can issue or resume an approval. Keep old keys
+available while approvals signed with them are pending; changing the secret
+invalidates those pending approvals.
+
+`WorkflowAgent` passes only the environment variable name into signing and
+verification steps. Each step reads the secret from its local environment, and
+the raw value is never included in step arguments, durable stream parts,
+callbacks, or telemetry events. Configure the environment variable on every
+worker, and do not put the secret value in `runtimeContext` or `toolsContext`.
+
+You can also provide `experimental_toolApprovalSecret` to `agent.stream()`.
+The stream-level value overrides the constructor default.
+
 ## Loop Control
 
 Control how many steps the agent can take:

package/docs/03-ai-sdk-harnesses/02-harness-agent.mdx

@@ -526,6 +526,10 @@ console.log(preparation.identity);
 - `sandboxConfig`: sandbox working-directory and lifecycle hook configuration.
 - `telemetry`, `debug`, and `onLog`: observability and diagnostics.
 
+Telemetry reports each turn's resolved model, instructions, and active
+host-defined tools. Skills are adapter context and do not have a corresponding
+AI SDK telemetry field, so they are not included in standard telemetry events.
+
 Adapter-specific settings belong on the adapter factory, for example
 `createCodex({ reasoningEffort: 'high' })`.
 

package/docs/04-ai-sdk-ui/03-chatbot-tool-usage.mdx

@@ -543,6 +543,13 @@ For manual approval requests, the reason for requiring approval is available as
 `part.approval.requestReason`. It remains separate from an optional response
 reason supplied to `addToolApprovalResponse`.
 
+Approval request chunks can also include an `approvalDescriptor` with opaque
+application-specific metadata. UI message processing exposes it as
+`part.approval.descriptor` in the `approval-requested` state and preserves it in
+subsequent approval-bearing states, including `approval-responded`. This lets
+clients render or persist server-computed approval metadata without using it to
+determine whether the tool was approved.
+
 ### Securing Approvals for Sensitive Tools
 
 In the `useChat` pattern, the client sends the full message history to the server each turn. Without additional protection, a modified client could fabricate an approval response. For tools that perform sensitive operations, add `experimental_toolApprovalSecret` to your `streamText` call so the server cryptographically verifies that it issued the approval:

package/docs/04-ai-sdk-ui/50-stream-protocol.mdx

@@ -367,11 +367,15 @@ Format: Server-Sent Event with JSON object
 Example:
 
 ```
-data: {"type":"tool-approval-request","toolCallId":"call_fJdQDqnXeGxTmr4E3YPSR7Ar","approvalId":"approval_123","reason":"Requires operator review"}
+data: {"type":"tool-approval-request","toolCallId":"call_fJdQDqnXeGxTmr4E3YPSR7Ar","approvalId":"approval_123","approvalDescriptor":{"scope":"account:delete"},"reason":"Requires operator review"}
 
 ```
 
-When `isAutomatic` is omitted, the request expects an explicit approval response from the client. `reason` is optional and explains why the tool call requires approval.
+When `isAutomatic` is omitted, the request expects an explicit approval response
+from the client. `reason` is optional and explains why the tool call requires
+approval. `approvalDescriptor` is optional opaque metadata for the approval.
+When the stream is processed into UI messages, it is available as
+`part.approval.descriptor` and is retained through subsequent approval states.
 
 ### Tool Approval Response Part
 

package/docs/07-reference/01-ai-sdk-core/31-ui-message.mdx

@@ -150,6 +150,36 @@ type ToolUIPart<TOOLS extends UITools = UITools> = ValueOf<{
         output?: never;
         errorText?: never;
       }
+    | {
+        state: 'approval-requested';
+        input: TOOLS[NAME]['input'];
+        output?: never;
+        errorText?: never;
+        approval: {
+          id: string;
+          approved?: never;
+          descriptor?: unknown;
+          requestReason?: string;
+          reason?: never;
+          isAutomatic?: boolean;
+          signature?: string;
+        };
+      }
+    | {
+        state: 'approval-responded';
+        input: TOOLS[NAME]['input'];
+        output?: never;
+        errorText?: never;
+        approval: {
+          id: string;
+          approved: boolean;
+          descriptor?: unknown;
+          requestReason?: string;
+          reason?: string;
+          isAutomatic?: boolean;
+          signature?: string;
+        };
+      }
     | {
         state: 'output-available';
         input: TOOLS[NAME]['input'];
@@ -168,6 +198,11 @@ type ToolUIPart<TOOLS extends UITools = UITools> = ValueOf<{
 }>;
 ```
 
+`approval.descriptor` contains optional opaque metadata supplied as
+`approvalDescriptor` on the approval request stream chunk. It is preserved when
+the tool part transitions from `approval-requested` to `approval-responded` and
+in later approval-bearing output states.
+
 ### `CustomContentUIPart`
 
 A provider-specific custom content part of a message.

package/docs/07-reference/04-ai-sdk-workflow/01-workflow-agent.mdx

@@ -136,6 +136,13 @@ To see `WorkflowAgent` in action, check out [these examples](#examples).
       description:
         'Default sandbox session passed to tool descriptions and execution as `experimental_sandbox`, and exposed to `prepareStep`. Per-stream values override this default.',
     },
+    {
+      name: 'experimental_toolApprovalSecret',
+      type: 'WorkflowToolApprovalSecret',
+      isOptional: true,
+      description:
+        'Workflow-safe reference to the environment variable containing the secret used to HMAC-sign tool approval requests and verify approved message history before tool execution. Only the environment variable name crosses workflow boundaries; the secret is read inside signing and verification steps. Per-stream values override this default.',
+    },
     {
       name: 'prepareStep',
       type: 'PrepareStepCallback',
@@ -559,6 +566,13 @@ const result = await agent.stream({
       description:
         'Sandbox session passed to tool descriptions and execution as `experimental_sandbox`, and exposed to `prepareStep`. Overrides the constructor default.',
     },
+    {
+      name: 'experimental_toolApprovalSecret',
+      type: 'WorkflowToolApprovalSecret',
+      isOptional: true,
+      description:
+        'Workflow-safe reference to the environment variable containing the secret used to HMAC-sign tool approval requests and verify approved message history before tool execution. Only the environment variable name crosses workflow boundaries; the secret is read inside signing and verification steps. Overrides the constructor default.',
+    },
     {
       name: 'telemetry',
       type: 'TelemetryOptions',
@@ -922,6 +936,9 @@ import { z } from 'zod';
 
 const agent = new WorkflowAgent({
   model: 'anthropic/claude-sonnet-4-6',
+  experimental_toolApprovalSecret: {
+    environmentVariable: 'TOOL_APPROVAL_SECRET',
+  },
   tools: {
     bookFlight: tool({
       description: 'Book a flight',
@@ -936,6 +953,14 @@ const agent = new WorkflowAgent({
 });
 ```
 
+When `experimental_toolApprovalSecret` is configured, each approval request is
+signed over its approval ID, tool call ID, tool name, and validated input.
+Replayed approvals with a missing or invalid signature do not execute the tool.
+The signature is preserved in the durable stream and UI message history, while
+only the environment variable name crosses workflow boundaries. Signing and
+verification steps read the raw secret from their local environment and do not
+serialize it. A stream-level reference overrides the constructor value.
+
 ### Agent with Lifecycle Callbacks
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.85",
+  "version": "7.0.87",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,18 +42,18 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.69",
+    "@ai-sdk/gateway": "4.0.70",
     "@ai-sdk/provider": "4.0.9",
     "@ai-sdk/provider-utils": "5.0.34"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.68",
+    "@ai-sdk/amazon-bedrock": "5.0.69",
     "@ai-sdk/deepseek": "3.0.37",
-    "@ai-sdk/google": "4.0.58",
+    "@ai-sdk/google": "4.0.59",
     "@ai-sdk/groq": "4.0.35",
     "@ai-sdk/huggingface": "2.0.41",
     "@ai-sdk/moonshotai": "3.0.43",
-    "@ai-sdk/openai": "4.0.52",
+    "@ai-sdk/openai": "4.0.53",
     "@ai-sdk/test-server": "2.0.1",
     "@ai-sdk/xai": "4.0.50",
     "@edge-runtime/vm": "^5.0.0",

package/src/ui/process-ui-message-stream.ts

@@ -748,6 +748,9 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
               toolInvocation.state = 'approval-requested';
               toolInvocation.approval = {
                 id: chunk.approvalId,
+                ...(chunk.approvalDescriptor != null
+                  ? { descriptor: chunk.approvalDescriptor }
+                  : {}),
                 ...(chunk.reason != null
                   ? { requestReason: chunk.reason }
                   : {}),
@@ -771,16 +774,10 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
 
               toolInvocation.state = 'approval-responded';
               toolInvocation.approval = {
+                ...approval,
                 id: chunk.approvalId,
                 approved: chunk.approved,
-                ...(approval.requestReason != null
-                  ? { requestReason: approval.requestReason }
-                  : {}),
                 ...(chunk.reason != null ? { reason: chunk.reason } : {}),
-                ...(approval.isAutomatic === true ? { isAutomatic: true } : {}),
-                ...(approval.signature != null
-                  ? { signature: approval.signature }
-                  : {}),
               };
               if (chunk.providerExecuted != null) {
                 toolInvocation.providerExecuted = chunk.providerExecuted;

package/src/ui/ui-messages.ts

@@ -319,6 +319,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
       approval: {
         id: string;
         approved?: never;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: never;
         isAutomatic?: boolean;
@@ -334,6 +335,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
       approval: {
         id: string;
         approved: boolean;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -351,6 +353,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
       approval?: {
         id: string;
         approved: true;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -368,6 +371,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
       approval?: {
         id: string;
         approved: true;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -383,6 +387,7 @@ export type UIToolInvocation<TOOL extends UITool | Tool> = {
       approval: {
         id: string;
         approved: false;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -442,6 +447,7 @@ export type DynamicToolUIPart = {
       approval: {
         id: string;
         approved?: never;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: never;
         isAutomatic?: boolean;
@@ -457,6 +463,7 @@ export type DynamicToolUIPart = {
       approval: {
         id: string;
         approved: boolean;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -474,6 +481,7 @@ export type DynamicToolUIPart = {
       approval?: {
         id: string;
         approved: true;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -490,6 +498,7 @@ export type DynamicToolUIPart = {
       approval?: {
         id: string;
         approved: true;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;
@@ -505,6 +514,7 @@ export type DynamicToolUIPart = {
       approval: {
         id: string;
         approved: false;
+        descriptor?: unknown;
         requestReason?: string;
         reason?: string;
         isAutomatic?: boolean;

package/src/ui/validate-ui-messages.ts

@@ -153,6 +153,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.never().optional(),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.never().optional(),
                     isAutomatic: z.boolean().optional(),
@@ -173,6 +174,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.boolean(),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.string().optional(),
                     isAutomatic: z.boolean().optional(),
@@ -196,6 +198,7 @@ const uiMessagesSchema = lazySchema(() =>
                     .object({
                       id: z.string(),
                       approved: z.literal(true),
+                      descriptor: z.unknown().optional(),
                       requestReason: z.string().optional(),
                       reason: z.string().optional(),
                       isAutomatic: z.boolean().optional(),
@@ -220,6 +223,7 @@ const uiMessagesSchema = lazySchema(() =>
                     .object({
                       id: z.string(),
                       approved: z.literal(true),
+                      descriptor: z.unknown().optional(),
                       requestReason: z.string().optional(),
                       reason: z.string().optional(),
                       isAutomatic: z.boolean().optional(),
@@ -241,6 +245,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.literal(false),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.string().optional(),
                     isAutomatic: z.boolean().optional(),
@@ -284,6 +289,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.never().optional(),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.never().optional(),
                     isAutomatic: z.boolean().optional(),
@@ -303,6 +309,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.boolean(),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.string().optional(),
                     isAutomatic: z.boolean().optional(),
@@ -325,6 +332,7 @@ const uiMessagesSchema = lazySchema(() =>
                     .object({
                       id: z.string(),
                       approved: z.literal(true),
+                      descriptor: z.unknown().optional(),
                       requestReason: z.string().optional(),
                       reason: z.string().optional(),
                       isAutomatic: z.boolean().optional(),
@@ -348,6 +356,7 @@ const uiMessagesSchema = lazySchema(() =>
                     .object({
                       id: z.string(),
                       approved: z.literal(true),
+                      descriptor: z.unknown().optional(),
                       requestReason: z.string().optional(),
                       reason: z.string().optional(),
                       isAutomatic: z.boolean().optional(),
@@ -368,6 +377,7 @@ const uiMessagesSchema = lazySchema(() =>
                   approval: z.object({
                     id: z.string(),
                     approved: z.literal(false),
+                    descriptor: z.unknown().optional(),
                     requestReason: z.string().optional(),
                     reason: z.string().optional(),
                     isAutomatic: z.boolean().optional(),

package/src/ui-message-stream/ui-message-chunks.ts

@@ -85,6 +85,7 @@ export const uiMessageChunkSchema = lazySchema(() =>
         type: z.literal('tool-approval-request'),
         approvalId: z.string(),
         toolCallId: z.string(),
+        approvalDescriptor: z.unknown().optional(),
         reason: z.string().optional(),
         isAutomatic: z.boolean().optional(),
         signature: z.string().optional(),
@@ -299,6 +300,7 @@ export type UIMessageChunk<
       type: 'tool-approval-request';
       approvalId: string;
       toolCallId: string;
+      approvalDescriptor?: unknown;
       reason?: string;
       isAutomatic?: boolean;
       signature?: string;