fix: preserve tool approval signatures when approvals are responded (#16589)

## Background

Tool approvals signed via experimental_toolApprovalSecret lost their
signature when moving from approval-requested to approval-responded,
causing resumed requests to fail signature validation with a missing
signature error.

## Summary

Updated manual chat approval responses and streamed tool approval
responses to carry forward an existing approval.signature while
preserving existing approval metadata.

## Testing

Added regression coverage for manual addToolApprovalResponse and
streamed tool-approval-response transitions to assert approval
signatures remain on the responded approval state.

## Related Issues

Fixes #16543

---------

Co-authored-by: dnukumamras <mukund.sarma@vercel.com>

Author: lgrammel

.changeset/tidy-camels-promise.md

@@ -0,0 +1,5 @@
+---
+'ai': patch
+---
+
+Preserve tool approval signatures when approvals transition to responded.

packages/ai/src/ui/process-ui-message-stream.test.ts

@@ -7698,6 +7698,72 @@ describe('processUIMessageStream', () => {
     });
   });
 
+  describe('tool approval response with signature', () => {
+    beforeEach(async () => {
+      const stream = createUIMessageStream([
+        {
+          type: 'start',
+        },
+        {
+          type: 'start-step',
+        },
+        {
+          input: {
+            value: 'value',
+          },
+          toolCallId: 'call-1',
+          toolName: 'tool1',
+          type: 'tool-input-available',
+        },
+        {
+          approvalId: 'id-1',
+          toolCallId: 'call-1',
+          type: 'tool-approval-request',
+          signature: 'test-sig',
+        },
+        {
+          approvalId: 'id-1',
+          approved: true,
+          type: 'tool-approval-response',
+        },
+        {
+          type: 'finish-step',
+        },
+        {
+          type: 'finish',
+        },
+      ]);
+
+      state = createStreamingUIMessageState({
+        messageId: 'msg-123',
+        lastMessage: undefined,
+      });
+
+      await consumeStream({
+        stream: processUIMessageStream({
+          stream,
+          runUpdateMessageJob,
+          onError: error => {
+            throw error;
+          },
+        }),
+      });
+    });
+
+    it('preserves signature when transitioning to approval-responded', async () => {
+      const toolPart = state!.message.parts.find(
+        part => part.type === 'tool-tool1',
+      ) as any;
+
+      expect(toolPart.state).toBe('approval-responded');
+      expect(toolPart.approval).toEqual({
+        id: 'id-1',
+        approved: true,
+        signature: 'test-sig',
+      });
+    });
+  });
+
   describe('tool approval request without signature', () => {
     beforeEach(async () => {
       const stream = createUIMessageStream([

packages/ai/src/ui/process-ui-message-stream.ts

@@ -731,6 +731,9 @@ export function processUIMessageStream<UI_MESSAGE extends UIMessage>({
                 approved: chunk.approved,
                 ...(chunk.reason != null ? { reason: chunk.reason } : {}),
                 ...(approval.isAutomatic === true ? { isAutomatic: true } : {}),
+                ...(approval.signature != null
+                  ? { signature: approval.signature }
+                  : {}),
               };
               if (chunk.providerExecuted != null) {
                 toolInvocation.providerExecuted = chunk.providerExecuted;