feat(eve): add remote client authentication foundation

[ruiconti]

What

• Parse GET /eve/v1/info with Zod at the network boundary.
• Add ClientAuth.vercelOidc for verified, project-scoped Vercel credentials.
• Keep credential replacement reversible while a replacement probe is in flight.
• Model remote connection states, probing, and controller ownership in separate modules.
• Document the public client behavior and add a patch changeset.

Why client auth belongs here

The dev TUI and eval CLI both use Client for remote agent requests. One Vercel OIDC token must populate the route bearer credential and Vercel trusted-OIDC header, so ClientAuth owns that mapping instead of each caller managing headers. DevelopmentCredentialGate only installs the token after the verified deployment matches the client host. A request begins bypass and OIDC resolution together, so a later credential replacement cannot split its headers across grants; a failed or cancelled replacement restores the prior grant.

Scope

This is stack 1 of 3. It provides the remote-auth foundation without a TUI command. The remote-connection controller is modeled and tested here; #111 wires the UI.

The production change under src/setup/verified-remote-client.ts bridges verified deployment identity into the client auth resolver for the dev TUI and eval CLI. This PR has no project-picker or Trusted Sources mutation. Team-scoped project search merged separately in #110.

Stack

1. feat(eve): add remote client authentication foundation #191 - remote client authentication foundation
2. feat(eve): add Trusted Sources policy primitives #190 - Trusted Sources policy primitives
3. feat(eve): recover remote TUI authentication #111 - remote TUI authentication exposure

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview, Comment, Open in v0	Jun 23, 2026 2:47pm

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• Package delta: install footprint 52.06 MB -> 52.36 MB (+303.1 kB ⚠️).

Delta vs main (b4fc7ac)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	3.29 MB	3.35 MB	+57.4 kB ⚠️
Package	Unpacked publish size	11.85 MB	12.16 MB	+303.1 kB ⚠️
Package	Installed footprint	52.06 MB	52.36 MB	+303.1 kB ⚠️
Package	Published files	2239	2249	+10
Package	Installed files	5444	5454	+10
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	9.35 MB	9.35 MB	-442 B ✅
Runtime	Public routes	9	9	0

Changed function payloads vs main (b4fc7ac) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/.well-known/workflow/v1/flow.func	changed	5.48 MB	5.48 MB	-298 B ✅	none
functions/__server.func	changed	3.87 MB	3.87 MB	-144 B ✅	none

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260610-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-06-23T14:47:47.540Z
• Route aliases: 9 public, 1 internal (10 total aliases)
• Vercel routes in config: 10
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.13.1
• Package directory: packages/eve
• Tarball: 3.35 MB (eve-0.13.1.tgz)
• Unpacked payload: 12.16 MB across 2249 published files
• Installed footprint: 52.36 MB across 5454 installed files
• Installed root package: 11.04 MB
• Installed dependencies: 41.32 MB
• Runtime dependencies: 1
• Peer dependencies: 12 (11 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.

Heavy installed dependencies

• @rolldown/binding-linux-x64-gnu: 20.61 MB (39.4%)
• eve: 11.04 MB (21.1%)
• ai: 6.20 MB (11.8%)
• zod: 4.97 MB (9.5%)
• nitro: 2.41 MB (4.6%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [####....................] 1.51 MB 12.4%
🟡 dist/src/compiled/@workflow/core/runtime.js      [##......................] 775.4 kB 6.4%
🟡 dist/src/compiled/@vercel/sandbox/index.js       [##......................] 632.0 kB 5.2%
🟡 dist/src/compiled/@chat-adapter/slack/index.js   [#.......................] 436.9 kB 3.6%
🟡 dist/src/compiled/_chunks/workflow/attribute-... [#.......................] 370.9 kB 3.1%
🔴 Other published files                            [########################] 8.44 MB 69.4%

Installed footprint breakdown

Installed package size
🔴 @rolldown/binding-linux-x64-gnu [########################] 20.61 MB 39.4%
🔴 eve                             [#############...........] 11.04 MB 21.1%
🔴 ai                              [#######.................] 6.20 MB 11.8%
🟠 zod                             [######..................] 4.97 MB 9.5%
🟠 nitro                           [###.....................] 2.41 MB 4.6%
🟡 rolldown                        [#.......................] 771.0 kB 1.5%
🔴 Other installed packages        [#######.................] 6.37 MB 12.2%

Runtime dependencies (1)

Package	Range	Notes
nitro	3.0.260610-beta

Peer dependencies (12)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
@sveltejs/kit	^2.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
just-bash	^3.0.0	optional peer
microsandbox	^0.5.0	optional peer
next	^16.0.0	optional peer
nuxt	^4.0.0	optional peer
react	^19.0.0	optional peer
svelte	^5.0.0	optional peer
vite	^8.0.0	optional peer
vue	^3.5.0	optional peer

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 5.48 MB 58.6%
🔴 functions/__server.func                         [#################.......] 3.87 MB 41.4%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 5.48 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	5.48 MB
Function files	5.48 MB across 27 files
Traced dependencies	0 B
Signal	🟠 Bundled file __eve_nitro_handler__.mjs is 1.51 MB (27.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 __eve_nitro_handler__.mjs              [########################] 1.51 MB 27.6%
🟠 _chunks/runtime.mjs                    [###############.........] 958.4 kB 17.5%
🟡 _chunks/sandbox.mjs                    [############............] 766.0 kB 14.0%
🟡 _chunks/attribute-changes-Bi5DLT8S.mjs [########................] 472.2 kB 8.6%
🟡 _chunks/dist-DTchiX0N.mjs              [#######.................] 460.6 kB 8.4%
🟠 Other bundled files                    [#####################...] 1.31 MB 24.0%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "environment": {
    "NODE_OPTIONS": "--experimental-require-module",
    "WORKFLOW_QUEUE_NAMESPACE": "eve"
  },
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ]
}

---

🟠 functions/__server.func • 8 public routes, 1 internal alias • 3.87 MB

Metric	Value
Public routes	/ /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/stream
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	3.87 MB
Function files	3.87 MB across 21 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 1.40 MB (36.3%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                              [########################] 1.40 MB 36.3%
🟠 _chunks/runtime.mjs                    [###############.........] 875.8 kB 22.6%
🟠 _chunks/sandbox.mjs                    [#############...........] 766.0 kB 19.8%
🟡 _chunks/attribute-changes-Bi5DLT8S.mjs [########................] 448.5 kB 11.6%
⚪ _libs/zod.mjs                          [##......................] 114.2 kB 3.0%
🟡 Other bundled files                    [####....................] 258.8 kB 6.7%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}