fix(eve): fail closed anonymous audience

[chadhietala]

Summary

Anonymous eve channel sessions were classified as public by default, which could record content from any reachable endpoint. This returns to the original behavior prior to #3325 for http channels, but now their is sufficient hooks ands information to override. They now classify as unknown; authenticated user, service, and runtime sessions remain private. The PR also adds credentialOwner for raw getToken-only auth and caller for audience callbacks without removing legacy APIs, and fixes step-local token cache-key collisions. Durable context, wire schemas, and Vercel Connect terminology remain unchanged.

Validation

• pnpm fmt
• pnpm lint (passes with existing unrelated warnings)
• pnpm typecheck (45 projects passed)
• pnpm guard:invariants
• pnpm docs:check
• pnpm build
• pnpm test:unit (807 files, 8,844 passed, 1 skipped)
• pnpm test:integration (829 passed; one unrelated Next.js missing-output message assertion failed)

The agent-channels E2E fixture now exercises caller; E2E runs in CI only.

Checklist

• This change was requested or approved by a maintainer
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview	Sep 15, 2026 1:58am UTC
eve-docs-4759	Ready	Preview, v0	Sep 15, 2026 1:58am UTC
eve-pkg	Ready	Preview	Sep 15, 2026 1:58am UTC

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs main (56cde32).

Delta vs main (56cde32)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	8.75 MB	8.75 MB	+1.2 kB ⚠️
Package	Unpacked publish size	32.95 MB	32.96 MB	+3.3 kB ⚠️
Package	Installed footprint	78.57 MB	78.58 MB	+3.3 kB ⚠️
Package	Published files	3993	3993	0
Package	Installed files	7915	7915	0
Package	Installed package instances	33	33	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	8	8	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	20.72 MB	20.72 MB	+3.5 kB ⚠️
Runtime	Public routes	18	18	0

Changed function payloads vs main (56cde32) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	10.36 MB	10.36 MB	+1.7 kB ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	10.36 MB	10.36 MB	+1.7 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	116.67 MB	116.67 MB	+3.3 kB ⚠️
Installed packages	113	113	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	49.20 MB	49.20 MB	+3.3 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260903-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-09-15T01:59:12.411Z
• Route aliases: 18 public, 1 internal (19 total aliases)
• Vercel routes in config: 21
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.55.0
• Package directory: packages/eve
• Tarball: 8.75 MB (eve-0.55.0.tgz)
• Unpacked payload: 32.96 MB across 3993 published files
• Installed footprint: 78.58 MB across 7915 installed files
• Installed root package: 31.53 MB
• Installed dependencies: 47.05 MB
• Installed package instances: 33
• Distinct installed package names: 32
• Installed dependency edges: 51
• Installed optional peer edges: 8
• Runtime dependencies: 2
• Peer dependencies: 6 (5 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 31.53 MB (40.1%)
• @rolldown/binding-linux-x64-gnu: 19.31 MB (24.6%)
• ai: 7.14 MB (9.1%)
• zod: 6.76 MB (8.6%)
• undici: 3.51 MB (4.5%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [#############...........] 9.76 MB 29.6%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.27 MB 6.9%
🟠 dist/src/compiled/@ai-sdk/code-mode/index.js     [#.......................] 1.03 MB 3.1%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 901.4 kB 2.7%
🟡 dist/src/compiled/_chunks/workflow/signal-exi... [#.......................] 514.6 kB 1.6%
🔴 Other published files                            [########################] 18.49 MB 56.1%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 31.53 MB 40.1%
🔴 @rolldown/binding-linux-x64-gnu [###############.........] 19.31 MB 24.6%
🔴 ai                              [#####...................] 7.14 MB 9.1%
🔴 zod                             [#####...................] 6.76 MB 8.6%
🟠 undici                          [###.....................] 3.51 MB 4.5%
🟠 nitro                           [#.......................] 1.89 MB 2.4%
🔴 Other installed packages        [######..................] 8.44 MB 10.7%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260903-beta
undici	8.9.0

Peer dependencies (6)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
dd-trace	^6.13.0	optional peer
just-bash	^3.1.0	optional peer
microsandbox	^0.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 116.67 MB across 9799 installed files
• Installed packages: 113 total (107 transitive-only)
• dependencies: 4 direct packages totaling 49.20 MB
• devDependencies: 2 direct packages totaling 5.04 MB
• Other transitive package files: 62.43 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• eve: 31.53 MB (27.0%)
• @typescript/typescript-linux-x64: 27.95 MB (24.0%)
• @rolldown/binding-linux-x64-gnu: 19.31 MB (16.5%)
• zod: 10.37 MB (8.9%)
• ai: 7.14 MB (6.1%)

Installed footprint breakdown

Installed package size
🔴 eve                              [########################] 31.53 MB 27.0%
🔴 @typescript/typescript-linux-x64 [#####################...] 27.95 MB 24.0%
🔴 @rolldown/binding-linux-x64-gnu  [###############.........] 19.31 MB 16.5%
🔴 zod                              [########................] 10.37 MB 8.9%
🔴 ai                               [#####...................] 7.14 MB 6.1%
🟠 undici                           [###.....................] 3.51 MB 3.0%
🔴 Other installed packages         [#############...........] 16.87 MB 14.5%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	1.0.0	167.9 kB	0.1%
ai	^7.0.93	7.14 MB	6.1%
eve	file:eve-0.55.0.tgz	31.53 MB	27.0%
zod	4.5.4	10.37 MB	8.9%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.54 MB	2.2%
typescript	7.0.2	2.50 MB	2.1%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.36 MB 50.0%
🔴 functions/__server.func                         [########################] 10.36 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.36 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.36 MB
Function files	10.36 MB across 115 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.24 MB (21.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                        [###########.............] 2.24 MB 21.6%
🟡 _libs/undici.mjs                 [#####...................] 980.8 kB 9.5%
🟡 _chunks/esm-Fqlolk7e.mjs         [###.....................] 723.3 kB 7.0%
🟡 _chunks/chatgpt-model.mjs        [###.....................] 699.7 kB 6.8%
🟡 _chunks/signal-exit-Dsy-TT0V.mjs [###.....................] 616.2 kB 5.9%
🔴 Other bundled files              [########################] 5.10 MB 49.2%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.36 MB

Metric	Value
Public routes	/ /.well-known/workflow/v1/webhook/[token] /eve/v1/activity/[token] /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/task-input/[token]
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	10.36 MB
Function files	10.36 MB across 115 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.24 MB (21.6%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                        [###########.............] 2.24 MB 21.6%
🟡 _libs/undici.mjs                 [#####...................] 980.8 kB 9.5%
🟡 _chunks/esm-Fqlolk7e.mjs         [###.....................] 723.3 kB 7.0%
🟡 _chunks/chatgpt-model.mjs        [###.....................] 699.7 kB 6.8%
🟡 _chunks/signal-exit-Dsy-TT0V.mjs [###.....................] 616.2 kB 5.9%
🔴 Other bundled files              [########################] 5.10 MB 49.2%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 6.10 s -> 6.02 s (-86.1 ms) vs main (56cde32).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (56cde32)`

Phase	Baseline	Current	Delta
extension.check	1.0 ms	1.0 ms	0.0 ms
project.resolve	0.3 ms	0.3 ms	0.0 ms
workspace.create	8.6 ms	0.5 ms	-8.1 ms
host.prepare	501.8 ms	503.3 ms	+1.5 ms
vercel.service-prefix.resolve	1.8 ms	1.7 ms	-0.1 ms
nitro.create	557.7 ms	556.3 ms	-1.4 ms
sandbox.prewarm	384.6 ms	364.5 ms	-20.1 ms
nitro.cache.prepare	0.3 ms	0.3 ms	0.0 ms
nitro.prepare	0.8 ms	0.7 ms	-0.1 ms
nitro.public-assets	0.8 ms	0.8 ms	0.0 ms
nitro.prerender	0.4 ms	0.5 ms	+0.1 ms
nitro.bundle	4.60 s	4.55 s	-58.7 ms
nitro.cache.write	0.3 ms	0.3 ms	0.0 ms
vercel.workflow-function.materialize	35.0 ms	35.9 ms	+0.9 ms
agent-summary.emit	0.7 ms	0.7 ms	0.0 ms
nitro.close	0.1 ms	0.2 ms	+0.1 ms
output.publish	3.0 ms	3.1 ms	+0.1 ms
workspace.remove	1.7 ms	1.7 ms	0.0 ms