feat(eve): models - set provider safety identifiers from auth

[AndrewBarba]

Summary

OpenAI and Anthropic end-user safety identifiers currently require each agent to thread user identity into provider options manually. eve now derives a privacy-preserving fingerprint from the active auth.current principal and supplies it as openai.safetyIdentifier or anthropic.metadata.userId, including during compaction. Framework defaults are deeply merged beneath authored provider options, so authored identifiers and neighboring nested options remain authoritative; null auth and other providers remain unchanged. The merge is constrained to plain records, with arrays and scalar values replaced by the authored override.

Validation

Focused unit and harness coverage passed with 214 tests, covering both provider shapes, recursive merge semantics, authored-value precedence, caller changes across turns, null-auth and unsupported-provider boundaries, and compaction propagation. The updated documentation also passed its compile and link checks.

Checklist

• This change was requested or approved by a maintainer
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

Diff size

Docs — 2 files · +18 / -0

Documents both provider paths, privacy and precedence semantics, compaction behavior, and the release note.

Implementation — 4 files · +73 / -2

Adds the provider-neutral safety enrichment and a small plain-record deep merge, then applies it to normal and compaction model calls.

Tests — 3 files · +277 / -1

Covers disjoint and conflicting nested keys, replacement and prototype-safety boundaries, both provider option shapes, per-turn caller changes, and compaction propagation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview, v0	Aug 25, 2026 7:51pm
eve-docs-4759	Ready	Preview, v0	Aug 25, 2026 7:51pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
eve-pkg	Skipped	v0	Aug 25, 2026 7:51pm

[github-actions]

Bundle + Package Summary: apps/fixtures/weather-agent

Key takeaways

• No notable deltas vs main (d2995e1).

Delta vs main (d2995e1)

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	8.22 MB	8.22 MB	+1.4 kB ⚠️
Package	Unpacked publish size	30.99 MB	30.99 MB	+2.8 kB ⚠️
Package	Installed footprint	75.20 MB	75.20 MB	+2.8 kB ⚠️
Package	Published files	3497	3501	+4
Package	Installed files	7212	7216	+4
Package	Installed package instances	35	35	0
Package	Distinct installed package names	34	34	0
Package	Installed dependency edges	53	53	0
Package	Installed optional peer edges	47	47	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	18.37 MB	18.37 MB	+2.5 kB ⚠️
Runtime	Public routes	16	16	0

Changed function payloads vs main (d2995e1) (2)

Function	Status	Baseline	Current	Delta	Route changes
functions/__server.func	changed	9.18 MB	9.19 MB	+1.3 kB ⚠️	none
functions/.well-known/workflow/v1/flow.func	changed	9.18 MB	9.19 MB	+1.3 kB ⚠️	none

eve init install

Metric	Baseline	Current	Delta
Installed footprint	113.64 MB	113.64 MB	+2.8 kB ⚠️
Installed packages	120	120	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	45.59 MB	45.60 MB	+2.8 kB ⚠️
devDependency package bytes	5.04 MB	5.04 MB	0 B ➖

Build Metadata

• Preset: vercel
• Nitro: nitro@3.0.260610-beta
• Output directory: apps/fixtures/weather-agent/.vercel/output
• Build metadata timestamp: 2026-08-25T19:52:05.996Z
• Route aliases: 16 public, 1 internal (17 total aliases)
• Vercel routes in config: 19
• Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

• Package: eve@0.44.4
• Package directory: packages/eve
• Tarball: 8.22 MB (eve-0.44.4.tgz)
• Unpacked payload: 30.99 MB across 3501 published files
• Installed footprint: 75.20 MB across 7216 installed files
• Installed root package: 29.64 MB
• Installed dependencies: 45.57 MB
• Installed package instances: 35
• Distinct installed package names: 34
• Installed dependency edges: 53
• Installed optional peer edges: 47
• Runtime dependencies: 2
• Peer dependencies: 5 (4 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

• eve: 29.64 MB (39.4%)
• @rolldown/binding-linux-x64-gnu: 19.91 MB (26.5%)
• ai: 6.77 MB (9.0%)
• zod: 5.07 MB (6.7%)
• undici: 3.50 MB (4.7%)

Publish payload breakdown

Published file size
🔴 dist/src/compiled/shadcn-registry/index.js       [##############..........] 9.76 MB 31.5%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [####....................] 2.44 MB 7.9%
🟠 dist/src/compiled/experimental-ai-sdk-code-mo... [##......................] 1.51 MB 4.9%
🟡 dist/src/compiled/_chunks/workflow/undici-Dzn... [#.......................] 512.7 kB 1.7%
🟡 dist/src/compiled/_chunks/node/undici-CUIybhQ... [#.......................] 508.8 kB 1.6%
🔴 Other published files                            [########################] 16.26 MB 52.5%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 29.64 MB 39.4%
🔴 @rolldown/binding-linux-x64-gnu [################........] 19.91 MB 26.5%
🔴 ai                              [#####...................] 6.77 MB 9.0%
🔴 zod                             [####....................] 5.07 MB 6.7%
🟠 undici                          [###.....................] 3.50 MB 4.7%
🟠 nitro                           [##......................] 2.41 MB 3.2%
🔴 Other installed packages        [######..................] 7.91 MB 10.5%

Runtime dependencies (2)

Package	Range	Notes
nitro	3.0.260610-beta
undici	8.9.0

Peer dependencies (5)

Package	Range	Notes
@opentelemetry/api	^1.0.0	optional peer
ai	catalog:
braintrust	^3.0.0	optional peer
just-bash	^3.1.0	optional peer
microsandbox	^0.5.0	optional peer

eve init install drill-down

eve init install details

• Command: eve init my-agent
• Package manager: npm
• Installed footprint: 113.64 MB across 9112 installed files
• Installed packages: 120 total (114 transitive-only)
• dependencies: 4 direct packages totaling 45.60 MB
• devDependencies: 2 direct packages totaling 5.04 MB
• Other transitive package files: 63.01 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

• eve: 29.64 MB (26.1%)
• @typescript/typescript-linux-x64: 27.95 MB (24.6%)
• @rolldown/binding-linux-x64-gnu: 19.91 MB (17.5%)
• zod: 9.02 MB (7.9%)
• ai: 6.77 MB (6.0%)

Installed footprint breakdown

Installed package size
🔴 eve                              [########################] 29.64 MB 26.1%
🔴 @typescript/typescript-linux-x64 [#######################.] 27.95 MB 24.6%
🔴 @rolldown/binding-linux-x64-gnu  [################........] 19.91 MB 17.5%
🔴 zod                              [#######.................] 9.02 MB 7.9%
🔴 ai                               [#####...................] 6.77 MB 6.0%
🟠 undici                           [###.....................] 3.50 MB 3.1%
🔴 Other installed packages         [##############..........] 16.85 MB 14.8%

dependencies (4)

Package	Range	Installed size	Share
@vercel/connect	1.0.0	167.9 kB	0.1%
ai	^7.0.58	6.77 MB	6.0%
eve	file:eve-0.44.4.tgz	29.64 MB	26.1%
zod	4.4.3	9.02 MB	7.9%

devDependencies (2)

Package	Range	Installed size	Share
@types/node	24.x	2.54 MB	2.2%
typescript	7.0.2	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 9.19 MB 50.0%
🔴 functions/__server.func                         [########################] 9.19 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 9.19 MB

Metric	Value
Public routes	/.well-known/workflow/v1/flow
Runtime	nodejs24.x
Handler	index.mjs
Payload	9.19 MB
Function files	9.19 MB across 99 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.03 MB (22.1%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                   [############............] 2.03 MB 22.1%
🟡 _libs/undici.mjs            [######..................] 980.5 kB 10.7%
🟡 _chunks/sandbox.mjs         [#####...................] 781.9 kB 8.5%
🟡 _chunks/frames-Dl2Hcma4.mjs [####....................] 678.7 kB 7.4%
🟡 _chunks/chatgpt-model.mjs   [####....................] 666.7 kB 7.3%
🔴 Other bundled files         [########################] 4.05 MB 44.1%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

---

🟠 functions/__server.func • 15 public routes, 1 internal alias • 9.19 MB

Metric	Value
Public routes	/ /eve/v1/callback/[token] /eve/v1/connections/[name]/callback/[attemptId]/[token] /eve/v1/connections/[name]/callback/[token] /eve/v1/health /eve/v1/info /eve/v1/session /eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream /eve/v1/session/[sessionId] /eve/v1/session/[sessionId]/cancel /eve/v1/session/[sessionId]/clear /eve/v1/session/[sessionId]/compact /eve/v1/session/[sessionId]/reset /eve/v1/session/[sessionId]/stream /eve/v1/task-input/[token]
Internal aliases	/__server
Runtime	nodejs24.x
Handler	index.mjs
Payload	9.19 MB
Function files	9.19 MB across 99 files
Traced dependencies	0 B
Signal	🟠 Bundled file index.mjs is 2.03 MB (22.1%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 index.mjs                   [############............] 2.03 MB 22.1%
🟡 _libs/undici.mjs            [######..................] 980.5 kB 10.7%
🟡 _chunks/sandbox.mjs         [#####...................] 781.9 kB 8.5%
🟡 _chunks/frames-Dl2Hcma4.mjs [####....................] 678.7 kB 7.4%
🟡 _chunks/chatgpt-model.mjs   [####....................] 666.7 kB 7.3%
🔴 Other bundled files         [########################] 4.05 MB 44.1%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: e2e/fixtures/agent-tools-sandbox

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

• Build pipeline: 2.30 s -> 2.33 s (+36.7 ms) vs main (d2995e1).
• Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (d2995e1)`

Phase	Baseline	Current	Delta
extension.check	1.2 ms	1.2 ms	0.0 ms
project.resolve	0.3 ms	0.2 ms	-0.1 ms
workspace.create	0.6 ms	0.6 ms	0.0 ms
host.prepare	412.5 ms	378.3 ms	-34.2 ms
vercel.service-prefix.resolve	1.8 ms	1.6 ms	-0.2 ms
nitro.create	250.4 ms	235.4 ms	-15.0 ms
sandbox.prewarm	223.7 ms	263.3 ms	+39.6 ms
nitro.cache.prepare	0.2 ms	0.3 ms	+0.1 ms
nitro.prepare	0.7 ms	0.7 ms	0.0 ms
nitro.public-assets	0.7 ms	0.7 ms	0.0 ms
nitro.prerender	0.4 ms	0.4 ms	0.0 ms
nitro.bundle	1.37 s	1.41 s	+45.3 ms
nitro.cache.write	0.3 ms	0.3 ms	0.0 ms
vercel.workflow-function.materialize	29.2 ms	30.6 ms	+1.4 ms
agent-summary.emit	0.6 ms	0.6 ms	0.0 ms
nitro.close	0.1 ms	0.1 ms	0.0 ms
output.publish	2.8 ms	2.7 ms	-0.1 ms
workspace.remove	1.6 ms	1.5 ms	-0.1 ms