eve 0.47.5 → 0.47.6

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # eve
 
+## 0.47.6
+
+### Patch Changes
+
+- 63f2e07: Run `Workflow` programs with the official AI SDK code-mode runtime while preserving eve's durable subagent accounting and event stream.
+- 450681a: Upgrade eve and newly generated projects to Zod 4.5, with lazy schema compilation for faster internal validation and substantially lower schema memory overhead. Boolean-only checks now use Zod's validation fast path instead of constructing full parse results.
+
 ## 0.47.5
 
 ### Patch Changes

package/NOTICE

@@ -3,3 +3,75 @@ Copyright 2026 Vercel, Inc. and contributors
 
 This product includes software developed at Vercel, Inc.
 (https://vercel.com/).
+
+The bundled code-mode runtime includes run, Copyright 2023 Vercel, Inc.,
+licensed under the Apache License, Version 2.0.
+
+run embeds devalue 5.8.2, quickjs-wasi 3.6.0, and QuickJS under the MIT
+License. Their notices follow.
+
+devalue
+Copyright (c) 2018-19 devalue contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+quickjs-wasi
+Copyright (c) quickjs-wasi contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+QuickJS Javascript Engine
+Copyright (c) 2017-2026 Fabrice Bellard
+Copyright (c) 2017-2025 Charlie Gordon
+Copyright (c) 2023-2026 Ben Noordhuis
+Copyright (c) 2023-2026 Saúl Ibarra Corretgé
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/src/cli/dev/tui/vercel-trusted-sources.js

@@ -1 +1 @@
-import{trustedSourcesToJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectprojectsbranchmatcher.js";import{updateProjectTrustedSourcesFromJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectblock.js";import{array,object,string,unknown}from"../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/schemas.js";import"../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/index.js";import{planTrustedSourceAccess}from"./vercel-trusted-sources-policy.js";import{captureVercel}from"#setup/primitives/index.js";import{normalizeVercelApiResult}from"#setup/vercel-api-failure.js";const ProjectSchema=object({id:string().min(1),name:string().min(1),customEnvironments:array(object({slug:string().min(1)})).optional(),trustedSources:unknown().nullable().optional()});function parseJson(e){try{return JSON.parse(e)}catch{return}}function parseTrustedSources(e){let n=JSON.stringify(e);if(n===void 0)return;let r=updateProjectTrustedSourcesFromJSON(n);return r.ok?r.value:void 0}function parseProject(e){let t=ProjectSchema.safeParse(parseJson(e));if(!t.success)return;let{trustedSources:n,...r}=t.data;if(n==null)return r;let i=parseTrustedSources(n);return i===void 0?void 0:{...r,trustedSources:i}}const ProjectUpdateSchema=object({id:string().min(1)}),defaultDeps={captureVercel};function environmentLabel(e){switch(e){case`development`:return`Development`;case`preview`:return`Preview`;case`production`:return`Production`;default:return e}}function projectPolicyContext(e){return{projectId:e.id,customEnvironmentSlugs:e.customEnvironments?.map(({slug:e})=>e)??[]}}async function readProject(e){let t=await e.deps.captureVercel([`api`,`/v9/projects/${encodeURIComponent(e.projectId)}`,`--scope`,e.ownerId,`--raw`],{cwd:e.workspaceRoot,nonInteractive:!0,signal:e.signal});if(!t.ok)return{kind:`failed`,message:t.failure.message};let n=parseProject(t.stdout);return n===void 0||n.id!==e.projectId?{kind:`failed`,message:`Vercel returned an invalid project response.`}:{kind:`project`,project:n}}async function prepareVercelTrustedSourceAccess(e){let t={...defaultDeps,...e.deps},n=e.target.deployment,r=await readProject({deps:t,workspaceRoot:e.workspaceRoot,ownerId:n.ownerId,projectId:n.projectId,signal:e.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not read Deployment Protection for ${n.projectName}: ${r.message}`};let{project:i}=r;if(planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:n.environment,trustedSources:i.trustedSources??void 0}).kind===`unchanged`)return{kind:`unchanged`};let a=environmentLabel(`development`),o=environmentLabel(n.environment);return await e.prompter.select({message:`Allow ${a} from ${i.name} to access ${o} deployments of ${i.name}?`,hintLayout:`stacked`,notices:[{tone:`warning`,text:`This changes Deployment Protection for ${i.name} until the Trusted Sources rule is removed.`}],options:[{value:`continue`,label:`Allow access`,hint:`Add ${a} → ${o} to Trusted Sources`},{value:`cancel`,label:`Cancel`,hint:`Leave Deployment Protection unchanged`}]})===`cancel`?{kind:`cancelled`}:{kind:`approved`,grant:{ownerId:n.ownerId,projectId:i.id,projectName:i.name,targetEnvironment:n.environment}}}async function applyVercelTrustedSourceAccess(t){let n={...defaultDeps,...t.deps},r=await readProject({deps:n,workspaceRoot:t.workspaceRoot,ownerId:t.grant.ownerId,projectId:t.grant.projectId,signal:t.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not refresh Deployment Protection for ${t.grant.projectName}: ${r.message}`};let{project:i}=r,a=planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:t.grant.targetEnvironment,trustedSources:i.trustedSources??void 0});if(a.kind===`unchanged`)return{kind:`unchanged`};let o=normalizeVercelApiResult(await n.captureVercel([`api`,`/v9/projects/${encodeURIComponent(i.id)}`,`--scope`,t.grant.ownerId,`--method`,`PATCH`,`--field`,`trustedSources=${trustedSourcesToJSON(a.trustedSources)}`,`--raw`],{cwd:t.workspaceRoot,nonInteractive:!0,signal:t.signal}));if(!o.ok)return{kind:`failed`,message:`Could not update Trusted Sources for ${i.name}: ${o.failure.message}`};let s=ProjectUpdateSchema.safeParse(parseJson(o.stdout));return(s.success?s.data:void 0)?.id===i.id?{kind:`updated`,targetProjectName:i.name}:{kind:`failed`,message:`Vercel returned an invalid project response.`}}export{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess};
+import{trustedSourcesToJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectprojectsbranchmatcher.js";import{updateProjectTrustedSourcesFromJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectblock.js";import{array,object,string,unknown}from"../../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/schemas.js";import"../../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/index.js";import{planTrustedSourceAccess}from"./vercel-trusted-sources-policy.js";import{captureVercel}from"#setup/primitives/index.js";import{normalizeVercelApiResult}from"#setup/vercel-api-failure.js";const ProjectSchema=object({id:string().min(1),name:string().min(1),customEnvironments:array(object({slug:string().min(1)})).optional(),trustedSources:unknown().nullable().optional()});function parseJson(e){try{return JSON.parse(e)}catch{return}}function parseTrustedSources(e){let n=JSON.stringify(e);if(n===void 0)return;let r=updateProjectTrustedSourcesFromJSON(n);return r.ok?r.value:void 0}function parseProject(e){let t=ProjectSchema.safeParse(parseJson(e));if(!t.success)return;let{trustedSources:n,...r}=t.data;if(n==null)return r;let i=parseTrustedSources(n);return i===void 0?void 0:{...r,trustedSources:i}}const ProjectUpdateSchema=object({id:string().min(1)}),defaultDeps={captureVercel};function environmentLabel(e){switch(e){case`development`:return`Development`;case`preview`:return`Preview`;case`production`:return`Production`;default:return e}}function projectPolicyContext(e){return{projectId:e.id,customEnvironmentSlugs:e.customEnvironments?.map(({slug:e})=>e)??[]}}async function readProject(e){let t=await e.deps.captureVercel([`api`,`/v9/projects/${encodeURIComponent(e.projectId)}`,`--scope`,e.ownerId,`--raw`],{cwd:e.workspaceRoot,nonInteractive:!0,signal:e.signal});if(!t.ok)return{kind:`failed`,message:t.failure.message};let n=parseProject(t.stdout);return n===void 0||n.id!==e.projectId?{kind:`failed`,message:`Vercel returned an invalid project response.`}:{kind:`project`,project:n}}async function prepareVercelTrustedSourceAccess(e){let t={...defaultDeps,...e.deps},n=e.target.deployment,r=await readProject({deps:t,workspaceRoot:e.workspaceRoot,ownerId:n.ownerId,projectId:n.projectId,signal:e.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not read Deployment Protection for ${n.projectName}: ${r.message}`};let{project:i}=r;if(planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:n.environment,trustedSources:i.trustedSources??void 0}).kind===`unchanged`)return{kind:`unchanged`};let a=environmentLabel(`development`),o=environmentLabel(n.environment);return await e.prompter.select({message:`Allow ${a} from ${i.name} to access ${o} deployments of ${i.name}?`,hintLayout:`stacked`,notices:[{tone:`warning`,text:`This changes Deployment Protection for ${i.name} until the Trusted Sources rule is removed.`}],options:[{value:`continue`,label:`Allow access`,hint:`Add ${a} → ${o} to Trusted Sources`},{value:`cancel`,label:`Cancel`,hint:`Leave Deployment Protection unchanged`}]})===`cancel`?{kind:`cancelled`}:{kind:`approved`,grant:{ownerId:n.ownerId,projectId:i.id,projectName:i.name,targetEnvironment:n.environment}}}async function applyVercelTrustedSourceAccess(t){let n={...defaultDeps,...t.deps},r=await readProject({deps:n,workspaceRoot:t.workspaceRoot,ownerId:t.grant.ownerId,projectId:t.grant.projectId,signal:t.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not refresh Deployment Protection for ${t.grant.projectName}: ${r.message}`};let{project:i}=r,a=planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:t.grant.targetEnvironment,trustedSources:i.trustedSources??void 0});if(a.kind===`unchanged`)return{kind:`unchanged`};let o=normalizeVercelApiResult(await n.captureVercel([`api`,`/v9/projects/${encodeURIComponent(i.id)}`,`--scope`,t.grant.ownerId,`--method`,`PATCH`,`--field`,`trustedSources=${trustedSourcesToJSON(a.trustedSources)}`,`--raw`],{cwd:t.workspaceRoot,nonInteractive:!0,signal:t.signal}));if(!o.ok)return{kind:`failed`,message:`Could not update Trusted Sources for ${i.name}: ${o.failure.message}`};let s=ProjectUpdateSchema.safeParse(parseJson(o.stdout));return(s.success?s.data:void 0)?.id===i.id?{kind:`updated`,targetProjectName:i.name}:{kind:`failed`,message:`Vercel returned an invalid project response.`}}export{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess};

package/dist/src/cli/invoke/result.d.ts

@@ -156,7 +156,7 @@ export declare const invokeResultJsonSchema: {
     $vocabulary?: Record<string, boolean>;
     $comment?: string;
     $defs?: Record<string, z.core.JSONSchema.JSONSchema>;
-    type?: "object" | "array" | "string" | "number" | "boolean" | "null" | "integer";
+    type?: z.core.JSONSchema.SchemaType | z.core.JSONSchema.SchemaType[];
     additionalItems?: z.core.JSONSchema._JSONSchema;
     unevaluatedItems?: z.core.JSONSchema._JSONSchema;
     prefixItems?: z.core.JSONSchema._JSONSchema[];

package/dist/src/compiled/.vendor-stamp.json

@@ -2,13 +2,13 @@
   "moduleVersions": {
     "@agentclientprotocol/sdk": "1.3.0",
     "@ai-sdk/anthropic": "4.0.36",
+    "@ai-sdk/code-mode": "1.0.39",
     "chat": "4.34.0",
     "@chat-adapter/slack": "4.34.0",
     "@chat-adapter/state-memory": "4.34.0",
     "@chat-adapter/twilio": "4.34.0",
     "chokidar": "5.0.0",
     "commander": "14.0.3",
-    "experimental-ai-sdk-code-mode": "1.0.16",
     "eventsource-parser": "3.1.0",
     "env-runner": "0.1.16",
     "@ai-sdk/google": "4.0.39",
@@ -26,8 +26,8 @@
     "@photon-ai/chat-adapter-imessage": "3.2.0",
     "@linqapp/chat-sdk-adapter": "0.5.1",
     "picocolors": "1.1.1",
-    "@ai-sdk/provider": "4.0.7",
-    "@ai-sdk/provider-utils": "5.0.25",
+    "@ai-sdk/provider": "4.0.8",
+    "@ai-sdk/provider-utils": "5.0.33",
     "semver": "7.8.4",
     "shadcn": "4.18.0",
     "@standard-schema/spec": "1.1.0",
@@ -45,10 +45,10 @@
     "@workflow/world": "5.0.0-beta.28",
     "@workflow/world-local": "5.0.0-beta.37",
     "@workflow/world-vercel": "5.0.0-beta.39",
-    "zod": "4.4.3",
+    "zod": "4.5.4",
     "zod-validation-error": "5.0.0"
   },
-  "scriptHash": "8dceaacca7c5165a215e4f8db7a34416b3010b4699d34c507aab73b254f2bcb1",
+  "scriptHash": "c2f4247b3722df8ea8b6c8d63b55f9b21478e9d73ca501f3e30c698eb0a16311",
   "toolVersions": {
     "rolldown": "1.1.5"
   }