fix(eve): keep OpenAPI schema refs under $defs instead of inlining them by AndrewBarba · Pull Request #5363 · vercel/eve

AndrewBarba · 2026-10-26T17:52:30Z

Summary

OpenAPI connection tools rejected valid deeply nested input, such as the Notion page title in #3267. derefSchema copied every $ref inline and cut schemas past a depth limit to {}, so both oneOf branches matched anything and validation failed. Raising the limit (#4885, closed) would let shared non-cyclic refs grow exponentially: a 2.7 KB spec ran out of memory.

Each operation's input schema now keeps the component schemas it references under $defs, once each, and points at them. Connection tools are deferred behind eve__search and eve__tool, so this schema never reaches a model provider. Only eve's validator, signature renderer, and search ranking read it, and each now resolves local refs. Validation applies at every depth, and an operation's schema grows with the size of the schemas it references instead of exponentially.

Hostile or unusual specs stay bounded and validated:

Conversion uses a worklist, so long $ref chains cannot overflow the stack. A schema nested too deeply to convert drops only its own operation.
A pure $ref alias cycle becomes {}, as before.
$id, $anchor, and $schema are dropped, because they would re-root the #/$defs refs.
A component named __proto__ still gets a real key.
Signatures and search ranking follow $ref chains for descriptions and constraints. This also helps MCP tools whose schemas use $defs.

Total memory still scales with operations × the schemas each one references. That is not new: main copied the same closures inline.

Closes #3267. Includes the repro test from #4883.

Validation

pnpm --filter eve exec vitest run --config vitest.unit.config.ts src/runtime/connections/ src/execution/catalog/ src/tools/: 35 files, 469 tests pass.
With main's openapi-schema.ts and openapi-client.ts, the first 3 new tests fail:
- The OpenAPI schema depth truncation rejects valid nested Notion titles #3267 title is rejected.
- An invalid value 20 levels deep in a recursive schema is accepted.
- The fan-out spec produces 122,252 bytes against a 7,212-byte bound.
With the first commit's production files, the hardening tests fail: alias cycle, $id, __proto__, long chain, deep-nesting isolation, alias-chain comments, and ranking by a referenced description.
Public GitHub (1242 operations) and Stripe (612 operations) specs, compared with main:
- Rendered signatures are byte-identical (0 differences).
- Input schema totals: 1076 → 1120 KB (GitHub), 1608 → 1626 KB (Stripe).
- Build and validation time unchanged, and no schema falls back to unvalidated pass-through.
A fresh-context review found nothing critical. Its findings are fixed in the second commit.
pnpm fmt, pnpm lint, pnpm --filter eve typecheck, pnpm guard:invariants, git diff --check: pass.
Full unit tier: 8 files fail only because this worktree has no dist build (self-modification/*, authored-package-boundary). They are unrelated to this change.

Checklist

I added tests and documentation where relevant
I added a changeset if this touches the published eve package
DCO sign-off passes for every commit (git commit --signoff)

OpenAPI connection tools copied every $ref inline up to a depth limit. The limit cut valid deep schemas to {}, so the Notion title in #3267 matched both oneOf branches and was rejected. Raising the limit instead lets shared, non-cyclic refs grow exponentially. Each operation now keeps the component schemas it references under $defs and points at them, so the validator and signature renderer resolve them directly. Signatures also take a referenced property's description and constraints from its target, keeping them identical to before. Closes #3267 Signed-off-by: Andrew Barba <barba@hey.com>

vercel · 2026-10-26T17:52:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Oct 26, 2026 6:02pm UTC
eve-pkg	Ready	Preview, v0	Oct 26, 2026 6:02pm UTC

github-actions · 2026-10-26T17:55:53Z

Bundle + Package Summary: `apps/fixtures/weather-agent`

Key takeaways

No notable deltas vs main (b335912).

Delta vs `main (b335912)`

Area	Metric	Baseline	Current	Delta
Package	Packed tarball	7.79 MB	7.79 MB	+797 B ⚠️
Package	Unpacked publish size	27.34 MB	27.34 MB	+2.2 kB ⚠️
Package	Installed footprint	75.65 MB	75.66 MB	+2.2 kB ⚠️
Package	Published files	4230	4230	0
Package	Installed files	8223	8223	0
Package	Installed package instances	34	34	0
Package	Distinct installed package names	32	32	0
Package	Installed dependency edges	51	51	0
Package	Installed optional peer edges	9	9	0
Runtime	Unique function payloads	2	2	0
Runtime	Total function bytes	20.93 MB	20.93 MB	+4.9 kB ⚠️
Runtime	Public routes	18	18	0

Changed function payloads vs main (b335912) (2)

Function	Status	Baseline	Current	Delta	Route changes
`functions/__server.func`	changed	10.46 MB	10.47 MB	+2.4 kB ⚠️	none
`functions/.well-known/workflow/v1/flow.func`	changed	10.46 MB	10.47 MB	+2.4 kB ⚠️	none

`eve init` install

Metric	Baseline	Current	Delta
Installed footprint	114.04 MB	114.04 MB	+2.2 kB ⚠️
Installed packages	97	97	0
dependencies	4	4	0
devDependencies	2	2	0
Dependency package bytes	45.74 MB	45.74 MB	+2.2 kB ⚠️
devDependency package bytes	5.11 MB	5.11 MB	0 B ➖

Build Metadata

Preset: vercel
Nitro: nitro@3.0.260903-beta
Output directory: apps/fixtures/weather-agent/.vercel/output
Build metadata timestamp: 2026-10-26T18:01:29.159Z
Route aliases: 18 public, 1 internal (19 total aliases)
Vercel routes in config: 21
Severity legend: 🔴 dominant/large, 🟠 notable, 🟡 watch, ⚪ small

Package Drill-Down

Package Details

Package: eve@0.83.2
Package directory: packages/eve
Tarball: 7.79 MB (eve-0.83.2.tgz)
Unpacked payload: 27.34 MB across 4230 published files
Installed footprint: 75.66 MB across 8223 installed files
Installed root package: 27.34 MB
Installed dependencies: 48.32 MB
Installed package instances: 34
Distinct installed package names: 32
Installed dependency edges: 51
Installed optional peer edges: 9
Runtime dependencies: 2
Peer dependencies: 7 (6 optional)

Installed footprint is measured from an isolated temporary npm install of the packed tarball.
Graph metrics read only package.json files in package directories directly beneath a node_modules boundary, including nested boundaries. Each directory is one package instance; distinct names come from those manifests. Dependency edges count each unique name in dependencies or optionalDependencies per instance; optional peer edges count peerDependencies marked optional.

Heavy installed dependencies

eve: 27.34 MB (36.1%)
@rolldown/binding-linux-x64-gnu: 19.89 MB (26.3%)
ai: 8.37 MB (11.1%)
zod: 6.15 MB (8.1%)
undici: 3.58 MB (4.7%)

Publish payload breakdown

Published file size
🟠 dist/src/compiled/shadcn-registry/index.js       [#####...................] 3.85 MB 14.1%
🟠 dist/src/compiled/@photon-ai/chat-adapter-ime... [###.....................] 2.29 MB 8.4%
🟠 dist/src/compiled/run/index.js                   [#.......................] 1.00 MB 3.7%
🟡 dist/src/compiled/@vercel/blob/index.js          [#.......................] 604.9 kB 2.2%
🟡 dist/src/compiled/_chunks/workflow/undici-D-I... [#.......................] 521.9 kB 1.9%
🔴 Other published files                            [########################] 19.07 MB 69.8%

Installed footprint breakdown

Installed package size
🔴 eve                             [########################] 27.34 MB 36.1%
🔴 @rolldown/binding-linux-x64-gnu [#################.......] 19.89 MB 26.3%
🔴 ai                              [#######.................] 8.37 MB 11.1%
🔴 zod                             [#####...................] 6.15 MB 8.1%
🟠 undici                          [###.....................] 3.58 MB 4.7%
🟠 nitro                           [##......................] 1.89 MB 2.5%
🔴 Other installed packages        [#######.................] 8.43 MB 11.1%

Runtime dependencies (2)

Package	Range	Notes
`nitro`	`3.0.260903-beta`
`undici`	`8.10.2`

Peer dependencies (7)

Package	Range	Notes
`@opentelemetry/api`	`^1.0.0`	optional peer
`ai`	`catalog:`
`braintrust`	`^3.0.0`	optional peer
`chat`	`^4.42.0`	optional peer
`dd-trace`	`^6.13.0`	optional peer
`just-bash`	`^3.1.0`	optional peer
`next`	`^16.0.0`	optional peer

eve init install drill-down

`eve init` install details

Command: eve init my-agent
Package manager: npm
Installed footprint: 114.04 MB across 10140 installed files
Installed packages: 97 total (91 transitive-only)
dependencies: 4 direct packages totaling 45.74 MB
devDependencies: 2 direct packages totaling 5.11 MB
Other transitive package files: 63.18 MB

Installed footprint is measured from an isolated temporary eve init my-agent using the current packed eve tarball.

Heavy installed dependencies

@typescript/typescript-linux-x64: 27.95 MB (24.5%)
eve: 27.34 MB (24.0%)
@rolldown/binding-linux-x64-gnu: 19.89 MB (17.4%)
zod: 9.76 MB (8.6%)
ai: 8.37 MB (7.3%)

Installed footprint breakdown

Installed package size
🔴 @typescript/typescript-linux-x64 [########################] 27.95 MB 24.5%
🔴 eve                              [#######################.] 27.34 MB 24.0%
🔴 @rolldown/binding-linux-x64-gnu  [#################.......] 19.89 MB 17.4%
🔴 zod                              [########................] 9.76 MB 8.6%
🔴 ai                               [#######.................] 8.37 MB 7.3%
🟠 undici                           [###.....................] 3.58 MB 3.1%
🔴 Other installed packages         [###############.........] 17.16 MB 15.0%

dependencies (4)

Package	Range	Installed size	Share
`@vercel/connect`	`2.5.2`	276.3 kB	0.2%
`ai`	`^7.0.137`	8.37 MB	7.3%
`eve`	`file:eve-0.83.2.tgz`	27.34 MB	24.0%
`zod`	`4.5.4`	9.76 MB	8.6%

devDependencies (2)

Package	Range	Installed size	Share
`@types/node`	`24.x`	2.61 MB	2.3%
`typescript`	`7.0.2`	2.50 MB	2.2%

Function Drill-Down

Payload Size Graph

Unique function payload size and share of total
🔴 functions/.well-known/workflow/v1/flow.func     [########################] 10.47 MB 50.0%
🔴 functions/__server.func                         [########################] 10.47 MB 50.0%

Top Function Payloads

🟠 functions/.well-known/workflow/v1/flow.func • 1 public route • 10.47 MB

Metric	Value
Public routes	`/.well-known/workflow/v1/flow`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	10.47 MB
Function files	10.47 MB across 121 files
Traced dependencies	0 B
Signal	🟠 Bundled file `_chunks/vercel.web.mjs` is 2.50 MB (23.9%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.50 MB 23.9%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.5%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.8%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 732.3 kB 7.0%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.7%
🔴 Other bundled files                            [########################] 4.72 MB 45.1%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x",
  "maxDuration": "max",
  "experimentalTriggers": [
    {
      "type": "queue/v2beta",
      "topic": "__eve776561746865722d6167656e74_wkf_workflow_*",
      "consumer": "default",
      "retryAfterSeconds": 5,
      "initialDelaySeconds": 0
    }
  ],
  "environment": {
    "WORKFLOW_PRECONDITION_GUARD": "1"
  }
}

🟠 functions/__server.func • 17 public routes, 1 internal alias • 10.47 MB

Metric	Value
Public routes	`/` `/.well-known/workflow/v1/webhook/[token]` `/eve/v1/callback/[token]` `/eve/v1/connections/[name]/callback/[attemptId]/[token]` `/eve/v1/connections/[name]/callback/[token]` `/eve/v1/health` `/eve/v1/info` `/eve/v1/session` `/eve/v1/session/[parentSessionId]/subagents/[callId]/[childSessionId]/stream` `/eve/v1/session/[sessionId]` `/eve/v1/session/[sessionId]/cancel` `/eve/v1/session/[sessionId]/clear` `/eve/v1/session/[sessionId]/compact` `/eve/v1/session/[sessionId]/reset` `/eve/v1/session/[sessionId]/stream` `/eve/v1/session/[sessionId]/stubs` `/eve/v1/task-input/[token]`
Internal aliases	`/__server`
Runtime	`nodejs24.x`
Handler	`index.mjs`
Payload	10.47 MB
Function files	10.47 MB across 121 files
Traced dependencies	0 B
Signal	🟠 Bundled file `_chunks/vercel.web.mjs` is 2.50 MB (23.9%)

🟠 🔎 Dependency Analysis

📦 Bundled files:

Bundled file size
🟠 _chunks/vercel.web.mjs                         [#############...........] 2.50 MB 23.9%
🟡 _libs/undici.mjs                               [#####...................] 994.5 kB 9.5%
🟡 _chunks/sandbox2.mjs                           [####....................] 815.0 kB 7.8%
🟡 _chunks/compiled-artifacts-instrumentation.mjs [####....................] 732.3 kB 7.0%
🟡 _chunks/token-util-Bla5Z0G9.mjs                [####....................] 704.5 kB 6.7%
🔴 Other bundled files                            [########################] 4.72 MB 45.1%

🧾 Vercel Config

{
  "handler": "index.mjs",
  "launcherType": "Nodejs",
  "shouldAddHelpers": false,
  "supportsResponseStreaming": true,
  "runtime": "nodejs24.x"
}

Build Timing: `e2e/fixtures/agent-tools-sandbox`

This is an informational timing measurement inside eve build, from preflight through publication. Output-size measurement and profile writing are excluded.

Build mode: deployable Vercel build with sandbox template prewarm included.

Build pipeline: 4.03 s -> 4.25 s (+218.7 ms) vs main (b335912).
Timing is informational: shared GitHub runners are too variable for a hard timing budget.

Detailed phase timings vs `main (b335912)`

Phase	Baseline	Current	Delta
`extension.check`	16.0 ms	0.5 ms	-15.5 ms
`project.resolve`	0.4 ms	0.4 ms	0.0 ms
`workspace.create`	0.5 ms	0.6 ms	+0.1 ms
`host.prepare`	605.1 ms	507.0 ms	-98.1 ms
`vercel.service-prefix.resolve`	2.1 ms	2.1 ms	0.0 ms
`nitro.create`	724.6 ms	722.9 ms	-1.7 ms
`sandbox.prewarm`	393.2 ms	715.1 ms	+321.9 ms
`nitro.cache.prepare`	0.3 ms	0.3 ms	0.0 ms
`nitro.prepare`	0.8 ms	0.8 ms	0.0 ms
`nitro.public-assets`	0.8 ms	0.8 ms	0.0 ms
`nitro.prerender`	0.6 ms	0.6 ms	0.0 ms
`nitro.bundle`	2.12 s	2.13 s	+7.1 ms
`nitro.cache.write`	0.4 ms	0.4 ms	0.0 ms
`vercel.workflow-function.materialize`	58.4 ms	56.4 ms	-2.0 ms
`agent-summary.emit`	0.7 ms	0.7 ms	0.0 ms
`connect-manifest.emit`	0.4 ms	0.4 ms	0.0 ms
`nitro.close`	0.1 ms	0.1 ms	0.0 ms
`output.publish`	3.6 ms	3.5 ms	-0.1 ms
`workspace.remove`	2.8 ms	3.0 ms	+0.2 ms

Convert $ref targets from a worklist so long chains cannot overflow the stack, and omit only the operation whose schema nests too deeply to convert. Keep validation working for $ref alias cycles, components with $id, and components named __proto__. Follow $ref alias chains for signature comments, and resolve referenced property descriptions for search ranking. Signed-off-by: Andrew Barba <barba@hey.com>

AndrewBarba requested a review from a team as a code owner October 26, 2026 17:52

AndrewBarba mentioned this pull request Oct 26, 2026

test(eve): pin nested OpenAPI union truncation rejecting valid input (#3267) #4883

Closed

vercel Bot deployed to Preview – eve-pkg October 26, 2026 17:53

View deployment

vercel Bot deployed to Preview – eve-docs October 26, 2026 17:55

View deployment

vercel Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread packages/eve/src/tools/signature.ts Resolved

vercel Bot deployed to Preview – eve-pkg October 26, 2026 17:59

View deployment

vercel Bot deployed to Preview – eve-docs October 26, 2026 18:02

View deployment

roboeve Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread packages/eve/src/tools/signature.ts Resolved

Comment thread packages/eve/src/runtime/connections/openapi-schema.ts Resolved

AndrewBarba enabled auto-merge (squash) October 26, 2026 18:15

AndrewBarba disabled auto-merge October 26, 2026 18:15

AndrewBarba merged commit 9a55d23 into main Oct 26, 2026
165 of 167 checks passed

AndrewBarba deleted the fix/openapi-schema-defs branch October 26, 2026 18:16

Navigation Menu

Repository navigation

fix(eve): keep OpenAPI schema refs under $defs instead of inlining them - #5363

fix(eve): keep OpenAPI schema refs under $defs instead of inlining them#5363
AndrewBarba merged 2 commits into
mainfrom
fix/openapi-schema-defs

AndrewBarba commented Oct 26, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Package Details

`eve init` install details

Payload Size Graph

Top Function Payloads

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

AndrewBarba commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Checklist

Uh oh!

vercel Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle + Package Summary: apps/fixtures/weather-agent

Delta vs main (b335912)

eve init install

Package Details

eve init install details

Payload Size Graph

Top Function Payloads

Build Timing: e2e/fixtures/agent-tools-sandbox

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AndrewBarba commented Oct 26, 2026 •

edited

Loading

vercel Bot commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Bundle + Package Summary: `apps/fixtures/weather-agent`

Delta vs `main (b335912)`

`eve init` install

`eve init` install details

Build Timing: `e2e/fixtures/agent-tools-sandbox`