fix(eve): detect credentialed deployment protection

.changeset/bright-dogs-login.md

@@ -0,0 +1,5 @@
+---
+"eve": patch
+---
+
+Start remote authentication when a credentialed Vercel deployment returns an `UNAUTHORIZED` protection response.

packages/eve/src/cli/dev/tui/remote-connection.test.ts

@@ -189,6 +189,16 @@ describe("createRemoteConnectionController", () => {
         challenge: { kind: "vercel-deployment-protection" },
       },
     },
+    {
+      name: "Vercel's credentialed Deployment Protection rejection",
+      error: new ClientError(401, "You must sign in\n\nUNAUTHORIZED\n\niad1::request-id\n", {
+        "x-vercel-error": "UNAUTHORIZED",
+      }),
+      expected: {
+        state: "auth-required",
+        challenge: { kind: "vercel-deployment-protection" },
+      },
+    },
     {
       name: "a 403 Trusted Sources environment mismatch",
       error: new ClientError(403, TRUSTED_SOURCES_MISMATCH),

packages/eve/src/services/dev-client/vercel-auth-error.test.ts

@@ -64,6 +64,16 @@ describe("isVercelAuthChallenge", () => {
     );
   });
 
+  it("detects Vercel's credentialed deployment-protection rejection", () => {
+    expect(
+      isVercelAuthChallenge(
+        new ClientError(401, "You must sign in\n\nUNAUTHORIZED\n\niad1::request-id\n", {
+          "x-vercel-error": "UNAUTHORIZED",
+        }),
+      ),
+    ).toBe(true);
+  });
+
   it("requires HTTP 401 and the complete legacy HTML challenge signature", () => {
     expect(isVercelAuthChallenge(new ClientError(500, VERCEL_SSO_CHALLENGE_BODY))).toBe(false);
     expect(

packages/eve/src/services/dev-client/vercel-auth-error.ts

@@ -72,6 +72,18 @@ function isVercelSsoRedirect(
   return false;
 }
 
+function isVercelUnauthorized(
+  status: number,
+  headers: Readonly<Record<string, unknown>> | undefined,
+): boolean {
+  if (status !== 401 || headers === undefined) return false;
+
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.toLowerCase() === "x-vercel-error" && value === "UNAUTHORIZED") return true;
+  }
+  return false;
+}
+
 function bodyLooksLikeStructuredVercelAuthChallenge(body: string): boolean {
   let payload: unknown;
   try {
@@ -114,6 +126,7 @@ export function isVercelAuthChallenge(error: unknown): boolean {
   const headers = isObject(candidate.headers) ? candidate.headers : undefined;
   return (
     isVercelSsoRedirect(candidate.status, headers) ||
+    isVercelUnauthorized(candidate.status, headers) ||
     (candidate.status === 401 &&
       (bodyLooksLikeVercelAuthChallenge(candidate.body) ||
         bodyLooksLikeStructuredVercelAuthChallenge(candidate.body)))