@effect-agent/platform-cloudflare 0.1.0-beta.75 → 0.1.0-beta.77

package/dist/CloudflareAiGateway.d.mts

@@ -0,0 +1,64 @@
+import { Layer, Redacted } from "effect";
+import { HttpClient } from "effect/unstable/http";
+declare namespace CloudflareAiGateway_d_exports {
+  export { ClientOptions, ProviderOptions, RestOptions, RouteOptions, provide, provider, rest };
+}
+/** Options understood by upstream Effect AI clients; no model or provider wrapper is created. */
+interface ClientOptions {
+  readonly apiUrl: string;
+  readonly transformClient: (client: HttpClient.HttpClient) => HttpClient.HttpClient;
+}
+interface ProviderOptions {
+  readonly accountId: string;
+  readonly gatewayId: string;
+  /** Cloudflare's provider path, such as openai, anthropic, google-ai-studio, or perplexity-ai. */
+  readonly provider: string;
+  /** Omit only for an unauthenticated gateway with a separately supplied provider key. */
+  readonly apiToken?: Redacted.Redacted<string>;
+}
+interface RestOptions {
+  readonly accountId: string;
+  readonly gatewayId: string;
+  /** Cloudflare API token with Workers AI Read permission. */
+  readonly apiToken: Redacted.Redacted<string>;
+  /** Matches the paths appended by the upstream Effect client. */
+  readonly protocol: "responses" | "chat-completions" | "messages";
+}
+/** Choose exactly one route: a native provider path or an account REST protocol. */
+type RouteOptions = (ProviderOptions & {
+  readonly protocol?: never;
+}) | (RestOptions & {
+  readonly provider?: never;
+});
+/**
+ * Provider-native proxy for model calls, streaming, embeddings, and hosted tools supported
+ * by that provider. Pass the result to the upstream client's layer along with its apiKey
+ * for BYOK-in-request, or omit apiKey for Gateway stored keys / Unified Billing.
+ * Provider model names and request bodies pass through unchanged. This module is Node-safe.
+ * Custom transforms and redirect policies must retain this endpoint and credential boundary.
+ */
+declare const provider: (options: ProviderOptions) => ClientOptions;
+/**
+ * Cloudflare's account REST API (not the deprecated /compat API). Use provider-qualified
+ * model names, e.g. openai/gpt-4.1 or anthropic/claude-haiku-4.5, and omit provider apiKey.
+ * OpenAI clients append /responses or /chat/completions; Anthropic appends /v1/messages.
+ * Compatibility remains the responsibility of the selected upstream client and model.
+ */
+declare const rest: (options: RestOptions) => ClientOptions;
+/**
+ * Provide a Gateway-configured upstream client directly in a Layer pipeline.
+ * Pass the client's `layer` factory, or a callback adding client-specific options.
+ * The factory's errors and remaining services (such as HttpClient) stay visible.
+ * Model selection and resource ownership remain with the supplied upstream Layers.
+ *
+ * @example
+ * ```ts
+ * AnthropicLanguageModel.model("claude-haiku-4-5").pipe(
+ *   Gateway.provide(AnthropicClient.layer, { ...options, provider: "anthropic" }),
+ * )
+ * ```
+ */
+declare const provide: <Client, E, R>(clientLayer: (options: ClientOptions) => Layer.Layer<Client, E, R>, options: RouteOptions) => <RIn2, E2, ROut2>(self: Layer.Layer<ROut2, E2, RIn2>) => Layer.Layer<ROut2, E | E2, R | Exclude<RIn2, Client>>;
+//#endregion
+export { ClientOptions, ProviderOptions, RestOptions, RouteOptions, provide, provider, rest, CloudflareAiGateway_d_exports as t };
+//# sourceMappingURL=CloudflareAiGateway.d.mts.map

package/dist/CloudflareAiGateway.mjs

@@ -0,0 +1,70 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { Context, Effect, Layer, Option, Redactable, Redacted, Schema } from "effect";
+import { FetchHttpClient, Headers, HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
+//#region src/CloudflareAiGateway.ts
+var CloudflareAiGateway_exports = /* @__PURE__ */ __exportAll({
+	provide: () => provide,
+	provider: () => provider,
+	rest: () => rest
+});
+const Segment = Schema.NonEmptyString.check(Schema.isMaxLength(256), Schema.isPattern(/^[a-zA-Z0-9_-]+$/));
+const decodeSegment = Schema.decodeUnknownSync(Segment);
+const redactGatewayToken = (headers, tokenHeader) => {
+	Object.defineProperty(headers, Redactable.symbolRedactable, {
+		configurable: true,
+		value: (context) => Headers.redact(headers, [...Context.get(context, Headers.CurrentRedactedNames), tokenHeader])
+	});
+};
+const clientOptions = (apiUrl, tokenHeader, apiToken, gatewayId) => Object.freeze({
+	apiUrl,
+	transformClient: (client) => client.pipe(HttpClient.mapRequestEffect((request) => {
+		const url = URL.parse(request.url);
+		if (url === null || url.username !== "" || url.password !== "" || !(url.href === apiUrl || url.href.startsWith(`${apiUrl}/`))) return Effect.fail(new HttpClientError.HttpClientError({ reason: new HttpClientError.InvalidUrlError({
+			request,
+			description: "Request is outside the configured Cloudflare AI Gateway endpoint"
+		}) }));
+		let prepared = request;
+		if (apiToken !== void 0) prepared = HttpClientRequest.setHeader(prepared, tokenHeader, `Bearer ${Redacted.value(apiToken)}`);
+		if (gatewayId !== void 0) prepared = HttpClientRequest.setHeader(prepared, "cf-aig-gateway-id", gatewayId);
+		return Effect.succeed(prepared);
+	}), HttpClient.transformResponse((effect) => Effect.gen(function* () {
+		const defaults = yield* Effect.serviceOption(FetchHttpClient.RequestInit);
+		return yield* effect.pipe(Effect.provideService(FetchHttpClient.RequestInit, {
+			...Option.getOrElse(defaults, () => ({})),
+			redirect: "error"
+		}));
+	})), HttpClient.transformResponse((effect) => effect.pipe(Effect.tap((response) => Effect.sync(() => redactGatewayToken(response.request.headers, tokenHeader))), Effect.tapError((error) => Effect.sync(() => redactGatewayToken(error.reason.request.headers, tokenHeader))), Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, tokenHeader]))))
+});
+/**
+* Provider-native proxy for model calls, streaming, embeddings, and hosted tools supported
+* by that provider. Pass the result to the upstream client's layer along with its apiKey
+* for BYOK-in-request, or omit apiKey for Gateway stored keys / Unified Billing.
+* Provider model names and request bodies pass through unchanged. This module is Node-safe.
+* Custom transforms and redirect policies must retain this endpoint and credential boundary.
+*/
+const provider = (options) => clientOptions(`https://gateway.ai.cloudflare.com/v1/${decodeSegment(options.accountId)}/${decodeSegment(options.gatewayId)}/${decodeSegment(options.provider)}`, "cf-aig-authorization", options.apiToken);
+/**
+* Cloudflare's account REST API (not the deprecated /compat API). Use provider-qualified
+* model names, e.g. openai/gpt-4.1 or anthropic/claude-haiku-4.5, and omit provider apiKey.
+* OpenAI clients append /responses or /chat/completions; Anthropic appends /v1/messages.
+* Compatibility remains the responsibility of the selected upstream client and model.
+*/
+const rest = (options) => clientOptions(`https://api.cloudflare.com/client/v4/accounts/${decodeSegment(options.accountId)}/ai${options.protocol === "messages" ? "" : "/v1"}`, "authorization", options.apiToken, decodeSegment(options.gatewayId));
+/**
+* Provide a Gateway-configured upstream client directly in a Layer pipeline.
+* Pass the client's `layer` factory, or a callback adding client-specific options.
+* The factory's errors and remaining services (such as HttpClient) stay visible.
+* Model selection and resource ownership remain with the supplied upstream Layers.
+*
+* @example
+* ```ts
+* AnthropicLanguageModel.model("claude-haiku-4-5").pipe(
+*   Gateway.provide(AnthropicClient.layer, { ...options, provider: "anthropic" }),
+* )
+* ```
+*/
+const provide = (clientLayer, options) => Layer.provide(clientLayer(options.provider !== void 0 ? provider(options) : rest(options)));
+//#endregion
+export { provide, provider, rest, CloudflareAiGateway_exports as t };
+
+//# sourceMappingURL=CloudflareAiGateway.mjs.map

package/dist/CloudflareAiGateway.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareAiGateway.mjs","names":[],"sources":["../src/CloudflareAiGateway.ts"],"sourcesContent":["import { Context, Effect, Layer, Option, Redactable, Redacted, Schema } from \"effect\";\nimport {\n  FetchHttpClient,\n  Headers,\n  HttpClient,\n  HttpClientError,\n  HttpClientRequest,\n} from \"effect/unstable/http\";\n\nconst Segment = Schema.NonEmptyString.check(\n  Schema.isMaxLength(256),\n  Schema.isPattern(/^[a-zA-Z0-9_-]+$/),\n);\n\nconst decodeSegment = Schema.decodeUnknownSync(Segment);\n\n/** Options understood by upstream Effect AI clients; no model or provider wrapper is created. */\nexport interface ClientOptions {\n  readonly apiUrl: string;\n  readonly transformClient: (client: HttpClient.HttpClient) => HttpClient.HttpClient;\n}\n\nexport interface ProviderOptions {\n  readonly accountId: string;\n  readonly gatewayId: string;\n  /** Cloudflare's provider path, such as openai, anthropic, google-ai-studio, or perplexity-ai. */\n  readonly provider: string;\n  /** Omit only for an unauthenticated gateway with a separately supplied provider key. */\n  readonly apiToken?: Redacted.Redacted<string>;\n}\n\nexport interface RestOptions {\n  readonly accountId: string;\n  readonly gatewayId: string;\n  /** Cloudflare API token with Workers AI Read permission. */\n  readonly apiToken: Redacted.Redacted<string>;\n  /** Matches the paths appended by the upstream Effect client. */\n  readonly protocol: \"responses\" | \"chat-completions\" | \"messages\";\n}\n\n/** Choose exactly one route: a native provider path or an account REST protocol. */\nexport type RouteOptions =\n  | (ProviderOptions & { readonly protocol?: never })\n  | (RestOptions & { readonly provider?: never });\n\nconst redactGatewayToken = (headers: Headers.Headers, tokenHeader: string): void => {\n  // HTTP tracing can copy headers after preprocessing. Attach the public redaction\n  // protocol to the final request as well, before a provider builds error details.\n  Object.defineProperty(headers, Redactable.symbolRedactable, {\n    configurable: true,\n    value: (context: Context.Context<never>) =>\n      Headers.redact(headers, [...Context.get(context, Headers.CurrentRedactedNames), tokenHeader]),\n  });\n};\n\nconst clientOptions = (\n  apiUrl: string,\n  tokenHeader: \"authorization\" | \"cf-aig-authorization\",\n  apiToken: Redacted.Redacted<string> | undefined,\n  gatewayId?: string,\n): ClientOptions =>\n  Object.freeze({\n    apiUrl,\n    transformClient: (client: HttpClient.HttpClient) =>\n      client.pipe(\n        HttpClient.mapRequestEffect((request) => {\n          const url = URL.parse(request.url);\n\n          // Check the normalized URL too: dot segments must not escape this account or gateway.\n          if (\n            url === null ||\n            url.username !== \"\" ||\n            url.password !== \"\" ||\n            !(url.href === apiUrl || url.href.startsWith(`${apiUrl}/`))\n          ) {\n            return Effect.fail(\n              new HttpClientError.HttpClientError({\n                reason: new HttpClientError.InvalidUrlError({\n                  request,\n                  description: \"Request is outside the configured Cloudflare AI Gateway endpoint\",\n                }),\n              }),\n            );\n          }\n          let prepared = request;\n\n          if (apiToken !== undefined) {\n            prepared = HttpClientRequest.setHeader(\n              prepared,\n              tokenHeader,\n              `Bearer ${Redacted.value(apiToken)}`,\n            );\n          }\n          if (gatewayId !== undefined) {\n            prepared = HttpClientRequest.setHeader(prepared, \"cf-aig-gateway-id\", gatewayId);\n          }\n\n          return Effect.succeed(prepared);\n        }),\n        HttpClient.transformResponse((effect) =>\n          Effect.gen(function* () {\n            const defaults = yield* Effect.serviceOption(FetchHttpClient.RequestInit);\n\n            return yield* effect.pipe(\n              Effect.provideService(FetchHttpClient.RequestInit, {\n                ...Option.getOrElse(defaults, () => ({})),\n                redirect: \"error\",\n              }),\n            );\n          }),\n        ),\n        HttpClient.transformResponse((effect) =>\n          effect.pipe(\n            Effect.tap((response) =>\n              Effect.sync(() => redactGatewayToken(response.request.headers, tokenHeader)),\n            ),\n            Effect.tapError((error) =>\n              Effect.sync(() => redactGatewayToken(error.reason.request.headers, tokenHeader)),\n            ),\n            Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, tokenHeader]),\n          ),\n        ),\n      ),\n  });\n\n/**\n * Provider-native proxy for model calls, streaming, embeddings, and hosted tools supported\n * by that provider. Pass the result to the upstream client's layer along with its apiKey\n * for BYOK-in-request, or omit apiKey for Gateway stored keys / Unified Billing.\n * Provider model names and request bodies pass through unchanged. This module is Node-safe.\n * Custom transforms and redirect policies must retain this endpoint and credential boundary.\n */\nexport const provider = (options: ProviderOptions): ClientOptions =>\n  clientOptions(\n    `https://gateway.ai.cloudflare.com/v1/${decodeSegment(options.accountId)}/${decodeSegment(options.gatewayId)}/${decodeSegment(options.provider)}`,\n    \"cf-aig-authorization\",\n    options.apiToken,\n  );\n\n/**\n * Cloudflare's account REST API (not the deprecated /compat API). Use provider-qualified\n * model names, e.g. openai/gpt-4.1 or anthropic/claude-haiku-4.5, and omit provider apiKey.\n * OpenAI clients append /responses or /chat/completions; Anthropic appends /v1/messages.\n * Compatibility remains the responsibility of the selected upstream client and model.\n */\nexport const rest = (options: RestOptions): ClientOptions =>\n  clientOptions(\n    `https://api.cloudflare.com/client/v4/accounts/${decodeSegment(options.accountId)}/ai${options.protocol === \"messages\" ? \"\" : \"/v1\"}`,\n    \"authorization\",\n    options.apiToken,\n    decodeSegment(options.gatewayId),\n  );\n\n/**\n * Provide a Gateway-configured upstream client directly in a Layer pipeline.\n * Pass the client's `layer` factory, or a callback adding client-specific options.\n * The factory's errors and remaining services (such as HttpClient) stay visible.\n * Model selection and resource ownership remain with the supplied upstream Layers.\n *\n * @example\n * ```ts\n * AnthropicLanguageModel.model(\"claude-haiku-4-5\").pipe(\n *   Gateway.provide(AnthropicClient.layer, { ...options, provider: \"anthropic\" }),\n * )\n * ```\n */\nexport const provide = <Client, E, R>(\n  clientLayer: (options: ClientOptions) => Layer.Layer<Client, E, R>,\n  options: RouteOptions,\n) => Layer.provide(clientLayer(options.provider !== undefined ? provider(options) : rest(options)));\n"],"mappings":";;;;;;;;;AASA,MAAM,UAAU,OAAO,eAAe,MACpC,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,kBAAkB,CACrC;AAEA,MAAM,gBAAgB,OAAO,kBAAkB,OAAO;AA+BtD,MAAM,sBAAsB,SAA0B,gBAA8B;CAGlF,OAAO,eAAe,SAAS,WAAW,kBAAkB;EAC1D,cAAc;EACd,QAAQ,YACN,QAAQ,OAAO,SAAS,CAAC,GAAG,QAAQ,IAAI,SAAS,QAAQ,oBAAoB,GAAG,WAAW,CAAC;CAChG,CAAC;AACH;AAEA,MAAM,iBACJ,QACA,aACA,UACA,cAEA,OAAO,OAAO;CACZ;CACA,kBAAkB,WAChB,OAAO,KACL,WAAW,kBAAkB,YAAY;EACvC,MAAM,MAAM,IAAI,MAAM,QAAQ,GAAG;EAGjC,IACE,QAAQ,QACR,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,EAAE,IAAI,SAAS,UAAU,IAAI,KAAK,WAAW,GAAG,OAAO,EAAE,IAEzD,OAAO,OAAO,KACZ,IAAI,gBAAgB,gBAAgB,EAClC,QAAQ,IAAI,gBAAgB,gBAAgB;GAC1C;GACA,aAAa;EACf,CAAC,EACH,CAAC,CACH;EAEF,IAAI,WAAW;EAEf,IAAI,aAAa,KAAA,GACf,WAAW,kBAAkB,UAC3B,UACA,aACA,UAAU,SAAS,MAAM,QAAQ,GACnC;EAEF,IAAI,cAAc,KAAA,GAChB,WAAW,kBAAkB,UAAU,UAAU,qBAAqB,SAAS;EAGjF,OAAO,OAAO,QAAQ,QAAQ;CAChC,CAAC,GACD,WAAW,mBAAmB,WAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAO,OAAO,cAAc,gBAAgB,WAAW;EAExE,OAAO,OAAO,OAAO,KACnB,OAAO,eAAe,gBAAgB,aAAa;GACjD,GAAG,OAAO,UAAU,iBAAiB,CAAC,EAAE;GACxC,UAAU;EACZ,CAAC,CACH;CACF,CAAC,CACH,GACA,WAAW,mBAAmB,WAC5B,OAAO,KACL,OAAO,KAAK,aACV,OAAO,WAAW,mBAAmB,SAAS,QAAQ,SAAS,WAAW,CAAC,CAC7E,GACA,OAAO,UAAU,UACf,OAAO,WAAW,mBAAmB,MAAM,OAAO,QAAQ,SAAS,WAAW,CAAC,CACjF,GACA,OAAO,cAAc,QAAQ,uBAAuB,UAAU,CAAC,GAAG,OAAO,WAAW,CAAC,CACvF,CACF,CACF;AACJ,CAAC;;;;;;;;AASH,MAAa,YAAY,YACvB,cACE,wCAAwC,cAAc,QAAQ,SAAS,EAAE,GAAG,cAAc,QAAQ,SAAS,EAAE,GAAG,cAAc,QAAQ,QAAQ,KAC9I,wBACA,QAAQ,QACV;;;;;;;AAQF,MAAa,QAAQ,YACnB,cACE,iDAAiD,cAAc,QAAQ,SAAS,EAAE,KAAK,QAAQ,aAAa,aAAa,KAAK,SAC9H,iBACA,QAAQ,UACR,cAAc,QAAQ,SAAS,CACjC;;;;;;;;;;;;;;AAeF,MAAa,WACX,aACA,YACG,MAAM,QAAQ,YAAY,QAAQ,aAAa,KAAA,IAAY,SAAS,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC"}

package/dist/CloudflareThreadClient.d.mts

@@ -482,11 +482,6 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
       readonly createdAt: string;
       readonly deploymentId: string;
       readonly payload: {
-        readonly _tag: "AbortRequested";
-        readonly submissionId: string;
-        readonly author: string;
-        readonly reason: string;
-      } | {
         readonly _tag: "ThreadCreated";
         readonly agentId: string;
         readonly definitions: {
@@ -661,6 +656,11 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
         readonly runDisposition?: Schema.Json | undefined;
         readonly finishReason?: "budget-exhausted" | undefined;
         readonly exhausted?: "tokens" | "tool-calls" | "turns" | undefined;
+      } | {
+        readonly _tag: "AbortRequested";
+        readonly submissionId: string;
+        readonly author: string;
+        readonly reason: string;
       } | {
         readonly _tag: "SubmissionSettled";
         readonly submissionId: string;
@@ -1120,6 +1120,16 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
 } | {
   readonly _tag: "HostFailed";
   readonly failure: {
+    readonly _tag: "HostProtocolError";
+    readonly message: string;
+  } | {
+    readonly _tag: "AgentInputError";
+    readonly message: string;
+  } | {
+    readonly _tag: "DigestError";
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+  } | {
     readonly _tag: "AdmissionConflict";
     readonly threadId: string;
     readonly principal: string;
@@ -1134,6 +1144,15 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly _tag: "SettlementConflict";
     readonly submissionId: string;
     readonly existingOutcome: "aborted" | "completed" | "failed";
+  } | {
+    readonly _tag: "ApprovalConflict";
+    readonly submissionId: string;
+    readonly toolCallId: string;
+    readonly existingDecision: "approved" | "denied";
+  } | {
+    readonly _tag: "UnknownResolutionConflict";
+    readonly submissionId: string;
+    readonly toolCallId: string;
   } | {
     readonly _tag: "JoinedToHost";
     readonly submissionId: string;
@@ -1163,25 +1182,6 @@ declare const encodeHostResponse: (input: AbortRecorded | ApprovalRecorded | Hos
     readonly threadId: string;
     readonly actualEpoch: number;
     readonly attemptedEpoch: number;
-  } | {
-    readonly _tag: "HostProtocolError";
-    readonly message: string;
-  } | {
-    readonly _tag: "AgentInputError";
-    readonly message: string;
-  } | {
-    readonly _tag: "DigestError";
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "ApprovalConflict";
-    readonly submissionId: string;
-    readonly toolCallId: string;
-    readonly existingDecision: "approved" | "denied";
-  } | {
-    readonly _tag: "UnknownResolutionConflict";
-    readonly submissionId: string;
-    readonly toolCallId: string;
   } | {
     readonly _tag: "DurableRuntimeFailpointError";
     readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "checkpoint:after-save" | "checkpoint:before-save" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-start-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:before-prepared-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append" | "worker:after-completion-append" | "worker:after-origin-append" | "worker:after-report-append" | "worker:after-report-delivery" | "worker:after-source-append" | "worker:after-subtree-append" | "worker:before-completion-append" | "worker:before-origin-append" | "worker:before-report-append" | "worker:before-report-delivery" | "worker:before-source-append" | "worker:before-subtree-append";

package/dist/{ThreadObject-CN-jwQe5.d.mts → ThreadObject-BnmDkg5W.d.mts}

@@ -322,13 +322,13 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
         readonly author: string;
         readonly reason: string;
         readonly resolution: {
-          readonly _tag: "SafeToRetry";
-        } | {
           readonly _tag: "CompletedWithResult";
           readonly result: Schema.Json;
           readonly isFailure: boolean;
         } | {
           readonly _tag: "NeverHappened";
+        } | {
+          readonly _tag: "SafeToRetry";
         } | {
           readonly _tag: "AbortSubmission";
         };
@@ -672,14 +672,38 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly reason: "occupied" | "refused" | "unavailable";
     readonly code: string;
   } | {
-    readonly _tag: "SettlementConflict";
+    readonly _tag: "OperationDenied";
+    readonly operation: "abort" | "awaitSettlement" | "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
+    readonly reason: string;
+    readonly threadId?: string | undefined;
+    readonly submissionId?: string | undefined;
+  } | {
+    readonly _tag: "RetryRefused";
     readonly submissionId: string;
-    readonly existingOutcome: "aborted" | "completed" | "failed";
+    readonly refusal: "await-approval-decision" | "await-unknown-resolution" | "settled";
+    readonly decisionTag: string;
+    readonly message: string;
   } | {
     readonly _tag: "LedgerError";
     readonly operation: string;
     readonly message: string;
     readonly cause?: Schema.Json | undefined;
+  } | {
+    readonly _tag: "RunJournalError";
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+  } | {
+    readonly _tag: "DigestError";
+    readonly message: string;
+    readonly cause?: Schema.Json | undefined;
+  } | {
+    readonly _tag: "OwnershipLost";
+    readonly submissionId: string;
+    readonly actualEpoch: number;
+  } | {
+    readonly _tag: "SettlementConflict";
+    readonly submissionId: string;
+    readonly existingOutcome: "aborted" | "completed" | "failed";
   } | {
     readonly _tag: "ThreadStoreError";
     readonly operation: string;
@@ -700,38 +724,14 @@ declare const encodeAdminResponse: (input: AdminFailed | ExplainedRecovery | Obl
     readonly threadId: string;
     readonly actualEpoch: number;
     readonly attemptedEpoch: number;
+  } | {
+    readonly _tag: "DurableRuntimeFailpointError";
+    readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "checkpoint:after-save" | "checkpoint:before-save" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-start-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:before-prepared-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append" | "worker:after-completion-append" | "worker:after-origin-append" | "worker:after-report-append" | "worker:after-report-delivery" | "worker:after-source-append" | "worker:after-subtree-append" | "worker:before-completion-append" | "worker:before-origin-append" | "worker:before-report-append" | "worker:before-report-delivery" | "worker:before-source-append" | "worker:before-subtree-append";
   } | {
     readonly _tag: "DurableAlarmError";
     readonly operation: string;
     readonly message: string;
     readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "OperationDenied";
-    readonly operation: "abort" | "awaitSettlement" | "explain" | "observe" | "resolveApproval" | "resolveUnknown" | "retry" | "scanObligations" | "verify" | "wake";
-    readonly reason: string;
-    readonly threadId?: string | undefined;
-    readonly submissionId?: string | undefined;
-  } | {
-    readonly _tag: "RetryRefused";
-    readonly submissionId: string;
-    readonly refusal: "await-approval-decision" | "await-unknown-resolution" | "settled";
-    readonly decisionTag: string;
-    readonly message: string;
-  } | {
-    readonly _tag: "RunJournalError";
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "DigestError";
-    readonly message: string;
-    readonly cause?: Schema.Json | undefined;
-  } | {
-    readonly _tag: "OwnershipLost";
-    readonly submissionId: string;
-    readonly actualEpoch: number;
-  } | {
-    readonly _tag: "DurableRuntimeFailpointError";
-    readonly location: "abort:after-intent" | "approval:after-request-append" | "approval:after-suspend" | "checkpoint:after-save" | "checkpoint:before-save" | "claim:after-claim" | "compaction:after-canonical-append" | "compaction:before-canonical-append" | "input:after-canonical-append" | "join:after-canonical-append" | "join:after-claim" | "policy:after-reservation-append" | "policy:before-reservation-append" | "resolve:after-intent" | "run:after-start-append" | "run:before-start-append" | "step:after-step-append" | "subagent:after-admit" | "subagent:after-child-abort-intent" | "subagent:after-child-ready" | "subagent:after-join-append" | "subagent:after-release" | "subagent:after-release-pending" | "subagent:after-request-append" | "subagent:after-reserve" | "subagent:after-sibling-settle" | "subagent:after-start-append" | "subagent:after-suspend" | "submit:after-admit" | "submit:after-materialize" | "terminalize:after-canonical-append" | "terminalize:after-reserve" | "tools:after-prepared-append" | "tools:before-prepared-append" | "turn:after-canonical-append" | "turn:after-response-append" | "turn:after-results-append" | "worker:after-completion-append" | "worker:after-origin-append" | "worker:after-report-append" | "worker:after-report-delivery" | "worker:after-source-append" | "worker:after-subtree-append" | "worker:before-completion-append" | "worker:before-origin-append" | "worker:before-report-append" | "worker:before-report-delivery" | "worker:before-source-append" | "worker:before-subtree-append";
   } | {
     readonly _tag: "HostProtocolError";
     readonly message: string;
@@ -775,4 +775,4 @@ interface Class<EventServices = never> {
 declare const make: <ApplicationServices, ApplicationError, EventServices = never, EventLayerError = never>(applicationLayer: Layer.Layer<CloudflareDurableRuntimeServices | ApplicationServices, ApplicationError, CloudflareBootstrapServices | DurableObjectState$1.DurableObjectState | WorkerEnvironment | DurableObjectContext | ThreadObjectNamespace>, options: Options<ApplicationServices, EventServices, EventLayerError>) => Class<ApplicationServices | EventServices>;
 //#endregion
 export { CloudflareDurableRuntimeOptions as C, layerConfig as D, layer as E, CloudflareDurableRuntimeInitializationError as S, ThreadPublicationOptions as T, decodeObligationThresholds as _, AdminVerifyRequest as a, make as b, Instance as c, RetryExecuted as d, ThreadObject_d_exports as f, decodeAdminVerifyRequest as g, decodeAdminResponse as h, AdminResponse as i, ObligationsScanned as l, decodeAdminExplainRequest as m, AdminFailed as n, Class as o, VerifiedIntegrity as p, AdminFailure as r, ExplainedRecovery as s, AdminExplainRequest as t, Options as u, decodeRetryCommand as v, CloudflareDurableRuntimeServices as w, CloudflareBootstrapServices as x, encodeAdminResponse as y };
-//# sourceMappingURL=ThreadObject-CN-jwQe5.d.mts.map
+//# sourceMappingURL=ThreadObject-BnmDkg5W.d.mts.map

package/dist/ThreadObject.d.mts

@@ -1,2 +1,2 @@
-import { C as CloudflareDurableRuntimeOptions, D as layerConfig, E as layer, S as CloudflareDurableRuntimeInitializationError, T as ThreadPublicationOptions, _ as decodeObligationThresholds, a as AdminVerifyRequest, b as make, c as Instance, d as RetryExecuted, g as decodeAdminVerifyRequest, h as decodeAdminResponse, i as AdminResponse, l as ObligationsScanned, m as decodeAdminExplainRequest, n as AdminFailed, o as Class, p as VerifiedIntegrity, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeRetryCommand, w as CloudflareDurableRuntimeServices, x as CloudflareBootstrapServices, y as encodeAdminResponse } from "./ThreadObject-CN-jwQe5.mjs";
+import { C as CloudflareDurableRuntimeOptions, D as layerConfig, E as layer, S as CloudflareDurableRuntimeInitializationError, T as ThreadPublicationOptions, _ as decodeObligationThresholds, a as AdminVerifyRequest, b as make, c as Instance, d as RetryExecuted, g as decodeAdminVerifyRequest, h as decodeAdminResponse, i as AdminResponse, l as ObligationsScanned, m as decodeAdminExplainRequest, n as AdminFailed, o as Class, p as VerifiedIntegrity, r as AdminFailure, s as ExplainedRecovery, t as AdminExplainRequest, u as Options, v as decodeRetryCommand, w as CloudflareDurableRuntimeServices, x as CloudflareBootstrapServices, y as encodeAdminResponse } from "./ThreadObject-BnmDkg5W.mjs";
 export { AdminExplainRequest, AdminFailed, AdminFailure, AdminResponse, AdminVerifyRequest, type CloudflareBootstrapServices as BootstrapServices, Class, ExplainedRecovery, type CloudflareDurableRuntimeInitializationError as InitializationError, Instance, ObligationsScanned, Options, type ThreadPublicationOptions as PublicationOptions, RetryExecuted, type CloudflareDurableRuntimeOptions as RuntimeOptions, type CloudflareDurableRuntimeServices as Services, VerifiedIntegrity, decodeAdminExplainRequest, decodeAdminResponse, decodeAdminVerifyRequest, decodeObligationThresholds, decodeRetryCommand, encodeAdminResponse, layer, layerConfig, make };

package/dist/index.d.mts

@@ -2,11 +2,12 @@ import { t as CloudflareBindings_d_exports } from "./CloudflareBindings.mjs";
 import { a as CloudflareConfig_d_exports } from "./CloudflareConfig-f3CqTel1.mjs";
 import { t as Alarm_d_exports } from "./Alarm.mjs";
 import { t as CloudflareBrowser_d_exports } from "./CloudflareBrowser-DJq53niJ.mjs";
+import { t as CloudflareAiGateway_d_exports } from "./CloudflareAiGateway.mjs";
 import { t as CloudflareCodeMode_d_exports } from "./CloudflareCodeMode.mjs";
 import { t as CloudflareMemory_d_exports } from "./CloudflareMemory.mjs";
 import { t as CloudflareScheduling_d_exports } from "./CloudflareScheduling.mjs";
 import { t as CloudflareSubscriptions_d_exports } from "./CloudflareSubscriptions.mjs";
 import { t as CloudflareThreadClient_d_exports } from "./CloudflareThreadClient.mjs";
-import { f as ThreadObject_d_exports } from "./ThreadObject-CN-jwQe5.mjs";
+import { f as ThreadObject_d_exports } from "./ThreadObject-BnmDkg5W.mjs";
 import { t as WakeScheduler_d_exports } from "./WakeScheduler.mjs";
-export { Alarm_d_exports as Alarm, CloudflareBindings_d_exports as CloudflareBindings, CloudflareBrowser_d_exports as CloudflareBrowser, CloudflareCodeMode_d_exports as CloudflareCodeMode, CloudflareConfig_d_exports as CloudflareConfig, CloudflareMemory_d_exports as CloudflareMemory, CloudflareScheduling_d_exports as CloudflareScheduling, CloudflareSubscriptions_d_exports as CloudflareSubscriptions, CloudflareThreadClient_d_exports as CloudflareThreadClient, ThreadObject_d_exports as ThreadObject, WakeScheduler_d_exports as WakeScheduler };
+export { Alarm_d_exports as Alarm, CloudflareAiGateway_d_exports as CloudflareAiGateway, CloudflareBindings_d_exports as CloudflareBindings, CloudflareBrowser_d_exports as CloudflareBrowser, CloudflareCodeMode_d_exports as CloudflareCodeMode, CloudflareConfig_d_exports as CloudflareConfig, CloudflareMemory_d_exports as CloudflareMemory, CloudflareScheduling_d_exports as CloudflareScheduling, CloudflareSubscriptions_d_exports as CloudflareSubscriptions, CloudflareThreadClient_d_exports as CloudflareThreadClient, ThreadObject_d_exports as ThreadObject, WakeScheduler_d_exports as WakeScheduler };

package/dist/index.mjs

@@ -9,4 +9,5 @@ import { t as CloudflareScheduling_exports } from "./CloudflareScheduling.mjs";
 import { t as CloudflareSubscriptions_exports } from "./CloudflareSubscriptions.mjs";
 import { t as WakeScheduler_exports } from "./WakeScheduler.mjs";
 import { l as ThreadObject_exports } from "./ThreadObject-KJf_5Isr.mjs";
-export { Alarm_exports as Alarm, CloudflareBindings_exports as CloudflareBindings, CloudflareBrowser_exports as CloudflareBrowser, CloudflareCodeMode_exports as CloudflareCodeMode, CloudflareConfig_exports as CloudflareConfig, CloudflareMemory_exports as CloudflareMemory, CloudflareScheduling_exports as CloudflareScheduling, CloudflareSubscriptions_exports as CloudflareSubscriptions, CloudflareThreadClient_exports as CloudflareThreadClient, ThreadObject_exports as ThreadObject, WakeScheduler_exports as WakeScheduler };
+import { t as CloudflareAiGateway_exports } from "./CloudflareAiGateway.mjs";
+export { Alarm_exports as Alarm, CloudflareAiGateway_exports as CloudflareAiGateway, CloudflareBindings_exports as CloudflareBindings, CloudflareBrowser_exports as CloudflareBrowser, CloudflareCodeMode_exports as CloudflareCodeMode, CloudflareConfig_exports as CloudflareConfig, CloudflareMemory_exports as CloudflareMemory, CloudflareScheduling_exports as CloudflareScheduling, CloudflareSubscriptions_exports as CloudflareSubscriptions, CloudflareThreadClient_exports as CloudflareThreadClient, ThreadObject_exports as ThreadObject, WakeScheduler_exports as WakeScheduler };

package/package.json

@@ -1 +1 @@
-{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.75","dependencies":{"@effect-agent/core":"0.1.0-beta.75","@effect-agent/engine":"0.1.0-beta.75","@effect-agent/sandbox":"0.1.0-beta.75","@effect-agent/storage-cloudflare":"0.1.0-beta.75","@effect-agent/thread":"0.1.0-beta.75","@effect/platform-browser":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112"},"devDependencies":{"@cloudflare/puppeteer":"1.1.0","@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/capabilities":"0.1.0-beta.75","@effect-agent/testing":"0.1.0-beta.75","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","effect":"4.0.0-rc.112","effect-cf":"0.40.0","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.0","vitest":"4.1.11"},"peerDependencies":{"@cloudflare/puppeteer":"^1.1.0","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./BrowserRestCapture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./BrowserRestCrawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./CloudflareBindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./CloudflareBrowser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./CloudflareCodeMode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./CloudflareConfig":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./CloudflareMemory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./CloudflareScheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./CloudflareSubscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./CloudflareThreadClient":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./InteractiveBrowser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./ProtectedBrowser":{"types":"./dist/ProtectedBrowser.d.mts","default":"./dist/ProtectedBrowser.mjs"},"./ThreadObject":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./WakeScheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"},"peerDependenciesMeta":{"@cloudflare/puppeteer":{"optional":true}}}
+{"name":"@effect-agent/platform-cloudflare","version":"0.1.0-beta.77","dependencies":{"@effect-agent/core":"0.1.0-beta.77","@effect-agent/engine":"0.1.0-beta.77","@effect-agent/sandbox":"0.1.0-beta.77","@effect-agent/storage-cloudflare":"0.1.0-beta.77","@effect-agent/thread":"0.1.0-beta.77","@effect/platform-browser":"4.0.0-rc.112","@effect/sql-sqlite-do":"4.0.0-rc.112"},"devDependencies":{"@cloudflare/puppeteer":"1.1.0","@cloudflare/vitest-pool-workers":"0.21.3","@cloudflare/workers-types":"5.20260825.1","@effect-agent/capabilities":"0.1.0-beta.77","@effect-agent/testing":"0.1.0-beta.77","@effect/platform-node":"4.0.0-rc.112","@effect/sql-d1":"4.0.0-rc.112","@effect/vitest":"4.0.0-rc.112","effect":"4.0.0-rc.112","effect-cf":"0.40.0","esbuild":"0.28.1","miniflare":"5.20260811.1-alpha","typescript":"7.0.2","vite-plus":"0.3.0","vitest":"4.1.11"},"peerDependencies":{"@cloudflare/puppeteer":"^1.1.0","effect":"^4.0.0-rc.112","effect-cf":"^0.40.0"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./Alarm":{"types":"./dist/Alarm.d.mts","default":"./dist/Alarm.mjs"},"./BrowserRestCapture":{"types":"./dist/BrowserRestCapture.d.mts","default":"./dist/BrowserRestCapture.mjs"},"./BrowserRestCrawl":{"types":"./dist/BrowserRestCrawl.d.mts","default":"./dist/BrowserRestCrawl.mjs"},"./CloudflareBindings":{"types":"./dist/CloudflareBindings.d.mts","default":"./dist/CloudflareBindings.mjs"},"./CloudflareBrowser":{"types":"./dist/CloudflareBrowser.d.mts","default":"./dist/CloudflareBrowser.mjs"},"./CloudflareCodeMode":{"types":"./dist/CloudflareCodeMode.d.mts","default":"./dist/CloudflareCodeMode.mjs"},"./CloudflareConfig":{"types":"./dist/CloudflareConfig.d.mts","default":"./dist/CloudflareConfig.mjs"},"./CloudflareMemory":{"types":"./dist/CloudflareMemory.d.mts","default":"./dist/CloudflareMemory.mjs"},"./CloudflareScheduling":{"types":"./dist/CloudflareScheduling.d.mts","default":"./dist/CloudflareScheduling.mjs"},"./CloudflareSubscriptions":{"types":"./dist/CloudflareSubscriptions.d.mts","default":"./dist/CloudflareSubscriptions.mjs"},"./CloudflareThreadClient":{"types":"./dist/CloudflareThreadClient.d.mts","default":"./dist/CloudflareThreadClient.mjs"},"./InteractiveBrowser":{"types":"./dist/InteractiveBrowser.d.mts","default":"./dist/InteractiveBrowser.mjs"},"./ProtectedBrowser":{"types":"./dist/ProtectedBrowser.d.mts","default":"./dist/ProtectedBrowser.mjs"},"./ThreadObject":{"types":"./dist/ThreadObject.d.mts","default":"./dist/ThreadObject.mjs"},"./WakeScheduler":{"types":"./dist/WakeScheduler.d.mts","default":"./dist/WakeScheduler.mjs"},"./CloudflareAiGateway":{"types":"./dist/CloudflareAiGateway.d.mts","default":"./dist/CloudflareAiGateway.mjs"}},"description":"Cloudflare Layer assembly for Effect Agent: Durable Objects and Browser Run adapters.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/danieljvdm/effect-agent.git","directory":"packages/platform-cloudflare"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"},"peerDependenciesMeta":{"@cloudflare/puppeteer":{"optional":true}}}

package/src/CloudflareAiGateway.ts

@@ -0,0 +1,170 @@
+import { Context, Effect, Layer, Option, Redactable, Redacted, Schema } from "effect";
+import {
+  FetchHttpClient,
+  Headers,
+  HttpClient,
+  HttpClientError,
+  HttpClientRequest,
+} from "effect/unstable/http";
+
+const Segment = Schema.NonEmptyString.check(
+  Schema.isMaxLength(256),
+  Schema.isPattern(/^[a-zA-Z0-9_-]+$/),
+);
+
+const decodeSegment = Schema.decodeUnknownSync(Segment);
+
+/** Options understood by upstream Effect AI clients; no model or provider wrapper is created. */
+export interface ClientOptions {
+  readonly apiUrl: string;
+  readonly transformClient: (client: HttpClient.HttpClient) => HttpClient.HttpClient;
+}
+
+export interface ProviderOptions {
+  readonly accountId: string;
+  readonly gatewayId: string;
+  /** Cloudflare's provider path, such as openai, anthropic, google-ai-studio, or perplexity-ai. */
+  readonly provider: string;
+  /** Omit only for an unauthenticated gateway with a separately supplied provider key. */
+  readonly apiToken?: Redacted.Redacted<string>;
+}
+
+export interface RestOptions {
+  readonly accountId: string;
+  readonly gatewayId: string;
+  /** Cloudflare API token with Workers AI Read permission. */
+  readonly apiToken: Redacted.Redacted<string>;
+  /** Matches the paths appended by the upstream Effect client. */
+  readonly protocol: "responses" | "chat-completions" | "messages";
+}
+
+/** Choose exactly one route: a native provider path or an account REST protocol. */
+export type RouteOptions =
+  | (ProviderOptions & { readonly protocol?: never })
+  | (RestOptions & { readonly provider?: never });
+
+const redactGatewayToken = (headers: Headers.Headers, tokenHeader: string): void => {
+  // HTTP tracing can copy headers after preprocessing. Attach the public redaction
+  // protocol to the final request as well, before a provider builds error details.
+  Object.defineProperty(headers, Redactable.symbolRedactable, {
+    configurable: true,
+    value: (context: Context.Context<never>) =>
+      Headers.redact(headers, [...Context.get(context, Headers.CurrentRedactedNames), tokenHeader]),
+  });
+};
+
+const clientOptions = (
+  apiUrl: string,
+  tokenHeader: "authorization" | "cf-aig-authorization",
+  apiToken: Redacted.Redacted<string> | undefined,
+  gatewayId?: string,
+): ClientOptions =>
+  Object.freeze({
+    apiUrl,
+    transformClient: (client: HttpClient.HttpClient) =>
+      client.pipe(
+        HttpClient.mapRequestEffect((request) => {
+          const url = URL.parse(request.url);
+
+          // Check the normalized URL too: dot segments must not escape this account or gateway.
+          if (
+            url === null ||
+            url.username !== "" ||
+            url.password !== "" ||
+            !(url.href === apiUrl || url.href.startsWith(`${apiUrl}/`))
+          ) {
+            return Effect.fail(
+              new HttpClientError.HttpClientError({
+                reason: new HttpClientError.InvalidUrlError({
+                  request,
+                  description: "Request is outside the configured Cloudflare AI Gateway endpoint",
+                }),
+              }),
+            );
+          }
+          let prepared = request;
+
+          if (apiToken !== undefined) {
+            prepared = HttpClientRequest.setHeader(
+              prepared,
+              tokenHeader,
+              `Bearer ${Redacted.value(apiToken)}`,
+            );
+          }
+          if (gatewayId !== undefined) {
+            prepared = HttpClientRequest.setHeader(prepared, "cf-aig-gateway-id", gatewayId);
+          }
+
+          return Effect.succeed(prepared);
+        }),
+        HttpClient.transformResponse((effect) =>
+          Effect.gen(function* () {
+            const defaults = yield* Effect.serviceOption(FetchHttpClient.RequestInit);
+
+            return yield* effect.pipe(
+              Effect.provideService(FetchHttpClient.RequestInit, {
+                ...Option.getOrElse(defaults, () => ({})),
+                redirect: "error",
+              }),
+            );
+          }),
+        ),
+        HttpClient.transformResponse((effect) =>
+          effect.pipe(
+            Effect.tap((response) =>
+              Effect.sync(() => redactGatewayToken(response.request.headers, tokenHeader)),
+            ),
+            Effect.tapError((error) =>
+              Effect.sync(() => redactGatewayToken(error.reason.request.headers, tokenHeader)),
+            ),
+            Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, tokenHeader]),
+          ),
+        ),
+      ),
+  });
+
+/**
+ * Provider-native proxy for model calls, streaming, embeddings, and hosted tools supported
+ * by that provider. Pass the result to the upstream client's layer along with its apiKey
+ * for BYOK-in-request, or omit apiKey for Gateway stored keys / Unified Billing.
+ * Provider model names and request bodies pass through unchanged. This module is Node-safe.
+ * Custom transforms and redirect policies must retain this endpoint and credential boundary.
+ */
+export const provider = (options: ProviderOptions): ClientOptions =>
+  clientOptions(
+    `https://gateway.ai.cloudflare.com/v1/${decodeSegment(options.accountId)}/${decodeSegment(options.gatewayId)}/${decodeSegment(options.provider)}`,
+    "cf-aig-authorization",
+    options.apiToken,
+  );
+
+/**
+ * Cloudflare's account REST API (not the deprecated /compat API). Use provider-qualified
+ * model names, e.g. openai/gpt-4.1 or anthropic/claude-haiku-4.5, and omit provider apiKey.
+ * OpenAI clients append /responses or /chat/completions; Anthropic appends /v1/messages.
+ * Compatibility remains the responsibility of the selected upstream client and model.
+ */
+export const rest = (options: RestOptions): ClientOptions =>
+  clientOptions(
+    `https://api.cloudflare.com/client/v4/accounts/${decodeSegment(options.accountId)}/ai${options.protocol === "messages" ? "" : "/v1"}`,
+    "authorization",
+    options.apiToken,
+    decodeSegment(options.gatewayId),
+  );
+
+/**
+ * Provide a Gateway-configured upstream client directly in a Layer pipeline.
+ * Pass the client's `layer` factory, or a callback adding client-specific options.
+ * The factory's errors and remaining services (such as HttpClient) stay visible.
+ * Model selection and resource ownership remain with the supplied upstream Layers.
+ *
+ * @example
+ * ```ts
+ * AnthropicLanguageModel.model("claude-haiku-4-5").pipe(
+ *   Gateway.provide(AnthropicClient.layer, { ...options, provider: "anthropic" }),
+ * )
+ * ```
+ */
+export const provide = <Client, E, R>(
+  clientLayer: (options: ClientOptions) => Layer.Layer<Client, E, R>,
+  options: RouteOptions,
+) => Layer.provide(clientLayer(options.provider !== undefined ? provider(options) : rest(options)));

package/src/index.ts

@@ -9,3 +9,4 @@ export * as CloudflareSubscriptions from "./CloudflareSubscriptions.ts";
 export * as CloudflareThreadClient from "./CloudflareThreadClient.ts";
 export * as ThreadObject from "./ThreadObject.ts";
 export * as WakeScheduler from "./WakeScheduler.ts";
+export * as CloudflareAiGateway from "./CloudflareAiGateway.ts";