effect-ai-vercel-gateway 0.1.0 → 0.1.1

package/dist/index.js

@@ -50,7 +50,7 @@ const hints = {
 	"vercel-oidc": ["Run on Vercel, where each request carries an OIDC token.", `Or run \`vercel env pull\` locally to populate ${OIDC_TOKEN_ENV}.`],
 	chain: [`Set ${API_KEY_ENV} to an AI Gateway API key.`, "Or run on Vercel / `vercel env pull` so an OIDC token is available."]
 };
-const fromConfig = (name, method, source) => Config.option(Config.Redacted(name)).pipe(Effect.map(Option.map((token) => ({
+const fromConfig = (name, method, source) => Config.option(Config.redacted(name)).pipe(Effect.map(Option.map((token) => ({
 	method,
 	token
 }))), Effect.catchTag("ConfigError", (cause) => new CredentialsError({

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["holder","Credentials.Credentials","Credentials.formatHeaders"],"sources":["../src/Credentials.ts","../src/AiGateway.ts"],"sourcesContent":["/**\n * How gateway requests authenticate.\n *\n * `Credentials` holds an effect that produces the credential for one request.\n * It runs per request rather than once at startup: on Vercel the OIDC token\n * arrives on the request context and rotates, so it must not be cached. Pick\n * a `from*` layer for where the credential comes from.\n *\n * @example\n * ```ts\n * import { Credentials } from \"effect-ai-vercel-gateway\"\n *\n * Credentials.fromChain()      // AI_GATEWAY_API_KEY, else the Vercel OIDC token\n * Credentials.fromEnv()        // AI_GATEWAY_API_KEY only\n * Credentials.fromVercelOidc() // the Vercel OIDC token only\n * Credentials.fromApiKey(\"…\")  // a fixed value\n * ```\n */\n\nimport { Config, Context, Data, Effect, Layer, Option, Redacted } from \"effect\"\n\n/** The environment variable `fromEnv` reads. */\nexport const API_KEY_ENV = \"AI_GATEWAY_API_KEY\"\n\n/** The environment variable `fromVercelOidc` falls back to. */\nexport const OIDC_TOKEN_ENV = \"VERCEL_OIDC_TOKEN\"\n\n/** Which `from*` layer produced or failed to produce a credential. */\nexport type Source = \"api-key\" | \"env\" | \"vercel-oidc\" | \"chain\"\n\n/**\n * A credential ready to put on a request. `method` is what the gateway\n * records as the auth method; it matches the values Vercel's own SDK sends.\n */\nexport interface Resolved {\n  readonly method: \"api-key\" | \"oidc\"\n  readonly token: Redacted.Redacted<string>\n}\n\n/** No credential could be produced for a gateway request. */\nexport class CredentialsError extends Data.TaggedError(\"AiGatewayCredentialsError\")<{\n  readonly message: string\n  readonly source: Source\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\nexport class Credentials extends Context.Service<\n  Credentials,\n  Effect.Effect<Resolved, CredentialsError>\n>()(\"effect-ai-vercel-gateway/Credentials\") {}\n\n/** The request headers that carry `credentials`. */\nexport const formatHeaders = (credentials: Resolved): Record<string, string> => ({\n  \"x-api-key\": Redacted.value(credentials.token),\n  \"ai-gateway-auth-method\": credentials.method,\n})\n\nconst hints: Record<Source, ReadonlyArray<string>> = {\n  \"api-key\": [],\n  env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],\n  \"vercel-oidc\": [\n    \"Run on Vercel, where each request carries an OIDC token.\",\n    `Or run \\`vercel env pull\\` locally to populate ${OIDC_TOKEN_ENV}.`,\n  ],\n  chain: [\n    `Set ${API_KEY_ENV} to an AI Gateway API key.`,\n    \"Or run on Vercel / `vercel env pull` so an OIDC token is available.\",\n  ],\n}\n\n/**\n * Where a credential may come from. `None` means the place is not configured,\n * so a chain can move on; a failure means it is configured but unusable.\n */\ntype Lookup = Effect.Effect<Option.Option<Resolved>, CredentialsError>\n\nconst fromConfig = (name: string, method: Resolved[\"method\"], source: Source): Lookup =>\n  Config.option(Config.Redacted(name)).pipe(\n    Effect.map(Option.map((token) => ({ method, token }))),\n    Effect.catchTag(\n      \"ConfigError\",\n      (cause) =>\n        new CredentialsError({\n          message: `Failed to read ${name}.`,\n          source,\n          hints: hints[source],\n          cause,\n        }),\n    ),\n  )\n\n/**\n * Vercel exposes the current request's context on a well-known global symbol.\n * In Functions, the `x-vercel-oidc-token` header of the request lives there.\n * Mirrors `@vercel/oidc`'s `getVercelOidcTokenSync`, minus the dev-time\n * refresh that package also offers.\n */\nconst REQUEST_CONTEXT = Symbol.for(\"@vercel/request-context\")\n\ntype RequestContext = { readonly headers?: Record<string, string | undefined> }\n\nconst fromRequestContext: Lookup = Effect.sync(() => {\n  const holder = globalThis as typeof globalThis & {\n    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }\n  }\n  const token = holder[REQUEST_CONTEXT]?.get?.()?.headers?.[\"x-vercel-oidc-token\"]\n  return token === undefined\n    ? Option.none()\n    : Option.some({ method: \"oidc\" as const, token: Redacted.make(token) })\n})\n\nconst firstOf = (lookups: ReadonlyArray<Lookup>): Lookup =>\n  Effect.gen(function* () {\n    for (const lookup of lookups) {\n      const found = yield* lookup\n      if (Option.isSome(found)) return found\n    }\n    return Option.none()\n  })\n\nconst require = (lookup: Lookup, source: Source, message: string) =>\n  Layer.succeed(Credentials)(\n    Effect.flatMap(lookup, (found) =>\n      Option.isSome(found)\n        ? Effect.succeed(found.value)\n        : Effect.fail(new CredentialsError({ message, source, hints: hints[source] })),\n    ),\n  )\n\nconst apiKeyLookup = fromConfig(API_KEY_ENV, \"api-key\", \"env\")\n\nconst vercelOidcLookup = firstOf([\n  fromRequestContext,\n  fromConfig(OIDC_TOKEN_ENV, \"oidc\", \"vercel-oidc\"),\n])\n\n/** A fixed API key. */\nexport const fromApiKey = (apiKey: string | Redacted.Redacted<string>): Layer.Layer<Credentials> =>\n  Layer.succeed(Credentials)(\n    Effect.succeed({\n      method: \"api-key\",\n      token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey),\n    }),\n  )\n\n/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */\nexport const fromEnv = (): Layer.Layer<Credentials> =>\n  require(apiKeyLookup, \"env\", `${API_KEY_ENV} is not set.`)\n\n/**\n * The OIDC token Vercel issues to the deployment: the `x-vercel-oidc-token`\n * header of the current request in Functions, else `VERCEL_OIDC_TOKEN` in\n * builds and after `vercel env pull`. Not refreshed when it expires locally.\n */\nexport const fromVercelOidc = (): Layer.Layer<Credentials> =>\n  require(vercelOidcLookup, \"vercel-oidc\", \"No Vercel OIDC token is available.\")\n\n/** `fromEnv`, then `fromVercelOidc`. The usual choice for an app deployed to Vercel. */\nexport const fromChain = (): Layer.Layer<Credentials> =>\n  require(firstOf([apiKeyLookup, vercelOidcLookup]), \"chain\", \"No AI Gateway credential found.\")\n","/**\n * Vercel AI Gateway as an Anthropic Messages API client for Effect AI.\n *\n * The gateway serves the Anthropic Messages API at its root URL and accepts\n * any model it lists, named `provider/model` (for example\n * `anthropic/claude-sonnet-4.5` or `google/gemini-2.5-flash`). Effect AI's\n * Anthropic provider only needs the base URL and the credential swapped, plus\n * two small dialect fixes (see `dropNullCacheControl` and\n * `fillMissingResponseKeys`), so this module is the one place the gateway is\n * configured.\n *\n * Structured output (`output_config.format`) works for every provider behind\n * the gateway, so the Anthropic provider's default of native structured\n * output holds for models it does not recognise.\n *\n * @example\n * ```ts\n * import { AiGateway, Credentials } from \"effect-ai-vercel-gateway\"\n * import { AnthropicLanguageModel } from \"@effect/ai-anthropic\"\n * import { Layer } from \"effect\"\n * import { FetchHttpClient } from \"effect/unstable/http\"\n *\n * const Model = AnthropicLanguageModel.layer({ model: \"anthropic/claude-sonnet-4.5\" }).pipe(\n *   Layer.provide(AiGateway.layer),\n *   Layer.provide([Credentials.fromChain(), FetchHttpClient.layer]),\n * )\n * ```\n */\n\nimport { AnthropicClient } from \"@effect/ai-anthropic\"\nimport { Effect, Layer } from \"effect\"\nimport {\n  HttpBody,\n  HttpClient,\n  HttpClientError,\n  HttpClientRequest,\n  HttpClientResponse,\n} from \"effect/unstable/http\"\nimport * as Credentials from \"./Credentials.js\"\n\n/** Base URL of the Vercel AI Gateway. */\nexport const AI_GATEWAY_URL = \"https://ai-gateway.vercel.sh\"\n\n/**\n * Builds the Anthropic client against the gateway, authenticating each\n * request with `credentials`. A credential failure fails that request as an\n * `HttpClientError`, which Effect AI surfaces as a network `AiError`.\n */\nexport const make = (credentials: typeof Credentials.Credentials.Service) =>\n  AnthropicClient.make({\n    apiUrl: AI_GATEWAY_URL,\n    transformClient: (client) =>\n      client.pipe(\n        HttpClient.mapRequestEffect(authenticate(credentials)),\n        HttpClient.mapRequest(dropNullCacheControl),\n        HttpClient.transformResponse(Effect.flatMap(fillMissingResponseKeys)),\n      ),\n  })\n\n/**\n * `AnthropicClient` backed by the gateway. Needs `Credentials` (see the\n * `Credentials` module's `from*` layers) and an `HttpClient`. Building never\n * fails; without a usable credential, the requests fail.\n */\nexport const layer: Layer.Layer<\n  AnthropicClient.AnthropicClient,\n  never,\n  Credentials.Credentials | HttpClient.HttpClient\n> = Layer.effect(AnthropicClient.AnthropicClient)(\n  Effect.flatMap(Effect.service(Credentials.Credentials), make),\n)\n\nfunction authenticate(credentials: typeof Credentials.Credentials.Service) {\n  return (request: HttpClientRequest.HttpClientRequest) =>\n    credentials.pipe(\n      Effect.map((resolved) =>\n        HttpClientRequest.setHeaders(request, Credentials.formatHeaders(resolved)),\n      ),\n      Effect.mapError(\n        (error) =>\n          new HttpClientError.HttpClientError({\n            reason: new HttpClientError.TransportError({\n              request,\n              cause: error,\n              description: \"AI Gateway credential unavailable\",\n            }),\n          }),\n      ),\n    )\n}\n\n/**\n * The Effect provider writes `\"cache_control\": null` on every content block\n * it has no cache setting for. Anthropic accepts that; the gateway rejects\n * the request with `messages.0.content: Invalid input`. Remove the null keys.\n */\nexport function dropNullCacheControl(\n  request: HttpClientRequest.HttpClientRequest,\n): HttpClientRequest.HttpClientRequest {\n  const body = request.body\n  if (body._tag !== \"Uint8Array\" || !isJson(body.contentType)) {\n    return request\n  }\n  const json: unknown = JSON.parse(new TextDecoder().decode(body.body))\n  return HttpClientRequest.setBody(\n    request,\n    HttpBody.jsonUnsafe(withoutNullCacheControl(json), body.contentType),\n  )\n}\n\nfunction withoutNullCacheControl(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(withoutNullCacheControl)\n  if (value === null || typeof value !== \"object\") return value\n  const result: Record<string, unknown> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    if (key === \"cache_control\" && entry === null) continue\n    result[key] = withoutNullCacheControl(entry)\n  }\n  return result\n}\n\n/**\n * The gateway's Anthropic-shaped responses leave out keys that Anthropic\n * always sends and the Effect provider's schema requires: the cache and\n * service-tier usage fields, the `signature` of a thinking block from a\n * non-Anthropic model, and `type`/`request_id` on error envelopes, whose\n * `error.type` may also be a gateway-specific value. Fill them with the values\n * Anthropic uses when there is nothing to report. Streaming responses are not\n * JSON and pass through untouched.\n */\nexport function fillMissingResponseKeys(\n  response: HttpClientResponse.HttpClientResponse,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> {\n  if (!isJson(response.headers[\"content-type\"] ?? \"\")) {\n    return Effect.succeed(response)\n  }\n  return Effect.map(response.text, (text) => {\n    const body = JSON.parse(text) as Record<string, unknown>\n    return HttpClientResponse.fromWeb(\n      response.request,\n      new Response(JSON.stringify(patchResponseBody(body)), {\n        status: response.status,\n        headers: response.headers,\n      }),\n    )\n  })\n}\n\nexport function patchResponseBody(body: Record<string, unknown>): Record<string, unknown> {\n  if (body.type === \"message\") {\n    const usage = (body.usage ?? {}) as Record<string, unknown>\n    body.usage = {\n      cache_creation: null,\n      cache_creation_input_tokens: null,\n      cache_read_input_tokens: null,\n      inference_geo: null,\n      service_tier: null,\n      ...usage,\n    }\n    if (Array.isArray(body.content)) {\n      body.content = body.content.map((block: unknown) =>\n        isRecord(block) && block.type === \"thinking\" ? { signature: \"\", ...block } : block,\n      )\n    }\n    return body\n  }\n  if (isRecord(body.error)) {\n    const error = ANTHROPIC_ERROR_TYPES.has(String(body.error.type))\n      ? body.error\n      : { ...body.error, type: \"api_error\" }\n    return { type: \"error\", request_id: null, ...body, error }\n  }\n  return body\n}\n\nconst ANTHROPIC_ERROR_TYPES = new Set([\n  \"invalid_request_error\",\n  \"authentication_error\",\n  \"billing_error\",\n  \"permission_error\",\n  \"not_found_error\",\n  \"rate_limit_error\",\n  \"timeout_error\",\n  \"api_error\",\n  \"overloaded_error\",\n])\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction isJson(contentType: string): boolean {\n  return contentType.startsWith(\"application/json\")\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,cAAc;;AAG3B,MAAa,iBAAiB;;AAe9B,IAAa,mBAAb,cAAsC,KAAK,YAAY,2BAA2B,CAAC,CAKhF,CAAC;AAEJ,IAAa,cAAb,cAAiC,QAAQ,QAGvC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;;AAG7C,MAAa,iBAAiB,iBAAmD;CAC/E,aAAa,SAAS,MAAM,YAAY,KAAK;CAC7C,0BAA0B,YAAY;AACxC;AAEA,MAAM,QAA+C;CACnD,WAAW,CAAC;CACZ,KAAK,CAAC,OAAO,YAAY,2BAA2B;CACpD,eAAe,CACb,4DACA,kDAAkD,eAAe,EACnE;CACA,OAAO,CACL,OAAO,YAAY,6BACnB,qEACF;AACF;AAQA,MAAM,cAAc,MAAc,QAA4B,WAC5D,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,KACnC,OAAO,IAAI,OAAO,KAAK,WAAW;CAAE;CAAQ;AAAM,EAAE,CAAC,GACrD,OAAO,SACL,gBACC,UACC,IAAI,iBAAiB;CACnB,SAAS,kBAAkB,KAAK;CAChC;CACA,OAAO,MAAM;CACb;AACF,CAAC,CACL,CACF;;;;;;;AAQF,MAAM,kBAAkB,OAAO,IAAI,yBAAyB;AAI5D,MAAM,qBAA6B,OAAO,WAAW;CAInD,MAAM,QAAQA,WAAO,gBAAgB,EAAE,MAAM,CAAC,EAAE,UAAU;CAC1D,OAAO,UAAU,KAAA,IACb,OAAO,KAAK,IACZ,OAAO,KAAK;EAAE,QAAQ;EAAiB,OAAO,SAAS,KAAK,KAAK;CAAE,CAAC;AAC1E,CAAC;AAED,MAAM,WAAW,YACf,OAAO,IAAI,aAAa;CACtB,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,OAAO,KAAK,GAAG,OAAO;CACnC;CACA,OAAO,OAAO,KAAK;AACrB,CAAC;AAEH,MAAM,WAAW,QAAgB,QAAgB,YAC/C,MAAM,QAAQ,WAAW,CAAC,CACxB,OAAO,QAAQ,SAAS,UACtB,OAAO,OAAO,KAAK,IACf,OAAO,QAAQ,MAAM,KAAK,IAC1B,OAAO,KAAK,IAAI,iBAAiB;CAAE;CAAS;CAAQ,OAAO,MAAM;AAAQ,CAAC,CAAC,CACjF,CACF;AAEF,MAAM,eAAe,WAAW,aAAa,WAAW,KAAK;AAE7D,MAAM,mBAAmB,QAAQ,CAC/B,oBACA,WAAW,gBAAgB,QAAQ,aAAa,CAClD,CAAC;;AAGD,MAAa,cAAc,WACzB,MAAM,QAAQ,WAAW,CAAC,CACxB,OAAO,QAAQ;CACb,QAAQ;CACR,OAAO,SAAS,WAAW,MAAM,IAAI,SAAS,SAAS,KAAK,MAAM;AACpE,CAAC,CACH;;AAGF,MAAa,gBACX,QAAQ,cAAc,OAAO,GAAG,YAAY,aAAa;;;;;;AAO3D,MAAa,uBACX,QAAQ,kBAAkB,eAAe,oCAAoC;;AAG/E,MAAa,kBACX,QAAQ,QAAQ,CAAC,cAAc,gBAAgB,CAAC,GAAG,SAAS,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvH/F,MAAa,iBAAiB;;;;;;AAO9B,MAAa,QAAQ,gBACnB,gBAAgB,KAAK;CACnB,QAAQ;CACR,kBAAkB,WAChB,OAAO,KACL,WAAW,iBAAiB,aAAa,WAAW,CAAC,GACrD,WAAW,WAAW,oBAAoB,GAC1C,WAAW,kBAAkB,OAAO,QAAQ,uBAAuB,CAAC,CACtE;AACJ,CAAC;;;;;;AAOH,MAAa,QAIT,MAAM,OAAO,gBAAgB,eAAe,CAAC,CAC/C,OAAO,QAAQ,OAAO,QAAQC,WAAuB,GAAG,IAAI,CAC9D;AAEA,SAAS,aAAa,aAAqD;CACzE,QAAQ,YACN,YAAY,KACV,OAAO,KAAK,aACV,kBAAkB,WAAW,SAASC,cAA0B,QAAQ,CAAC,CAC3E,GACA,OAAO,UACJ,UACC,IAAI,gBAAgB,gBAAgB,EAClC,QAAQ,IAAI,gBAAgB,eAAe;EACzC;EACA,OAAO;EACP,aAAa;CACf,CAAC,EACH,CAAC,CACL,CACF;AACJ;;;;;;AAOA,SAAgB,qBACd,SACqC;CACrC,MAAM,OAAO,QAAQ;CACrB,IAAI,KAAK,SAAS,gBAAgB,CAAC,OAAO,KAAK,WAAW,GACxD,OAAO;CAET,MAAM,OAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;CACpE,OAAO,kBAAkB,QACvB,SACA,SAAS,WAAW,wBAAwB,IAAI,GAAG,KAAK,WAAW,CACrE;AACF;AAEA,SAAS,wBAAwB,OAAyB;CACxD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,uBAAuB;CAClE,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,QAAQ,mBAAmB,UAAU,MAAM;EAC/C,OAAO,OAAO,wBAAwB,KAAK;CAC7C;CACA,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,wBACd,UACuF;CACvF,IAAI,CAAC,OAAO,SAAS,QAAQ,mBAAmB,EAAE,GAChD,OAAO,OAAO,QAAQ,QAAQ;CAEhC,OAAO,OAAO,IAAI,SAAS,OAAO,SAAS;EACzC,MAAM,OAAO,KAAK,MAAM,IAAI;EAC5B,OAAO,mBAAmB,QACxB,SAAS,SACT,IAAI,SAAS,KAAK,UAAU,kBAAkB,IAAI,CAAC,GAAG;GACpD,QAAQ,SAAS;GACjB,SAAS,SAAS;EACpB,CAAC,CACH;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAwD;CACxF,IAAI,KAAK,SAAS,WAAW;EAE3B,KAAK,QAAQ;GACX,gBAAgB;GAChB,6BAA6B;GAC7B,yBAAyB;GACzB,eAAe;GACf,cAAc;GACd,GAPa,KAAK,SAAS,CAAC;EAQ9B;EACA,IAAI,MAAM,QAAQ,KAAK,OAAO,GAC5B,KAAK,UAAU,KAAK,QAAQ,KAAK,UAC/B,SAAS,KAAK,KAAK,MAAM,SAAS,aAAa;GAAE,WAAW;GAAI,GAAG;EAAM,IAAI,KAC/E;EAEF,OAAO;CACT;CACA,IAAI,SAAS,KAAK,KAAK,GAAG;EACxB,MAAM,QAAQ,sBAAsB,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,IAC3D,KAAK,QACL;GAAE,GAAG,KAAK;GAAO,MAAM;EAAY;EACvC,OAAO;GAAE,MAAM;GAAS,YAAY;GAAM,GAAG;GAAM;EAAM;CAC3D;CACA,OAAO;AACT;AAEA,MAAM,wCAAwB,IAAI,IAAI;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OAAO,aAA8B;CAC5C,OAAO,YAAY,WAAW,kBAAkB;AAClD"}
+{"version":3,"file":"index.js","names":["holder","Credentials.Credentials","Credentials.formatHeaders"],"sources":["../src/Credentials.ts","../src/AiGateway.ts"],"sourcesContent":["/**\n * How gateway requests authenticate.\n *\n * `Credentials` holds an effect that produces the credential for one request.\n * It runs per request rather than once at startup: on Vercel the OIDC token\n * arrives on the request context and rotates, so it must not be cached. Pick\n * a `from*` layer for where the credential comes from.\n *\n * @example\n * ```ts\n * import { Credentials } from \"effect-ai-vercel-gateway\"\n *\n * Credentials.fromChain()      // AI_GATEWAY_API_KEY, else the Vercel OIDC token\n * Credentials.fromEnv()        // AI_GATEWAY_API_KEY only\n * Credentials.fromVercelOidc() // the Vercel OIDC token only\n * Credentials.fromApiKey(\"…\")  // a fixed value\n * ```\n */\n\nimport { Config, Context, Data, Effect, Layer, Option, Redacted } from \"effect\"\n\n/** The environment variable `fromEnv` reads. */\nexport const API_KEY_ENV = \"AI_GATEWAY_API_KEY\"\n\n/** The environment variable `fromVercelOidc` falls back to. */\nexport const OIDC_TOKEN_ENV = \"VERCEL_OIDC_TOKEN\"\n\n/** Which `from*` layer produced or failed to produce a credential. */\nexport type Source = \"api-key\" | \"env\" | \"vercel-oidc\" | \"chain\"\n\n/**\n * A credential ready to put on a request. `method` is what the gateway\n * records as the auth method; it matches the values Vercel's own SDK sends.\n */\nexport interface Resolved {\n  readonly method: \"api-key\" | \"oidc\"\n  readonly token: Redacted.Redacted<string>\n}\n\n/** No credential could be produced for a gateway request. */\nexport class CredentialsError extends Data.TaggedError(\"AiGatewayCredentialsError\")<{\n  readonly message: string\n  readonly source: Source\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\nexport class Credentials extends Context.Service<\n  Credentials,\n  Effect.Effect<Resolved, CredentialsError>\n>()(\"effect-ai-vercel-gateway/Credentials\") {}\n\n/** The request headers that carry `credentials`. */\nexport const formatHeaders = (credentials: Resolved): Record<string, string> => ({\n  \"x-api-key\": Redacted.value(credentials.token),\n  \"ai-gateway-auth-method\": credentials.method,\n})\n\nconst hints: Record<Source, ReadonlyArray<string>> = {\n  \"api-key\": [],\n  env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],\n  \"vercel-oidc\": [\n    \"Run on Vercel, where each request carries an OIDC token.\",\n    `Or run \\`vercel env pull\\` locally to populate ${OIDC_TOKEN_ENV}.`,\n  ],\n  chain: [\n    `Set ${API_KEY_ENV} to an AI Gateway API key.`,\n    \"Or run on Vercel / `vercel env pull` so an OIDC token is available.\",\n  ],\n}\n\n/**\n * Where a credential may come from. `None` means the place is not configured,\n * so a chain can move on; a failure means it is configured but unusable.\n */\ntype Lookup = Effect.Effect<Option.Option<Resolved>, CredentialsError>\n\nconst fromConfig = (name: string, method: Resolved[\"method\"], source: Source): Lookup =>\n  Config.option(Config.redacted(name)).pipe(\n    Effect.map(Option.map((token) => ({ method, token }))),\n    Effect.catchTag(\n      \"ConfigError\",\n      (cause) =>\n        new CredentialsError({\n          message: `Failed to read ${name}.`,\n          source,\n          hints: hints[source],\n          cause,\n        }),\n    ),\n  )\n\n/**\n * Vercel exposes the current request's context on a well-known global symbol.\n * In Functions, the `x-vercel-oidc-token` header of the request lives there.\n * Mirrors `@vercel/oidc`'s `getVercelOidcTokenSync`, minus the dev-time\n * refresh that package also offers.\n */\nconst REQUEST_CONTEXT = Symbol.for(\"@vercel/request-context\")\n\ntype RequestContext = { readonly headers?: Record<string, string | undefined> }\n\nconst fromRequestContext: Lookup = Effect.sync(() => {\n  const holder = globalThis as typeof globalThis & {\n    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }\n  }\n  const token = holder[REQUEST_CONTEXT]?.get?.()?.headers?.[\"x-vercel-oidc-token\"]\n  return token === undefined\n    ? Option.none()\n    : Option.some({ method: \"oidc\" as const, token: Redacted.make(token) })\n})\n\nconst firstOf = (lookups: ReadonlyArray<Lookup>): Lookup =>\n  Effect.gen(function* () {\n    for (const lookup of lookups) {\n      const found = yield* lookup\n      if (Option.isSome(found)) return found\n    }\n    return Option.none()\n  })\n\nconst require = (lookup: Lookup, source: Source, message: string) =>\n  Layer.succeed(Credentials)(\n    Effect.flatMap(lookup, (found) =>\n      Option.isSome(found)\n        ? Effect.succeed(found.value)\n        : Effect.fail(new CredentialsError({ message, source, hints: hints[source] })),\n    ),\n  )\n\nconst apiKeyLookup = fromConfig(API_KEY_ENV, \"api-key\", \"env\")\n\nconst vercelOidcLookup = firstOf([\n  fromRequestContext,\n  fromConfig(OIDC_TOKEN_ENV, \"oidc\", \"vercel-oidc\"),\n])\n\n/** A fixed API key. */\nexport const fromApiKey = (apiKey: string | Redacted.Redacted<string>): Layer.Layer<Credentials> =>\n  Layer.succeed(Credentials)(\n    Effect.succeed({\n      method: \"api-key\",\n      token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey),\n    }),\n  )\n\n/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */\nexport const fromEnv = (): Layer.Layer<Credentials> =>\n  require(apiKeyLookup, \"env\", `${API_KEY_ENV} is not set.`)\n\n/**\n * The OIDC token Vercel issues to the deployment: the `x-vercel-oidc-token`\n * header of the current request in Functions, else `VERCEL_OIDC_TOKEN` in\n * builds and after `vercel env pull`. Not refreshed when it expires locally.\n */\nexport const fromVercelOidc = (): Layer.Layer<Credentials> =>\n  require(vercelOidcLookup, \"vercel-oidc\", \"No Vercel OIDC token is available.\")\n\n/** `fromEnv`, then `fromVercelOidc`. The usual choice for an app deployed to Vercel. */\nexport const fromChain = (): Layer.Layer<Credentials> =>\n  require(firstOf([apiKeyLookup, vercelOidcLookup]), \"chain\", \"No AI Gateway credential found.\")\n","/**\n * Vercel AI Gateway as an Anthropic Messages API client for Effect AI.\n *\n * The gateway serves the Anthropic Messages API at its root URL and accepts\n * any model it lists, named `provider/model` (for example\n * `anthropic/claude-sonnet-4.5` or `google/gemini-2.5-flash`). Effect AI's\n * Anthropic provider only needs the base URL and the credential swapped, plus\n * two small dialect fixes (see `dropNullCacheControl` and\n * `fillMissingResponseKeys`), so this module is the one place the gateway is\n * configured.\n *\n * Structured output (`output_config.format`) works for every provider behind\n * the gateway, so the Anthropic provider's default of native structured\n * output holds for models it does not recognise.\n *\n * @example\n * ```ts\n * import { AiGateway, Credentials } from \"effect-ai-vercel-gateway\"\n * import { AnthropicLanguageModel } from \"@effect/ai-anthropic\"\n * import { Layer } from \"effect\"\n * import { FetchHttpClient } from \"effect/unstable/http\"\n *\n * const Model = AnthropicLanguageModel.layer({ model: \"anthropic/claude-sonnet-4.5\" }).pipe(\n *   Layer.provide(AiGateway.layer),\n *   Layer.provide([Credentials.fromChain(), FetchHttpClient.layer]),\n * )\n * ```\n */\n\nimport { AnthropicClient } from \"@effect/ai-anthropic\"\nimport { Effect, Layer } from \"effect\"\nimport {\n  HttpBody,\n  HttpClient,\n  HttpClientError,\n  HttpClientRequest,\n  HttpClientResponse,\n} from \"effect/unstable/http\"\nimport * as Credentials from \"./Credentials.js\"\n\n/** Base URL of the Vercel AI Gateway. */\nexport const AI_GATEWAY_URL = \"https://ai-gateway.vercel.sh\"\n\n/**\n * Builds the Anthropic client against the gateway, authenticating each\n * request with `credentials`. A credential failure fails that request as an\n * `HttpClientError`, which Effect AI surfaces as a network `AiError`.\n */\nexport const make = (credentials: typeof Credentials.Credentials.Service) =>\n  AnthropicClient.make({\n    apiUrl: AI_GATEWAY_URL,\n    transformClient: (client) =>\n      client.pipe(\n        HttpClient.mapRequestEffect(authenticate(credentials)),\n        HttpClient.mapRequest(dropNullCacheControl),\n        HttpClient.transformResponse(Effect.flatMap(fillMissingResponseKeys)),\n      ),\n  })\n\n/**\n * `AnthropicClient` backed by the gateway. Needs `Credentials` (see the\n * `Credentials` module's `from*` layers) and an `HttpClient`. Building never\n * fails; without a usable credential, the requests fail.\n */\nexport const layer: Layer.Layer<\n  AnthropicClient.AnthropicClient,\n  never,\n  Credentials.Credentials | HttpClient.HttpClient\n> = Layer.effect(AnthropicClient.AnthropicClient)(\n  Effect.flatMap(Effect.service(Credentials.Credentials), make),\n)\n\nfunction authenticate(credentials: typeof Credentials.Credentials.Service) {\n  return (request: HttpClientRequest.HttpClientRequest) =>\n    credentials.pipe(\n      Effect.map((resolved) =>\n        HttpClientRequest.setHeaders(request, Credentials.formatHeaders(resolved)),\n      ),\n      Effect.mapError(\n        (error) =>\n          new HttpClientError.HttpClientError({\n            reason: new HttpClientError.TransportError({\n              request,\n              cause: error,\n              description: \"AI Gateway credential unavailable\",\n            }),\n          }),\n      ),\n    )\n}\n\n/**\n * The Effect provider writes `\"cache_control\": null` on every content block\n * it has no cache setting for. Anthropic accepts that; the gateway rejects\n * the request with `messages.0.content: Invalid input`. Remove the null keys.\n */\nexport function dropNullCacheControl(\n  request: HttpClientRequest.HttpClientRequest,\n): HttpClientRequest.HttpClientRequest {\n  const body = request.body\n  if (body._tag !== \"Uint8Array\" || !isJson(body.contentType)) {\n    return request\n  }\n  const json: unknown = JSON.parse(new TextDecoder().decode(body.body))\n  return HttpClientRequest.setBody(\n    request,\n    HttpBody.jsonUnsafe(withoutNullCacheControl(json), body.contentType),\n  )\n}\n\nfunction withoutNullCacheControl(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(withoutNullCacheControl)\n  if (value === null || typeof value !== \"object\") return value\n  const result: Record<string, unknown> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    if (key === \"cache_control\" && entry === null) continue\n    result[key] = withoutNullCacheControl(entry)\n  }\n  return result\n}\n\n/**\n * The gateway's Anthropic-shaped responses leave out keys that Anthropic\n * always sends and the Effect provider's schema requires: the cache and\n * service-tier usage fields, the `signature` of a thinking block from a\n * non-Anthropic model, and `type`/`request_id` on error envelopes, whose\n * `error.type` may also be a gateway-specific value. Fill them with the values\n * Anthropic uses when there is nothing to report. Streaming responses are not\n * JSON and pass through untouched.\n */\nexport function fillMissingResponseKeys(\n  response: HttpClientResponse.HttpClientResponse,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> {\n  if (!isJson(response.headers[\"content-type\"] ?? \"\")) {\n    return Effect.succeed(response)\n  }\n  return Effect.map(response.text, (text) => {\n    const body = JSON.parse(text) as Record<string, unknown>\n    return HttpClientResponse.fromWeb(\n      response.request,\n      new Response(JSON.stringify(patchResponseBody(body)), {\n        status: response.status,\n        headers: response.headers,\n      }),\n    )\n  })\n}\n\nexport function patchResponseBody(body: Record<string, unknown>): Record<string, unknown> {\n  if (body.type === \"message\") {\n    const usage = (body.usage ?? {}) as Record<string, unknown>\n    body.usage = {\n      cache_creation: null,\n      cache_creation_input_tokens: null,\n      cache_read_input_tokens: null,\n      inference_geo: null,\n      service_tier: null,\n      ...usage,\n    }\n    if (Array.isArray(body.content)) {\n      body.content = body.content.map((block: unknown) =>\n        isRecord(block) && block.type === \"thinking\" ? { signature: \"\", ...block } : block,\n      )\n    }\n    return body\n  }\n  if (isRecord(body.error)) {\n    const error = ANTHROPIC_ERROR_TYPES.has(String(body.error.type))\n      ? body.error\n      : { ...body.error, type: \"api_error\" }\n    return { type: \"error\", request_id: null, ...body, error }\n  }\n  return body\n}\n\nconst ANTHROPIC_ERROR_TYPES = new Set([\n  \"invalid_request_error\",\n  \"authentication_error\",\n  \"billing_error\",\n  \"permission_error\",\n  \"not_found_error\",\n  \"rate_limit_error\",\n  \"timeout_error\",\n  \"api_error\",\n  \"overloaded_error\",\n])\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction isJson(contentType: string): boolean {\n  return contentType.startsWith(\"application/json\")\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAa,cAAc;;AAG3B,MAAa,iBAAiB;;AAe9B,IAAa,mBAAb,cAAsC,KAAK,YAAY,2BAA2B,CAAC,CAKhF,CAAC;AAEJ,IAAa,cAAb,cAAiC,QAAQ,QAGvC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;;AAG7C,MAAa,iBAAiB,iBAAmD;CAC/E,aAAa,SAAS,MAAM,YAAY,KAAK;CAC7C,0BAA0B,YAAY;AACxC;AAEA,MAAM,QAA+C;CACnD,WAAW,CAAC;CACZ,KAAK,CAAC,OAAO,YAAY,2BAA2B;CACpD,eAAe,CACb,4DACA,kDAAkD,eAAe,EACnE;CACA,OAAO,CACL,OAAO,YAAY,6BACnB,qEACF;AACF;AAQA,MAAM,cAAc,MAAc,QAA4B,WAC5D,OAAO,OAAO,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,KACnC,OAAO,IAAI,OAAO,KAAK,WAAW;CAAE;CAAQ;AAAM,EAAE,CAAC,GACrD,OAAO,SACL,gBACC,UACC,IAAI,iBAAiB;CACnB,SAAS,kBAAkB,KAAK;CAChC;CACA,OAAO,MAAM;CACb;AACF,CAAC,CACL,CACF;;;;;;;AAQF,MAAM,kBAAkB,OAAO,IAAI,yBAAyB;AAI5D,MAAM,qBAA6B,OAAO,WAAW;CAInD,MAAM,QAAQA,WAAO,gBAAgB,EAAE,MAAM,CAAC,EAAE,UAAU;CAC1D,OAAO,UAAU,KAAA,IACb,OAAO,KAAK,IACZ,OAAO,KAAK;EAAE,QAAQ;EAAiB,OAAO,SAAS,KAAK,KAAK;CAAE,CAAC;AAC1E,CAAC;AAED,MAAM,WAAW,YACf,OAAO,IAAI,aAAa;CACtB,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,OAAO,KAAK,GAAG,OAAO;CACnC;CACA,OAAO,OAAO,KAAK;AACrB,CAAC;AAEH,MAAM,WAAW,QAAgB,QAAgB,YAC/C,MAAM,QAAQ,WAAW,CAAC,CACxB,OAAO,QAAQ,SAAS,UACtB,OAAO,OAAO,KAAK,IACf,OAAO,QAAQ,MAAM,KAAK,IAC1B,OAAO,KAAK,IAAI,iBAAiB;CAAE;CAAS;CAAQ,OAAO,MAAM;AAAQ,CAAC,CAAC,CACjF,CACF;AAEF,MAAM,eAAe,WAAW,aAAa,WAAW,KAAK;AAE7D,MAAM,mBAAmB,QAAQ,CAC/B,oBACA,WAAW,gBAAgB,QAAQ,aAAa,CAClD,CAAC;;AAGD,MAAa,cAAc,WACzB,MAAM,QAAQ,WAAW,CAAC,CACxB,OAAO,QAAQ;CACb,QAAQ;CACR,OAAO,SAAS,WAAW,MAAM,IAAI,SAAS,SAAS,KAAK,MAAM;AACpE,CAAC,CACH;;AAGF,MAAa,gBACX,QAAQ,cAAc,OAAO,GAAG,YAAY,aAAa;;;;;;AAO3D,MAAa,uBACX,QAAQ,kBAAkB,eAAe,oCAAoC;;AAG/E,MAAa,kBACX,QAAQ,QAAQ,CAAC,cAAc,gBAAgB,CAAC,GAAG,SAAS,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvH/F,MAAa,iBAAiB;;;;;;AAO9B,MAAa,QAAQ,gBACnB,gBAAgB,KAAK;CACnB,QAAQ;CACR,kBAAkB,WAChB,OAAO,KACL,WAAW,iBAAiB,aAAa,WAAW,CAAC,GACrD,WAAW,WAAW,oBAAoB,GAC1C,WAAW,kBAAkB,OAAO,QAAQ,uBAAuB,CAAC,CACtE;AACJ,CAAC;;;;;;AAOH,MAAa,QAIT,MAAM,OAAO,gBAAgB,eAAe,CAAC,CAC/C,OAAO,QAAQ,OAAO,QAAQC,WAAuB,GAAG,IAAI,CAC9D;AAEA,SAAS,aAAa,aAAqD;CACzE,QAAQ,YACN,YAAY,KACV,OAAO,KAAK,aACV,kBAAkB,WAAW,SAASC,cAA0B,QAAQ,CAAC,CAC3E,GACA,OAAO,UACJ,UACC,IAAI,gBAAgB,gBAAgB,EAClC,QAAQ,IAAI,gBAAgB,eAAe;EACzC;EACA,OAAO;EACP,aAAa;CACf,CAAC,EACH,CAAC,CACL,CACF;AACJ;;;;;;AAOA,SAAgB,qBACd,SACqC;CACrC,MAAM,OAAO,QAAQ;CACrB,IAAI,KAAK,SAAS,gBAAgB,CAAC,OAAO,KAAK,WAAW,GACxD,OAAO;CAET,MAAM,OAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;CACpE,OAAO,kBAAkB,QACvB,SACA,SAAS,WAAW,wBAAwB,IAAI,GAAG,KAAK,WAAW,CACrE;AACF;AAEA,SAAS,wBAAwB,OAAyB;CACxD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,uBAAuB;CAClE,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,QAAQ,mBAAmB,UAAU,MAAM;EAC/C,OAAO,OAAO,wBAAwB,KAAK;CAC7C;CACA,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,wBACd,UACuF;CACvF,IAAI,CAAC,OAAO,SAAS,QAAQ,mBAAmB,EAAE,GAChD,OAAO,OAAO,QAAQ,QAAQ;CAEhC,OAAO,OAAO,IAAI,SAAS,OAAO,SAAS;EACzC,MAAM,OAAO,KAAK,MAAM,IAAI;EAC5B,OAAO,mBAAmB,QACxB,SAAS,SACT,IAAI,SAAS,KAAK,UAAU,kBAAkB,IAAI,CAAC,GAAG;GACpD,QAAQ,SAAS;GACjB,SAAS,SAAS;EACpB,CAAC,CACH;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAwD;CACxF,IAAI,KAAK,SAAS,WAAW;EAE3B,KAAK,QAAQ;GACX,gBAAgB;GAChB,6BAA6B;GAC7B,yBAAyB;GACzB,eAAe;GACf,cAAc;GACd,GAPa,KAAK,SAAS,CAAC;EAQ9B;EACA,IAAI,MAAM,QAAQ,KAAK,OAAO,GAC5B,KAAK,UAAU,KAAK,QAAQ,KAAK,UAC/B,SAAS,KAAK,KAAK,MAAM,SAAS,aAAa;GAAE,WAAW;GAAI,GAAG;EAAM,IAAI,KAC/E;EAEF,OAAO;CACT;CACA,IAAI,SAAS,KAAK,KAAK,GAAG;EACxB,MAAM,QAAQ,sBAAsB,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,IAC3D,KAAK,QACL;GAAE,GAAG,KAAK;GAAO,MAAM;EAAY;EACvC,OAAO;GAAE,MAAM;GAAS,YAAY;GAAM,GAAG;GAAM;EAAM;CAC3D;CACA,OAAO;AACT;AAEA,MAAM,wCAAwB,IAAI,IAAI;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OAAO,aAA8B;CAC5C,OAAO,YAAY,WAAW,kBAAkB;AAClD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "effect-ai-vercel-gateway",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Vercel AI Gateway client for Effect AI (@effect/ai-anthropic)",
   "keywords": [
     "ai-gateway",
@@ -33,11 +33,11 @@
     "access": "public"
   },
   "devDependencies": {
-    "@effect/ai-anthropic": "4.0.0-rc.115",
+    "@effect/ai-anthropic": "4.0.0-rc.112",
     "@effect/language-service": "^0.87.2",
-    "@effect/vitest": "4.0.0-rc.115",
+    "@effect/vitest": "4.0.0-rc.112",
     "@types/node": "^24",
-    "effect": "4.0.0-rc.115",
+    "effect": "4.0.0-rc.112",
     "oxfmt": "^0.68.0",
     "oxlint": "^1.83.0",
     "tsdown": "^0.23.0",
@@ -45,8 +45,8 @@
     "vitest": "^5.0.1"
   },
   "peerDependencies": {
-    "@effect/ai-anthropic": "^4.0.0-rc.112",
-    "effect": "^4.0.0-rc.112"
+    "@effect/ai-anthropic": "4.0.0-rc.112",
+    "effect": "4.0.0-rc.112"
   },
   "scripts": {
     "build": "tsdown",

package/src/Credentials.ts

@@ -76,7 +76,7 @@ const hints: Record<Source, ReadonlyArray<string>> = {
 type Lookup = Effect.Effect<Option.Option<Resolved>, CredentialsError>
 
 const fromConfig = (name: string, method: Resolved["method"], source: Source): Lookup =>
-  Config.option(Config.Redacted(name)).pipe(
+  Config.option(Config.redacted(name)).pipe(
     Effect.map(Option.map((token) => ({ method, token }))),
     Effect.catchTag(
       "ConfigError",