effect-vercel 0.1.0

package/dist/oidc.d.ts

@@ -0,0 +1,27 @@
+import { Effect, Option, Redacted } from "effect";
+declare namespace VercelOidc_d_exports {
+  export { TOKEN_ENV, VercelOidcError, find, hints, token };
+}
+/** The environment variable read when no request carries a token. */
+declare const TOKEN_ENV = "VERCEL_OIDC_TOKEN";
+declare const VercelOidcError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "VercelOidcError";
+} & Readonly<A>;
+/** No usable OIDC token. */
+declare class VercelOidcError extends VercelOidcError_base<{
+  readonly message: string;
+  readonly hints: ReadonlyArray<string>;
+  readonly cause?: unknown;
+}> {}
+/** How to make a token available. */
+declare const hints: ReadonlyArray<string>;
+/**
+ * The token if one is available: the request header, else `VERCEL_OIDC_TOKEN`.
+ * `None` means neither is set, so a caller can fall back to something else.
+ */
+declare const find: Effect.Effect<Option.Option<Redacted.Redacted<string>>, VercelOidcError>;
+/** Like `find`, but fails when no token is available. */
+declare const token: Effect.Effect<Redacted.Redacted<string>, VercelOidcError>;
+//#endregion
+export { VercelOidc_d_exports as VercelOidc };
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.js

@@ -0,0 +1,2 @@
+import { t as VercelOidc_exports } from "./VercelOidc--1oU5DP2.js";
+export { VercelOidc_exports as VercelOidc };

package/dist/rolldown-runtime-D7D4PA-g.js

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll as t };

package/dist/runtime-cache.d.ts

@@ -0,0 +1,27 @@
+import { Layer } from "effect";
+import { RuntimeCache } from "@vercel/functions";
+import { Persistence } from "effect/unstable/persistence";
+declare namespace VercelRuntimeCache_d_exports {
+  export { layer, layerBacking, makeBacking };
+}
+/**
+ * A `BackingPersistence` over `cache`.
+ *
+ * Entries are keyed by the JSON pair `[storeId, key]`, so no two stores share
+ * a key. Each entry is tagged with a hash of the store id, since tags are
+ * joined with `,` and sent unescaped, and `clear` expires that tag. Entries
+ * are sent without a name, so keys don't reach Vercel's o11y or the request
+ * headers, where non-Latin-1 characters would make the write fail. TTLs round
+ * up to whole seconds, the cache's resolution.
+ *
+ * `getCache()` hashes keys with a 32-bit hash by default, which can collide.
+ * Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.
+ */
+declare const makeBacking: (cache: RuntimeCache) => Persistence.BackingPersistence["Service"];
+/** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */
+declare const layerBacking: Layer.Layer<Persistence.BackingPersistence>;
+/** `Persistence` backed by the Vercel Runtime Cache. */
+declare const layer: Layer.Layer<Persistence.Persistence>;
+//#endregion
+export { VercelRuntimeCache_d_exports as VercelRuntimeCache };
+//# sourceMappingURL=runtime-cache.d.ts.map

package/dist/runtime-cache.js

@@ -0,0 +1,100 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { Duration, Effect, Layer } from "effect";
+import { createHash } from "node:crypto";
+import { getCache } from "@vercel/functions";
+import { Persistence } from "effect/unstable/persistence";
+//#region src/VercelRuntimeCache.ts
+/**
+* Effect `Persistence` backed by the Vercel Runtime Cache, so a
+* `PersistedCache` shares results across Function instances in a region.
+*
+* Outside Vercel, `getCache` falls back to an in-memory cache, so the same
+* layer works in local dev and tests.
+*
+* @example
+* ```ts
+* import { VercelRuntimeCache } from "effect-vercel/runtime-cache"
+* import { Effect } from "effect"
+* import { PersistedCache } from "effect/unstable/persistence"
+*
+* const program = Effect.gen(function* () {
+*   const users = yield* PersistedCache.make(fetchUser, {
+*     storeId: "users",
+*     timeToLive: () => "1 hour",
+*   })
+*   return yield* users.get(new GetUser({ id: 1 }))
+* }).pipe(Effect.scoped, Effect.provide(VercelRuntimeCache.layer))
+* ```
+*/
+var VercelRuntimeCache_exports = /* @__PURE__ */ __exportAll({
+	layer: () => layer,
+	layerBacking: () => layerBacking,
+	makeBacking: () => makeBacking
+});
+const sha256 = (key) => createHash("sha256").update(key).digest("hex");
+/**
+* A `BackingPersistence` over `cache`.
+*
+* Entries are keyed by the JSON pair `[storeId, key]`, so no two stores share
+* a key. Each entry is tagged with a hash of the store id, since tags are
+* joined with `,` and sent unescaped, and `clear` expires that tag. Entries
+* are sent without a name, so keys don't reach Vercel's o11y or the request
+* headers, where non-Latin-1 characters would make the write fail. TTLs round
+* up to whole seconds, the cache's resolution.
+*
+* `getCache()` hashes keys with a 32-bit hash by default, which can collide.
+* Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.
+*/
+const makeBacking = (cache) => Persistence.BackingPersistence.of({ make: (storeId) => Effect.sync(() => {
+	const prefixed = (key) => JSON.stringify([storeId, key]);
+	const tag = `effect-persistence:${sha256(storeId)}`;
+	const get = (key) => Effect.tryPromise({
+		try: () => cache.get(prefixed(key)),
+		catch: (cause) => new Persistence.PersistenceError({
+			message: `Failed to get key ${key}`,
+			cause
+		})
+	}).pipe(Effect.map((value) => typeof value === "object" && value !== null ? value : void 0));
+	const set = (key, value, ttl) => Effect.tryPromise({
+		try: () => cache.set(prefixed(key), value, {
+			name: "",
+			tags: [tag],
+			...ttl && { ttl: Math.max(1, Math.ceil(Duration.toSeconds(ttl))) }
+		}),
+		catch: (cause) => new Persistence.PersistenceError({
+			message: `Failed to set key ${key}`,
+			cause
+		})
+	});
+	return {
+		get,
+		getMany: (keys) => Effect.forEach(keys, get, { concurrency: "unbounded" }),
+		set,
+		setMany: (entries) => Effect.forEach(new Map(entries.map(([key, value, ttl]) => [key, [value, ttl]])), ([key, [value, ttl]]) => set(key, value, ttl), {
+			concurrency: "unbounded",
+			discard: true
+		}),
+		remove: (key) => Effect.tryPromise({
+			try: () => cache.delete(prefixed(key)),
+			catch: (cause) => new Persistence.PersistenceError({
+				message: `Failed to remove key ${key}`,
+				cause
+			})
+		}),
+		clear: Effect.tryPromise({
+			try: () => cache.expireTag(tag),
+			catch: (cause) => new Persistence.PersistenceError({
+				message: `Failed to clear ${storeId}`,
+				cause
+			})
+		})
+	};
+}) });
+/** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */
+const layerBacking = Layer.sync(Persistence.BackingPersistence)(() => makeBacking(getCache({ keyHashFunction: sha256 })));
+/** `Persistence` backed by the Vercel Runtime Cache. */
+const layer = Persistence.layer.pipe(Layer.provide(layerBacking));
+//#endregion
+export { VercelRuntimeCache_exports as VercelRuntimeCache };
+
+//# sourceMappingURL=runtime-cache.js.map

package/dist/runtime-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-cache.js","names":[],"sources":["../src/VercelRuntimeCache.ts"],"sourcesContent":["/**\n * Effect `Persistence` backed by the Vercel Runtime Cache, so a\n * `PersistedCache` shares results across Function instances in a region.\n *\n * Outside Vercel, `getCache` falls back to an in-memory cache, so the same\n * layer works in local dev and tests.\n *\n * @example\n * ```ts\n * import { VercelRuntimeCache } from \"effect-vercel/runtime-cache\"\n * import { Effect } from \"effect\"\n * import { PersistedCache } from \"effect/unstable/persistence\"\n *\n * const program = Effect.gen(function* () {\n *   const users = yield* PersistedCache.make(fetchUser, {\n *     storeId: \"users\",\n *     timeToLive: () => \"1 hour\",\n *   })\n *   return yield* users.get(new GetUser({ id: 1 }))\n * }).pipe(Effect.scoped, Effect.provide(VercelRuntimeCache.layer))\n * ```\n */\n\nimport { createHash } from \"node:crypto\"\nimport { getCache, type RuntimeCache } from \"@vercel/functions\"\nimport { Duration, Effect, Layer } from \"effect\"\nimport { Persistence } from \"effect/unstable/persistence\"\n\nconst sha256 = (key: string) => createHash(\"sha256\").update(key).digest(\"hex\")\n\n/**\n * A `BackingPersistence` over `cache`.\n *\n * Entries are keyed by the JSON pair `[storeId, key]`, so no two stores share\n * a key. Each entry is tagged with a hash of the store id, since tags are\n * joined with `,` and sent unescaped, and `clear` expires that tag. Entries\n * are sent without a name, so keys don't reach Vercel's o11y or the request\n * headers, where non-Latin-1 characters would make the write fail. TTLs round\n * up to whole seconds, the cache's resolution.\n *\n * `getCache()` hashes keys with a 32-bit hash by default, which can collide.\n * Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.\n */\nexport const makeBacking = (cache: RuntimeCache): Persistence.BackingPersistence[\"Service\"] =>\n  Persistence.BackingPersistence.of({\n    make: (storeId) =>\n      Effect.sync(() => {\n        const prefixed = (key: string) => JSON.stringify([storeId, key])\n        const tag = `effect-persistence:${sha256(storeId)}`\n\n        const get = (key: string) =>\n          Effect.tryPromise({\n            try: () => cache.get(prefixed(key)),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to get key ${key}`, cause }),\n          }).pipe(\n            Effect.map((value) =>\n              typeof value === \"object\" && value !== null ? value : undefined,\n            ),\n          )\n\n        const set = (key: string, value: object, ttl: Duration.Duration | undefined) =>\n          Effect.tryPromise({\n            try: () =>\n              cache.set(prefixed(key), value, {\n                name: \"\",\n                tags: [tag],\n                ...(ttl && { ttl: Math.max(1, Math.ceil(Duration.toSeconds(ttl))) }),\n              }),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to set key ${key}`, cause }),\n          })\n\n        return {\n          get,\n          getMany: (keys) => Effect.forEach(keys, get, { concurrency: \"unbounded\" }),\n          set,\n          // Writes run concurrently, so keep only the last entry for each key.\n          setMany: (entries) =>\n            Effect.forEach(\n              new Map(entries.map(([key, value, ttl]) => [key, [value, ttl] as const])),\n              ([key, [value, ttl]]) => set(key, value, ttl),\n              { concurrency: \"unbounded\", discard: true },\n            ),\n          remove: (key) =>\n            Effect.tryPromise({\n              try: () => cache.delete(prefixed(key)),\n              catch: (cause) =>\n                new Persistence.PersistenceError({ message: `Failed to remove key ${key}`, cause }),\n            }),\n          clear: Effect.tryPromise({\n            try: () => cache.expireTag(tag),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to clear ${storeId}`, cause }),\n          }),\n        }\n      }),\n  })\n\n/** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */\nexport const layerBacking: Layer.Layer<Persistence.BackingPersistence> = Layer.sync(\n  Persistence.BackingPersistence,\n)(() => makeBacking(getCache({ keyHashFunction: sha256 })))\n\n/** `Persistence` backed by the Vercel Runtime Cache. */\nexport const layer: Layer.Layer<Persistence.Persistence> = Persistence.layer.pipe(\n  Layer.provide(layerBacking),\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,UAAU,QAAgB,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK;;;;;;;;;;;;;;AAe7E,MAAa,eAAe,UAC1B,YAAY,mBAAmB,GAAG,EAChC,OAAO,YACL,OAAO,WAAW;CAChB,MAAM,YAAY,QAAgB,KAAK,UAAU,CAAC,SAAS,GAAG,CAAC;CAC/D,MAAM,MAAM,sBAAsB,OAAO,OAAO;CAEhD,MAAM,OAAO,QACX,OAAO,WAAW;EAChB,WAAW,MAAM,IAAI,SAAS,GAAG,CAAC;EAClC,QAAQ,UACN,IAAI,YAAY,iBAAiB;GAAE,SAAS,qBAAqB;GAAO;EAAM,CAAC;CACnF,CAAC,CAAC,CAAC,KACD,OAAO,KAAK,UACV,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA,CACxD,CACF;CAEF,MAAM,OAAO,KAAa,OAAe,QACvC,OAAO,WAAW;EAChB,WACE,MAAM,IAAI,SAAS,GAAG,GAAG,OAAO;GAC9B,MAAM;GACN,MAAM,CAAC,GAAG;GACV,GAAI,OAAO,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC,EAAE;EACpE,CAAC;EACH,QAAQ,UACN,IAAI,YAAY,iBAAiB;GAAE,SAAS,qBAAqB;GAAO;EAAM,CAAC;CACnF,CAAC;CAEH,OAAO;EACL;EACA,UAAU,SAAS,OAAO,QAAQ,MAAM,KAAK,EAAE,aAAa,YAAY,CAAC;EACzE;EAEA,UAAU,YACR,OAAO,QACL,IAAI,IAAI,QAAQ,KAAK,CAAC,KAAK,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAU,CAAC,CAAC,IACvE,CAAC,KAAK,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAG,GAC5C;GAAE,aAAa;GAAa,SAAS;EAAK,CAC5C;EACF,SAAS,QACP,OAAO,WAAW;GAChB,WAAW,MAAM,OAAO,SAAS,GAAG,CAAC;GACrC,QAAQ,UACN,IAAI,YAAY,iBAAiB;IAAE,SAAS,wBAAwB;IAAO;GAAM,CAAC;EACtF,CAAC;EACH,OAAO,OAAO,WAAW;GACvB,WAAW,MAAM,UAAU,GAAG;GAC9B,QAAQ,UACN,IAAI,YAAY,iBAAiB;IAAE,SAAS,mBAAmB;IAAW;GAAM,CAAC;EACrF,CAAC;CACH;AACF,CAAC,EACL,CAAC;;AAGH,MAAa,eAA4D,MAAM,KAC7E,YAAY,kBACd,CAAC,OAAO,YAAY,SAAS,EAAE,iBAAiB,OAAO,CAAC,CAAC,CAAC;;AAG1D,MAAa,QAA8C,YAAY,MAAM,KAC3E,MAAM,QAAQ,YAAY,CAC5B"}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "effect-vercel",
+  "version": "0.1.0",
+  "description": "Effect integrations for Vercel: AI Gateway, OIDC, Runtime Cache",
+  "keywords": [
+    "ai-gateway",
+    "effect",
+    "effect-ai",
+    "oidc",
+    "runtime-cache",
+    "vercel"
+  ],
+  "homepage": "https://github.com/duailibe/effect-vercel#readme",
+  "bugs": {
+    "url": "https://github.com/duailibe/effect-vercel/issues"
+  },
+  "license": "MIT",
+  "author": "Lucas Duailibe <lucasds@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/duailibe/effect-vercel.git"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./ai-gateway": "./dist/ai-gateway.js",
+    "./oidc": "./dist/oidc.js",
+    "./runtime-cache": "./dist/runtime-cache.js",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check",
+    "prepublishOnly": "pnpm check && pnpm test && pnpm build"
+  },
+  "devDependencies": {
+    "@effect/ai-anthropic": "4.0.0-rc.112",
+    "@effect/language-service": "^0.87.2",
+    "@effect/vitest": "4.0.0-rc.112",
+    "@types/node": "^24",
+    "@vercel/functions": "^3.9.9",
+    "effect": "4.0.0-rc.112",
+    "oxfmt": "^0.68.0",
+    "oxlint": "^1.83.0",
+    "tsdown": "^0.23.0",
+    "typescript": "^5.9",
+    "vitest": "^5.0.1"
+  },
+  "peerDependencies": {
+    "@effect/ai-anthropic": "4.0.0-rc.112",
+    "@vercel/functions": "^3.9.9",
+    "effect": "4.0.0-rc.112"
+  },
+  "peerDependenciesMeta": {
+    "@effect/ai-anthropic": {
+      "optional": true
+    },
+    "@vercel/functions": {
+      "optional": true
+    }
+  },
+  "packageManager": "pnpm@10.33.0"
+}

package/src/AiGateway.ts

@@ -0,0 +1,202 @@
+/**
+ * Vercel AI Gateway as an Anthropic Messages API client for Effect AI.
+ *
+ * The gateway serves the Anthropic Messages API at its root URL and accepts
+ * any model it lists, named `provider/model` (for example
+ * `anthropic/claude-sonnet-4.5` or `google/gemini-2.5-flash`). Effect AI's
+ * Anthropic provider only needs the base URL and the credential swapped, plus
+ * two small dialect fixes (see `dropNullCacheControl` and
+ * `fillMissingResponseKeys`), so this module is the one place the gateway is
+ * configured.
+ *
+ * Structured output (`output_config.format`) works for every provider behind
+ * the gateway, so the Anthropic provider's default of native structured
+ * output holds for models it does not recognise.
+ *
+ * @example
+ * ```ts
+ * import { AiGateway } from "effect-vercel/ai-gateway"
+ * import { AnthropicLanguageModel } from "@effect/ai-anthropic"
+ * import { Layer } from "effect"
+ * import { FetchHttpClient } from "effect/unstable/http"
+ *
+ * const Model = AnthropicLanguageModel.layer({ model: "anthropic/claude-sonnet-4.5" }).pipe(
+ *   Layer.provide(AiGateway.layer),
+ *   Layer.provide(FetchHttpClient.layer),
+ * )
+ * ```
+ */
+
+import { AnthropicClient } from "@effect/ai-anthropic"
+import { Effect, Layer } from "effect"
+import {
+  HttpBody,
+  HttpClient,
+  HttpClientError,
+  HttpClientRequest,
+  HttpClientResponse,
+} from "effect/unstable/http"
+import * as AiGatewayCredentials from "./AiGatewayCredentials.js"
+
+/** Base URL of the Vercel AI Gateway. */
+export const AI_GATEWAY_URL = "https://ai-gateway.vercel.sh"
+
+/**
+ * Builds the Anthropic client against the gateway, authenticating each
+ * request with `credentials`. A credential failure fails that request as an
+ * `HttpClientError`, which Effect AI surfaces as a network `AiError`.
+ */
+export const make = (credentials: typeof AiGatewayCredentials.AiGatewayCredentials.Service) =>
+  AnthropicClient.make({
+    apiUrl: AI_GATEWAY_URL,
+    transformClient: (client) =>
+      client.pipe(
+        HttpClient.mapRequestEffect(authenticate(credentials)),
+        HttpClient.mapRequest(dropNullCacheControl),
+        HttpClient.transformResponse(Effect.flatMap(fillMissingResponseKeys)),
+      ),
+  })
+
+/**
+ * `AnthropicClient` backed by the gateway, authenticating with the
+ * `AiGatewayCredentials` you provide (see that module's `layerFrom*` layers).
+ * Needs an `HttpClient` too.
+ */
+export const layerWithoutCredentials: Layer.Layer<
+  AnthropicClient.AnthropicClient,
+  never,
+  AiGatewayCredentials.AiGatewayCredentials | HttpClient.HttpClient
+> = Layer.effect(AnthropicClient.AnthropicClient)(
+  Effect.flatMap(Effect.service(AiGatewayCredentials.AiGatewayCredentials), make),
+)
+
+/**
+ * `layerWithoutCredentials` with the default `AiGatewayCredentials.layer`:
+ * `AI_GATEWAY_API_KEY`, else the Vercel OIDC token. Needs an `HttpClient`.
+ * Building never fails; without a usable credential, the requests fail.
+ */
+export const layer: Layer.Layer<AnthropicClient.AnthropicClient, never, HttpClient.HttpClient> =
+  layerWithoutCredentials.pipe(Layer.provide(AiGatewayCredentials.layer))
+
+function authenticate(credentials: typeof AiGatewayCredentials.AiGatewayCredentials.Service) {
+  return (request: HttpClientRequest.HttpClientRequest) =>
+    credentials.pipe(
+      Effect.map((resolved) =>
+        HttpClientRequest.setHeaders(request, AiGatewayCredentials.formatHeaders(resolved)),
+      ),
+      Effect.mapError(
+        (error) =>
+          new HttpClientError.HttpClientError({
+            reason: new HttpClientError.TransportError({
+              request,
+              cause: error,
+              description: "AI Gateway credential unavailable",
+            }),
+          }),
+      ),
+    )
+}
+
+/**
+ * The Effect provider writes `"cache_control": null` on every content block
+ * it has no cache setting for. Anthropic accepts that; the gateway rejects
+ * the request with `messages.0.content: Invalid input`. Remove the null keys.
+ */
+export function dropNullCacheControl(
+  request: HttpClientRequest.HttpClientRequest,
+): HttpClientRequest.HttpClientRequest {
+  const body = request.body
+  if (body._tag !== "Uint8Array" || !isJson(body.contentType)) {
+    return request
+  }
+  const json: unknown = JSON.parse(new TextDecoder().decode(body.body))
+  return HttpClientRequest.setBody(
+    request,
+    HttpBody.jsonUnsafe(withoutNullCacheControl(json), body.contentType),
+  )
+}
+
+function withoutNullCacheControl(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(withoutNullCacheControl)
+  if (value === null || typeof value !== "object") return value
+  const result: Record<string, unknown> = {}
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "cache_control" && entry === null) continue
+    result[key] = withoutNullCacheControl(entry)
+  }
+  return result
+}
+
+/**
+ * The gateway's Anthropic-shaped responses leave out keys that Anthropic
+ * always sends and the Effect provider's schema requires: the cache and
+ * service-tier usage fields, the `signature` of a thinking block from a
+ * non-Anthropic model, and `type`/`request_id` on error envelopes, whose
+ * `error.type` may also be a gateway-specific value. Fill them with the values
+ * Anthropic uses when there is nothing to report. Streaming responses are not
+ * JSON and pass through untouched.
+ */
+export function fillMissingResponseKeys(
+  response: HttpClientResponse.HttpClientResponse,
+): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> {
+  if (!isJson(response.headers["content-type"] ?? "")) {
+    return Effect.succeed(response)
+  }
+  return Effect.map(response.text, (text) => {
+    const body = JSON.parse(text) as Record<string, unknown>
+    return HttpClientResponse.fromWeb(
+      response.request,
+      new Response(JSON.stringify(patchResponseBody(body)), {
+        status: response.status,
+        headers: response.headers,
+      }),
+    )
+  })
+}
+
+export function patchResponseBody(body: Record<string, unknown>): Record<string, unknown> {
+  if (body.type === "message") {
+    const usage = (body.usage ?? {}) as Record<string, unknown>
+    body.usage = {
+      cache_creation: null,
+      cache_creation_input_tokens: null,
+      cache_read_input_tokens: null,
+      inference_geo: null,
+      service_tier: null,
+      ...usage,
+    }
+    if (Array.isArray(body.content)) {
+      body.content = body.content.map((block: unknown) =>
+        isRecord(block) && block.type === "thinking" ? { signature: "", ...block } : block,
+      )
+    }
+    return body
+  }
+  if (isRecord(body.error)) {
+    const error = ANTHROPIC_ERROR_TYPES.has(String(body.error.type))
+      ? body.error
+      : { ...body.error, type: "api_error" }
+    return { type: "error", request_id: null, ...body, error }
+  }
+  return body
+}
+
+const ANTHROPIC_ERROR_TYPES = new Set([
+  "invalid_request_error",
+  "authentication_error",
+  "billing_error",
+  "permission_error",
+  "not_found_error",
+  "rate_limit_error",
+  "timeout_error",
+  "api_error",
+  "overloaded_error",
+])
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function isJson(contentType: string): boolean {
+  return contentType.startsWith("application/json")
+}

package/src/AiGatewayCredentials.ts

@@ -0,0 +1,152 @@
+/**
+ * How gateway requests authenticate.
+ *
+ * `AiGatewayCredentials` holds an effect that produces the credential for one
+ * request. It runs per request rather than once at startup: on Vercel the OIDC
+ * token arrives on the request context and rotates, so it must not be cached.
+ * `layer` is the default; pick a `layerFrom*` layer to use one source only.
+ *
+ * @example
+ * ```ts
+ * import { AiGatewayCredentials } from "effect-vercel/ai-gateway"
+ *
+ * AiGatewayCredentials.layer           // AI_GATEWAY_API_KEY, else the Vercel OIDC token
+ * AiGatewayCredentials.layerFromEnv         // AI_GATEWAY_API_KEY only
+ * AiGatewayCredentials.layerFromVercelOidc  // the Vercel OIDC token only
+ * AiGatewayCredentials.layerFromApiKey("…") // a fixed value
+ * ```
+ */
+
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect"
+import * as VercelOidc from "./VercelOidc.js"
+
+/** The environment variable `layerFromEnv` reads. */
+export const API_KEY_ENV = "AI_GATEWAY_API_KEY"
+
+/** Which layer produced or failed to produce a credential. */
+export type Source = "api-key" | "env" | "vercel-oidc" | "default"
+
+/**
+ * A credential ready to put on a request. `method` is what the gateway
+ * records as the auth method; it matches the values Vercel's own SDK sends.
+ */
+export interface Resolved {
+  readonly method: "api-key" | "oidc"
+  readonly token: Redacted.Redacted<string>
+}
+
+/** No credential could be produced for a gateway request. */
+export class AiGatewayCredentialsError extends Data.TaggedError("AiGatewayCredentialsError")<{
+  readonly message: string
+  readonly source: Source
+  readonly hints: ReadonlyArray<string>
+  readonly cause?: unknown
+}> {}
+
+export class AiGatewayCredentials extends Context.Service<
+  AiGatewayCredentials,
+  Effect.Effect<Resolved, AiGatewayCredentialsError>
+>()("effect-vercel/ai-gateway/AiGatewayCredentials") {}
+
+/** The request headers that carry `credentials`. */
+export const formatHeaders = (credentials: Resolved): Record<string, string> => ({
+  "x-api-key": Redacted.value(credentials.token),
+  "ai-gateway-auth-method": credentials.method,
+})
+
+const hints: Record<Source, ReadonlyArray<string>> = {
+  "api-key": [],
+  env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],
+  "vercel-oidc": VercelOidc.hints,
+  default: [
+    `Set ${API_KEY_ENV} to an AI Gateway API key.`,
+    "Or run on Vercel / `vercel env pull` so an OIDC token is available.",
+  ],
+}
+
+/**
+ * Where a credential may come from. `None` means the place is not configured,
+ * so a chain can move on; a failure means it is configured but unusable.
+ */
+type Lookup = Effect.Effect<Option.Option<Resolved>, AiGatewayCredentialsError>
+
+const apiKeyLookup: Lookup = Config.option(Config.redacted(API_KEY_ENV)).pipe(
+  Effect.map(Option.map((token) => ({ method: "api-key" as const, token }))),
+  Effect.catchTag(
+    "ConfigError",
+    (cause) =>
+      new AiGatewayCredentialsError({
+        message: `Failed to read ${API_KEY_ENV}.`,
+        source: "env",
+        hints: hints.env,
+        cause,
+      }),
+  ),
+)
+
+const vercelOidcLookup: Lookup = VercelOidc.find.pipe(
+  Effect.map(Option.map((token) => ({ method: "oidc" as const, token }))),
+  Effect.mapError(
+    (cause) =>
+      new AiGatewayCredentialsError({
+        message: cause.message,
+        source: "vercel-oidc",
+        hints: cause.hints,
+        cause,
+      }),
+  ),
+)
+
+const firstOf = (lookups: ReadonlyArray<Lookup>): Lookup =>
+  Effect.gen(function* () {
+    for (const lookup of lookups) {
+      const found = yield* lookup
+      if (Option.isSome(found)) return found
+    }
+    return Option.none()
+  })
+
+const toLayer = (lookup: Lookup, source: Source, message: string) =>
+  Layer.succeed(AiGatewayCredentials)(
+    Effect.flatMap(lookup, (found) =>
+      Option.isSome(found)
+        ? Effect.succeed(found.value)
+        : Effect.fail(new AiGatewayCredentialsError({ message, source, hints: hints[source] })),
+    ),
+  )
+
+/** A fixed API key. */
+export const layerFromApiKey = (
+  apiKey: string | Redacted.Redacted<string>,
+): Layer.Layer<AiGatewayCredentials> =>
+  Layer.succeed(AiGatewayCredentials)(
+    Effect.succeed({
+      method: "api-key",
+      token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey),
+    }),
+  )
+
+/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
+export const layerFromEnv: Layer.Layer<AiGatewayCredentials> = toLayer(
+  apiKeyLookup,
+  "env",
+  `${API_KEY_ENV} is not set.`,
+)
+
+/** The Vercel OIDC token (see `VercelOidc.find`). Not refreshed when it expires locally. */
+export const layerFromVercelOidc: Layer.Layer<AiGatewayCredentials> = toLayer(
+  vercelOidcLookup,
+  "vercel-oidc",
+  "No Vercel OIDC token is available.",
+)
+
+/**
+ * The default: `layerFromEnv`, then `layerFromVercelOidc`. Same order as
+ * Vercel's own SDK, so it works locally with an API key and on Vercel without
+ * one.
+ */
+export const layer: Layer.Layer<AiGatewayCredentials> = toLayer(
+  firstOf([apiKeyLookup, vercelOidcLookup]),
+  "default",
+  "No AI Gateway credential found.",
+)