effect-vercel 0.3.0 → 0.4.0

package/README.md

@@ -1,19 +1,25 @@
 # effect-vercel
 
-[Effect](https://effect.website) (v4) integrations for Vercel. Each one is its own entry point:
+[Effect](https://effect.website) (v4) integrations for Vercel. Each module is its own entry
+point, imported as a namespace like Effect's own modules:
 
-| Import                        | What                                                                            |
-| ----------------------------- | ------------------------------------------------------------------------------- |
-| `effect-vercel/ai-gateway`    | [Vercel AI Gateway](https://vercel.com/docs/ai-gateway) for Effect AI           |
-| `effect-vercel/oidc`          | The OIDC token Vercel issues to a deployment                                    |
-| `effect-vercel/runtime-cache` | [Runtime Cache](https://vercel.com/docs/runtime-cache) for Effect `Persistence` |
+```ts
+import * as AiGateway from "effect-vercel/AiGateway"
+```
+
+| Module                               | What                                                                            |
+| ------------------------------------ | ------------------------------------------------------------------------------- |
+| `effect-vercel/AiGateway`            | [Vercel AI Gateway](https://vercel.com/docs/ai-gateway) for Effect AI           |
+| `effect-vercel/AiGatewayCredentials` | How AI Gateway requests authenticate                                            |
+| `effect-vercel/Oidc`                 | The OIDC token Vercel issues to a deployment                                    |
+| `effect-vercel/RuntimeCache`         | [Runtime Cache](https://vercel.com/docs/runtime-cache) for Effect `Persistence` |
 
 ## Install
 
 ```sh
 pnpm add effect-vercel effect
-pnpm add @effect/ai-anthropic   # only for effect-vercel/ai-gateway
-pnpm add @vercel/functions      # only for effect-vercel/runtime-cache
+pnpm add @effect/ai-anthropic   # only for effect-vercel/AiGateway
+pnpm add @vercel/functions      # only for effect-vercel/RuntimeCache
 ```
 
 ## AI Gateway
@@ -26,7 +32,7 @@ dialect and what the provider's schemas expect.
 ### Usage
 
 ```ts
-import { AiGateway } from "effect-vercel/ai-gateway"
+import * as AiGateway from "effect-vercel/AiGateway"
 import { AnthropicLanguageModel } from "@effect/ai-anthropic"
 import { Effect, Layer } from "effect"
 import { LanguageModel } from "effect/ai"
@@ -56,6 +62,8 @@ To pick the source yourself, use `AiGateway.layerWithoutCredentials` and provide
 `AiGatewayCredentials` layer:
 
 ```ts
+import * as AiGatewayCredentials from "effect-vercel/AiGatewayCredentials"
+
 AnthropicLanguageModel.layer({ model: "google/gemini-2.5-flash" }).pipe(
   Layer.provide(AiGateway.layerWithoutCredentials),
   Layer.provide([AiGatewayCredentials.layerFromApiKey(key), FetchHttpClient.layer]),
@@ -64,9 +72,9 @@ AnthropicLanguageModel.layer({ model: "google/gemini-2.5-flash" }).pipe(
 
 | Layer                                       | Source                                                    |
 | ------------------------------------------- | --------------------------------------------------------- |
-| `AiGatewayCredentials.layer`                | The default: `layerFromEnv`, then `layerFromVercelOidc`.  |
+| `AiGatewayCredentials.layer`                | The default: `layerFromEnv`, then `layerFromOidc`.        |
 | `AiGatewayCredentials.layerFromEnv`         | `AI_GATEWAY_API_KEY`. Local dev, CI, anywhere off Vercel. |
-| `AiGatewayCredentials.layerFromVercelOidc`  | The Vercel OIDC token (see [OIDC](#oidc)).                |
+| `AiGatewayCredentials.layerFromOidc`        | The Vercel OIDC token (see [OIDC](#oidc)).                |
 | `AiGatewayCredentials.layerFromApiKey(key)` | A fixed key. Tests, custom wiring.                        |
 
 The credential is resolved on every request, so a rotating token is always current.
@@ -96,31 +104,29 @@ Vercel issues each deployment an OIDC token. Use it for the AI Gateway, or excha
 cloud credentials (AWS `AssumeRoleWithWebIdentity`, GCP workload identity federation).
 
 ```ts
-import { VercelOidc } from "effect-vercel/oidc"
+import * as Oidc from "effect-vercel/Oidc"
 import { Effect, Redacted } from "effect"
 
 const program = Effect.gen(function* () {
-  const token = yield* VercelOidc.token
+  const token = yield* Oidc.ambientToken
   // Redacted.value(token) is the web identity token
 })
 ```
 
-- `VercelOidc.token` reads the `x-vercel-oidc-token` header of the current request
-  (Functions), else `VERCEL_OIDC_TOKEN` (builds, `vercel env pull`). It fails with a
-  `VercelOidcError` when neither is set.
-- `VercelOidc.find` is the same but returns `Option.none()` instead of failing, for fallback
-  chains.
+`Oidc.ambientToken` reads the `x-vercel-oidc-token` header of the current request
+(Functions), else `VERCEL_OIDC_TOKEN` (builds, `vercel env pull`). Empty values count as
+unset. It fails with an `OidcError` when neither is set.
 
-Both read the token on every run, since it rotates per request. They do not refresh an
+It reads the token on every run, since it rotates per request. It does not refresh an
 expired local token; re-run `vercel env pull`.
 
 ## Runtime Cache
 
-`VercelRuntimeCache.layer` provides Effect's `Persistence`, stored in the Vercel Runtime Cache.
+`RuntimeCache.layer` provides Effect's `Persistence`, stored in the Vercel Runtime Cache.
 Use it with `PersistedCache` to share results across Function instances in a region.
 
 ```ts
-import { VercelRuntimeCache } from "effect-vercel/runtime-cache"
+import * as RuntimeCache from "effect-vercel/RuntimeCache"
 import { Effect, Schema } from "effect"
 import { Persistable, PersistedCache } from "effect/persistence"
 
@@ -136,14 +142,14 @@ const program = Effect.gen(function* () {
     timeToLive: () => "1 hour",
   })
   return yield* users.get(new GetUser({ id: 1 }))
-}).pipe(Effect.scoped, Effect.provide(VercelRuntimeCache.layer))
+}).pipe(Effect.scoped, Effect.provide(RuntimeCache.layer))
 ```
 
 - Off Vercel, `@vercel/functions` falls back to an in-memory cache, so the layer works in
   local dev and tests.
 - Entries are keyed by `[storeId, primaryKey]`, hashed with SHA-256. Only the hash reaches
   Vercel. `getCache`'s default hash is 32-bit and can collide, so
-  `VercelRuntimeCache.makeBacking(cache)` expects a cache with a stronger `keyHashFunction` if
+  `RuntimeCache.makeBacking(cache)` expects a cache with a stronger `keyHashFunction` if
   you build your own.
 - Each entry is tagged `effect-persistence:<sha256 of storeId>`. `clear` expires that tag.
 - TTLs round up to whole seconds.

package/dist/AiGateway.d.ts

@@ -0,0 +1,44 @@
+import { AiGatewayCredentials, t as AiGatewayCredentials_d_exports } from "./AiGatewayCredentials.js";
+import { AnthropicClient } from "@effect/ai-anthropic";
+import { Effect, Layer } from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
+//#region src/AiGateway.d.ts
+/** Base URL of the Vercel AI Gateway. */
+export declare const AI_GATEWAY_URL = "https://ai-gateway.vercel.sh";
+/**
+ * Builds the Anthropic client against the gateway, authenticating each
+ * request with `credentials`. A credential failure fails that request as an
+ * `HttpClientError`, which Effect AI surfaces as a network `AiError`.
+ */
+export declare const make: (credentials: typeof AiGatewayCredentials.Service) => Effect.Effect<AnthropicClient.Service, never, HttpClient.HttpClient>;
+/**
+ * `AnthropicClient` backed by the gateway, authenticating with the
+ * `AiGatewayCredentials` you provide (see that module's `layerFrom*` layers).
+ * Needs an `HttpClient` too.
+ */
+export declare const layerWithoutCredentials: Layer.Layer<AnthropicClient.AnthropicClient, never, AiGatewayCredentials | HttpClient.HttpClient>;
+/**
+ * `layerWithoutCredentials` with the default `AiGatewayCredentials.layer`:
+ * `AI_GATEWAY_API_KEY`, else the Vercel OIDC token. Needs an `HttpClient`.
+ * Building never fails; without a usable credential, the requests fail.
+ */
+export declare const layer: Layer.Layer<AnthropicClient.AnthropicClient, never, HttpClient.HttpClient>;
+/**
+ * The Effect provider writes `"cache_control": null` on every content block
+ * it has no cache setting for. Anthropic accepts that; the gateway rejects
+ * the request with `messages.0.content: Invalid input`. Remove the null keys.
+ */
+export declare function dropNullCacheControl(request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest;
+/**
+ * The gateway's Anthropic-shaped responses leave out keys that Anthropic
+ * always sends and the Effect provider's schema requires: the cache and
+ * service-tier usage fields, the `signature` of a thinking block from a
+ * non-Anthropic model, and `type`/`request_id` on error envelopes, whose
+ * `error.type` may also be a gateway-specific value. Fill them with the values
+ * Anthropic uses when there is nothing to report. Streaming responses are not
+ * JSON and pass through untouched.
+ */
+export declare function fillMissingResponseKeys(response: HttpClientResponse.HttpClientResponse): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>;
+export declare function patchResponseBody(body: Record<string, unknown>): Record<string, unknown>;
+//#endregion
+//# sourceMappingURL=AiGateway.d.ts.map

package/dist/{ai-gateway.js → AiGateway.js}

@@ -1,99 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { n as find, r as hints$1 } from "./VercelOidc-DCkdXW3E.js";
+import { AiGatewayCredentials, formatHeaders, layer as layer$1 } from "./AiGatewayCredentials.js";
 import { AnthropicClient } from "@effect/ai-anthropic";
-import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
+import { Effect, Layer } from "effect";
 import { HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
-//#region src/AiGatewayCredentials.ts
-/**
-* How gateway requests authenticate.
-*
-* `AiGatewayCredentials` holds an effect that produces the credential for one
-* request. It runs per request rather than once at startup: on Vercel the OIDC
-* token arrives on the request context and rotates, so it must not be cached.
-* `layer` is the default; pick a `layerFrom*` layer to use one source only.
-*
-* @example
-* ```ts
-* import { AiGatewayCredentials } from "effect-vercel/ai-gateway"
-*
-* AiGatewayCredentials.layer           // AI_GATEWAY_API_KEY, else the Vercel OIDC token
-* AiGatewayCredentials.layerFromEnv         // AI_GATEWAY_API_KEY only
-* AiGatewayCredentials.layerFromVercelOidc  // the Vercel OIDC token only
-* AiGatewayCredentials.layerFromApiKey("…") // a fixed value
-* ```
-*/
-var AiGatewayCredentials_exports = /* @__PURE__ */ __exportAll({
-	API_KEY_ENV: () => API_KEY_ENV,
-	AiGatewayCredentials: () => AiGatewayCredentials,
-	AiGatewayCredentialsError: () => AiGatewayCredentialsError,
-	formatHeaders: () => formatHeaders,
-	layer: () => layer$1,
-	layerFromApiKey: () => layerFromApiKey,
-	layerFromEnv: () => layerFromEnv,
-	layerFromVercelOidc: () => layerFromVercelOidc
-});
-/** The environment variable `layerFromEnv` reads. */
-const API_KEY_ENV = "AI_GATEWAY_API_KEY";
-/** No credential could be produced for a gateway request. */
-var AiGatewayCredentialsError = class extends Data.TaggedError("AiGatewayCredentialsError") {};
-var AiGatewayCredentials = class extends Context.Service()("effect-vercel/ai-gateway/AiGatewayCredentials") {};
-/** The request headers that carry `credentials`. */
-const formatHeaders = (credentials) => ({
-	"x-api-key": Redacted.value(credentials.token),
-	"ai-gateway-auth-method": credentials.method
-});
-const hints = {
-	"api-key": [],
-	env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],
-	"vercel-oidc": hints$1,
-	default: [`Set ${API_KEY_ENV} to an AI Gateway API key.`, "Or run on Vercel / `vercel env pull` so an OIDC token is available."]
-};
-const apiKeyLookup = Config.option(Config.Redacted(API_KEY_ENV)).pipe(Effect.map(Option.map((token) => ({
-	method: "api-key",
-	token
-}))), Effect.catchTag("ConfigError", (cause) => new AiGatewayCredentialsError({
-	message: `Failed to read ${API_KEY_ENV}.`,
-	source: "env",
-	hints: hints.env,
-	cause
-})));
-const vercelOidcLookup = find.pipe(Effect.map(Option.map((token) => ({
-	method: "oidc",
-	token
-}))), Effect.mapError((cause) => new AiGatewayCredentialsError({
-	message: cause.message,
-	source: "vercel-oidc",
-	hints: cause.hints,
-	cause
-})));
-const firstOf = (lookups) => Effect.gen(function* () {
-	for (const lookup of lookups) {
-		const found = yield* lookup;
-		if (Option.isSome(found)) return found;
-	}
-	return Option.none();
-});
-const toLayer = (lookup, source, message) => Layer.succeed(AiGatewayCredentials)(Effect.flatMap(lookup, (found) => Option.isSome(found) ? Effect.succeed(found.value) : Effect.fail(new AiGatewayCredentialsError({
-	message,
-	source,
-	hints: hints[source]
-}))));
-/** A fixed API key. */
-const layerFromApiKey = (apiKey) => Layer.succeed(AiGatewayCredentials)(Effect.succeed({
-	method: "api-key",
-	token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey)
-}));
-/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
-const layerFromEnv = toLayer(apiKeyLookup, "env", `${API_KEY_ENV} is not set.`);
-/** The Vercel OIDC token (see `VercelOidc.find`). Not refreshed when it expires locally. */
-const layerFromVercelOidc = toLayer(vercelOidcLookup, "vercel-oidc", "No Vercel OIDC token is available.");
-/**
-* The default: `layerFromEnv`, then `layerFromVercelOidc`. Same order as
-* Vercel's own SDK, so it works locally with an API key and on Vercel without
-* one.
-*/
-const layer$1 = toLayer(firstOf([apiKeyLookup, vercelOidcLookup]), "default", "No AI Gateway credential found.");
-//#endregion
 //#region src/AiGateway.ts
 /**
 * Vercel AI Gateway as an Anthropic Messages API client for Effect AI.
@@ -112,7 +20,7 @@ const layer$1 = toLayer(firstOf([apiKeyLookup, vercelOidcLookup]), "default", "N
 *
 * @example
 * ```ts
-* import { AiGateway } from "effect-vercel/ai-gateway"
+* import * as AiGateway from "effect-vercel/AiGateway"
 * import { AnthropicLanguageModel } from "@effect/ai-anthropic"
 * import { Layer } from "effect"
 * import { FetchHttpClient } from "effect/http"
@@ -123,15 +31,6 @@ const layer$1 = toLayer(firstOf([apiKeyLookup, vercelOidcLookup]), "default", "N
 * )
 * ```
 */
-var AiGateway_exports = /* @__PURE__ */ __exportAll({
-	AI_GATEWAY_URL: () => AI_GATEWAY_URL,
-	dropNullCacheControl: () => dropNullCacheControl,
-	fillMissingResponseKeys: () => fillMissingResponseKeys,
-	layer: () => layer,
-	layerWithoutCredentials: () => layerWithoutCredentials,
-	make: () => make,
-	patchResponseBody: () => patchResponseBody
-});
 /** Base URL of the Vercel AI Gateway. */
 const AI_GATEWAY_URL = "https://ai-gateway.vercel.sh";
 /**
@@ -250,6 +149,6 @@ function isJson(contentType) {
 	return contentType.startsWith("application/json");
 }
 //#endregion
-export { AiGateway_exports as AiGateway, AiGatewayCredentials_exports as AiGatewayCredentials };
+export { AI_GATEWAY_URL, dropNullCacheControl, fillMissingResponseKeys, layer, layerWithoutCredentials, make, patchResponseBody };
 
-//# sourceMappingURL=ai-gateway.js.map
+//# sourceMappingURL=AiGateway.js.map

package/dist/AiGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiGateway.js","names":["AiGatewayCredentials.AiGatewayCredentials","AiGatewayCredentials.layer","AiGatewayCredentials.formatHeaders"],"sources":["../src/AiGateway.ts"],"sourcesContent":["/**\n * Vercel AI Gateway as an Anthropic Messages API client for Effect AI.\n *\n * The gateway serves the Anthropic Messages API at its root URL and accepts\n * any model it lists, named `provider/model` (for example\n * `anthropic/claude-sonnet-4.5` or `google/gemini-2.5-flash`). Effect AI's\n * Anthropic provider only needs the base URL and the credential swapped, plus\n * two small dialect fixes (see `dropNullCacheControl` and\n * `fillMissingResponseKeys`), so this module is the one place the gateway is\n * configured.\n *\n * Structured output (`output_config.format`) works for every provider behind\n * the gateway, so the Anthropic provider's default of native structured\n * output holds for models it does not recognise.\n *\n * @example\n * ```ts\n * import * as AiGateway from \"effect-vercel/AiGateway\"\n * import { AnthropicLanguageModel } from \"@effect/ai-anthropic\"\n * import { Layer } from \"effect\"\n * import { FetchHttpClient } from \"effect/http\"\n *\n * const Model = AnthropicLanguageModel.layer({ model: \"anthropic/claude-sonnet-4.5\" }).pipe(\n *   Layer.provide(AiGateway.layer),\n *   Layer.provide(FetchHttpClient.layer),\n * )\n * ```\n */\n\nimport { AnthropicClient } from \"@effect/ai-anthropic\"\nimport { Effect, Layer } from \"effect\"\nimport {\n  HttpBody,\n  HttpClient,\n  HttpClientError,\n  HttpClientRequest,\n  HttpClientResponse,\n} from \"effect/http\"\nimport * as AiGatewayCredentials from \"./AiGatewayCredentials.js\"\n\n/** Base URL of the Vercel AI Gateway. */\nexport const AI_GATEWAY_URL = \"https://ai-gateway.vercel.sh\"\n\n/**\n * Builds the Anthropic client against the gateway, authenticating each\n * request with `credentials`. A credential failure fails that request as an\n * `HttpClientError`, which Effect AI surfaces as a network `AiError`.\n */\nexport const make = (credentials: typeof AiGatewayCredentials.AiGatewayCredentials.Service) =>\n  AnthropicClient.make({\n    apiUrl: AI_GATEWAY_URL,\n    transformClient: (client) =>\n      client.pipe(\n        HttpClient.mapRequestEffect(authenticate(credentials)),\n        HttpClient.mapRequest(dropNullCacheControl),\n        HttpClient.transformResponse(Effect.flatMap(fillMissingResponseKeys)),\n      ),\n  })\n\n/**\n * `AnthropicClient` backed by the gateway, authenticating with the\n * `AiGatewayCredentials` you provide (see that module's `layerFrom*` layers).\n * Needs an `HttpClient` too.\n */\nexport const layerWithoutCredentials: Layer.Layer<\n  AnthropicClient.AnthropicClient,\n  never,\n  AiGatewayCredentials.AiGatewayCredentials | HttpClient.HttpClient\n> = Layer.effect(AnthropicClient.AnthropicClient)(\n  Effect.flatMap(Effect.service(AiGatewayCredentials.AiGatewayCredentials), make),\n)\n\n/**\n * `layerWithoutCredentials` with the default `AiGatewayCredentials.layer`:\n * `AI_GATEWAY_API_KEY`, else the Vercel OIDC token. Needs an `HttpClient`.\n * Building never fails; without a usable credential, the requests fail.\n */\nexport const layer: Layer.Layer<AnthropicClient.AnthropicClient, never, HttpClient.HttpClient> =\n  layerWithoutCredentials.pipe(Layer.provide(AiGatewayCredentials.layer))\n\nfunction authenticate(credentials: typeof AiGatewayCredentials.AiGatewayCredentials.Service) {\n  return (request: HttpClientRequest.HttpClientRequest) =>\n    credentials.pipe(\n      Effect.map((resolved) =>\n        HttpClientRequest.setHeaders(request, AiGatewayCredentials.formatHeaders(resolved)),\n      ),\n      Effect.mapError(\n        (error) =>\n          new HttpClientError.HttpClientError({\n            reason: new HttpClientError.TransportError({\n              request,\n              cause: error,\n              description: \"AI Gateway credential unavailable\",\n            }),\n          }),\n      ),\n    )\n}\n\n/**\n * The Effect provider writes `\"cache_control\": null` on every content block\n * it has no cache setting for. Anthropic accepts that; the gateway rejects\n * the request with `messages.0.content: Invalid input`. Remove the null keys.\n */\nexport function dropNullCacheControl(\n  request: HttpClientRequest.HttpClientRequest,\n): HttpClientRequest.HttpClientRequest {\n  const body = request.body\n  if (body._tag !== \"Uint8Array\" || !isJson(body.contentType)) {\n    return request\n  }\n  const json: unknown = JSON.parse(new TextDecoder().decode(body.body))\n  return HttpClientRequest.setBody(\n    request,\n    HttpBody.jsonUnsafe(withoutNullCacheControl(json), body.contentType),\n  )\n}\n\nfunction withoutNullCacheControl(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(withoutNullCacheControl)\n  if (value === null || typeof value !== \"object\") return value\n  const result: Record<string, unknown> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    if (key === \"cache_control\" && entry === null) continue\n    result[key] = withoutNullCacheControl(entry)\n  }\n  return result\n}\n\n/**\n * The gateway's Anthropic-shaped responses leave out keys that Anthropic\n * always sends and the Effect provider's schema requires: the cache and\n * service-tier usage fields, the `signature` of a thinking block from a\n * non-Anthropic model, and `type`/`request_id` on error envelopes, whose\n * `error.type` may also be a gateway-specific value. Fill them with the values\n * Anthropic uses when there is nothing to report. Streaming responses are not\n * JSON and pass through untouched.\n */\nexport function fillMissingResponseKeys(\n  response: HttpClientResponse.HttpClientResponse,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError> {\n  if (!isJson(response.headers[\"content-type\"] ?? \"\")) {\n    return Effect.succeed(response)\n  }\n  return Effect.map(response.text, (text) => {\n    const body = JSON.parse(text) as Record<string, unknown>\n    return HttpClientResponse.fromWeb(\n      response.request,\n      new Response(JSON.stringify(patchResponseBody(body)), {\n        status: response.status,\n        headers: response.headers,\n      }),\n    )\n  })\n}\n\nexport function patchResponseBody(body: Record<string, unknown>): Record<string, unknown> {\n  if (body.type === \"message\") {\n    const usage = (body.usage ?? {}) as Record<string, unknown>\n    body.usage = {\n      cache_creation: null,\n      cache_creation_input_tokens: null,\n      cache_read_input_tokens: null,\n      inference_geo: null,\n      service_tier: null,\n      ...usage,\n    }\n    if (Array.isArray(body.content)) {\n      body.content = body.content.map((block: unknown) =>\n        isRecord(block) && block.type === \"thinking\" ? { signature: \"\", ...block } : block,\n      )\n    }\n    return body\n  }\n  if (isRecord(body.error)) {\n    const error = ANTHROPIC_ERROR_TYPES.has(String(body.error.type))\n      ? body.error\n      : { ...body.error, type: \"api_error\" }\n    return { type: \"error\", request_id: null, ...body, error }\n  }\n  return body\n}\n\nconst ANTHROPIC_ERROR_TYPES = new Set([\n  \"invalid_request_error\",\n  \"authentication_error\",\n  \"billing_error\",\n  \"permission_error\",\n  \"not_found_error\",\n  \"rate_limit_error\",\n  \"timeout_error\",\n  \"api_error\",\n  \"overloaded_error\",\n])\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction isJson(contentType: string): boolean {\n  return contentType.startsWith(\"application/json\")\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAa,iBAAiB;;;;;;AAO9B,MAAa,QAAQ,gBACnB,gBAAgB,KAAK;CACnB,QAAQ;CACR,kBAAkB,WAChB,OAAO,KACL,WAAW,iBAAiB,aAAa,WAAW,CAAC,GACrD,WAAW,WAAW,oBAAoB,GAC1C,WAAW,kBAAkB,OAAO,QAAQ,uBAAuB,CAAC,CACtE;AACJ,CAAC;;;;;;AAOH,MAAa,0BAIT,MAAM,OAAO,gBAAgB,eAAe,CAAC,CAC/C,OAAO,QAAQ,OAAO,QAAQA,oBAAyC,GAAG,IAAI,CAChF;;;;;;AAOA,MAAa,QACX,wBAAwB,KAAK,MAAM,QAAQC,OAA0B,CAAC;AAExE,SAAS,aAAa,aAAuE;CAC3F,QAAQ,YACN,YAAY,KACV,OAAO,KAAK,aACV,kBAAkB,WAAW,SAASC,cAAmC,QAAQ,CAAC,CACpF,GACA,OAAO,UACJ,UACC,IAAI,gBAAgB,gBAAgB,EAClC,QAAQ,IAAI,gBAAgB,eAAe;EACzC;EACA,OAAO;EACP,aAAa;CACf,CAAC,EACH,CAAC,CACL,CACF;AACJ;;;;;;AAOA,SAAgB,qBACd,SACqC;CACrC,MAAM,OAAO,QAAQ;CACrB,IAAI,KAAK,SAAS,gBAAgB,CAAC,OAAO,KAAK,WAAW,GACxD,OAAO;CAET,MAAM,OAAgB,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;CACpE,OAAO,kBAAkB,QACvB,SACA,SAAS,WAAW,wBAAwB,IAAI,GAAG,KAAK,WAAW,CACrE;AACF;AAEA,SAAS,wBAAwB,OAAyB;CACxD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,uBAAuB;CAClE,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,QAAQ,mBAAmB,UAAU,MAAM;EAC/C,OAAO,OAAO,wBAAwB,KAAK;CAC7C;CACA,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,wBACd,UACuF;CACvF,IAAI,CAAC,OAAO,SAAS,QAAQ,mBAAmB,EAAE,GAChD,OAAO,OAAO,QAAQ,QAAQ;CAEhC,OAAO,OAAO,IAAI,SAAS,OAAO,SAAS;EACzC,MAAM,OAAO,KAAK,MAAM,IAAI;EAC5B,OAAO,mBAAmB,QACxB,SAAS,SACT,IAAI,SAAS,KAAK,UAAU,kBAAkB,IAAI,CAAC,GAAG;GACpD,QAAQ,SAAS;GACjB,SAAS,SAAS;EACpB,CAAC,CACH;CACF,CAAC;AACH;AAEA,SAAgB,kBAAkB,MAAwD;CACxF,IAAI,KAAK,SAAS,WAAW;EAE3B,KAAK,QAAQ;GACX,gBAAgB;GAChB,6BAA6B;GAC7B,yBAAyB;GACzB,eAAe;GACf,cAAc;GACd,GAPa,KAAK,SAAS,CAAC;EAQ9B;EACA,IAAI,MAAM,QAAQ,KAAK,OAAO,GAC5B,KAAK,UAAU,KAAK,QAAQ,KAAK,UAC/B,SAAS,KAAK,KAAK,MAAM,SAAS,aAAa;GAAE,WAAW;GAAI,GAAG;EAAM,IAAI,KAC/E;EAEF,OAAO;CACT;CACA,IAAI,SAAS,KAAK,KAAK,GAAG;EACxB,MAAM,QAAQ,sBAAsB,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,IAC3D,KAAK,QACL;GAAE,GAAG,KAAK;GAAO,MAAM;EAAY;EACvC,OAAO;GAAE,MAAM;GAAS,YAAY;GAAM,GAAG;GAAM;EAAM;CAC3D;CACA,OAAO;AACT;AAEA,MAAM,wCAAwB,IAAI,IAAI;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OAAO,aAA8B;CAC5C,OAAO,YAAY,WAAW,kBAAkB;AAClD"}

package/dist/AiGatewayCredentials.d.ts

@@ -0,0 +1,45 @@
+import { Context, Effect, Layer, Redacted } from "effect";
+declare namespace AiGatewayCredentials_d_exports {
+  export { API_KEY_ENV, AiGatewayCredentials, AiGatewayCredentialsError, Resolved, Source, formatHeaders, layer, layerFromApiKey, layerFromEnv, layerFromOidc };
+}
+/** The environment variable `layerFromEnv` reads. */
+export declare const API_KEY_ENV = "AI_GATEWAY_API_KEY";
+/** Which layer produced or failed to produce a credential. */
+export type Source = "api-key" | "env" | "oidc" | "default";
+/**
+ * A credential ready to put on a request. `method` is what the gateway
+ * records as the auth method; it matches the values Vercel's own SDK sends.
+ */
+export interface Resolved {
+  readonly method: "api-key" | "oidc";
+  readonly token: Redacted.Redacted<string>;
+}
+declare const AiGatewayCredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AiGatewayCredentialsError";
+} & Readonly<A>;
+/** No credential could be produced for a gateway request. */
+export declare class AiGatewayCredentialsError extends AiGatewayCredentialsError_base<{
+  readonly message: string;
+  readonly source: Source;
+  readonly hints: ReadonlyArray<string>;
+  readonly cause?: unknown;
+}> {}
+declare const AiGatewayCredentials_base: Context.ServiceClass<AiGatewayCredentials, "effect-vercel/AiGatewayCredentials", Effect.Effect<Resolved, AiGatewayCredentialsError, never>>;
+export declare class AiGatewayCredentials extends AiGatewayCredentials_base {}
+/** The request headers that carry `credentials`. */
+export declare const formatHeaders: (credentials: Resolved) => Record<string, string>;
+/** A fixed API key. */
+export declare const layerFromApiKey: (apiKey: string | Redacted.Redacted<string>) => Layer.Layer<AiGatewayCredentials>;
+/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
+export declare const layerFromEnv: Layer.Layer<AiGatewayCredentials>;
+/** The Vercel OIDC token (see `Oidc.ambientToken`). */
+export declare const layerFromOidc: Layer.Layer<AiGatewayCredentials>;
+/**
+ * The default: `layerFromEnv`, then `layerFromOidc`. Same order as
+ * Vercel's own SDK, so it works locally with an API key and on Vercel without
+ * one. Falls back only when the key is unset, not when it can't be read.
+ */
+export declare const layer: Layer.Layer<AiGatewayCredentials>;
+//#endregion
+export { AiGatewayCredentials_d_exports as t };
+//# sourceMappingURL=AiGatewayCredentials.d.ts.map

package/dist/AiGatewayCredentials.js

@@ -0,0 +1,94 @@
+import { ambientToken, hints as hints$1 } from "./Oidc.js";
+import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect";
+//#region src/AiGatewayCredentials.ts
+/**
+* How gateway requests authenticate.
+*
+* `AiGatewayCredentials` holds an effect that produces the credential for one
+* request. It runs per request rather than once at startup: on Vercel the OIDC
+* token arrives on the request context and rotates, so it must not be cached.
+* `layer` is the default; pick a `layerFrom*` layer to use one source only.
+*
+* @example
+* ```ts
+* import * as AiGatewayCredentials from "effect-vercel/AiGatewayCredentials"
+*
+* AiGatewayCredentials.layer                // AI_GATEWAY_API_KEY, else the Vercel OIDC token
+* AiGatewayCredentials.layerFromEnv         // AI_GATEWAY_API_KEY only
+* AiGatewayCredentials.layerFromOidc        // the Vercel OIDC token only
+* AiGatewayCredentials.layerFromApiKey("…") // a fixed value
+* ```
+*/
+/** The environment variable `layerFromEnv` reads. */
+const API_KEY_ENV = "AI_GATEWAY_API_KEY";
+/** No credential could be produced for a gateway request. */
+var AiGatewayCredentialsError = class extends Data.TaggedError("AiGatewayCredentialsError") {};
+var AiGatewayCredentials = class extends Context.Service()("effect-vercel/AiGatewayCredentials") {};
+/** The request headers that carry `credentials`. */
+const formatHeaders = (credentials) => ({
+	"x-api-key": Redacted.value(credentials.token),
+	"ai-gateway-auth-method": credentials.method
+});
+const hints = {
+	"api-key": [],
+	env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],
+	oidc: hints$1,
+	default: [`Set ${API_KEY_ENV} to an AI Gateway API key.`, "Or run on Vercel / `vercel env pull` so an OIDC token is available."]
+};
+/** `AI_GATEWAY_API_KEY`, or `None` when unset. Fails only when it can't be read. */
+const envApiKey = Config.option(Config.Redacted(API_KEY_ENV)).pipe(Effect.mapError((cause) => new AiGatewayCredentialsError({
+	message: `Failed to read ${API_KEY_ENV}.`,
+	source: "env",
+	hints: hints.env,
+	cause
+})));
+const fromEnv = Effect.flatMap(envApiKey, Option.match({
+	onNone: () => Effect.fail(new AiGatewayCredentialsError({
+		message: `${API_KEY_ENV} is not set.`,
+		source: "env",
+		hints: hints.env
+	})),
+	onSome: (token) => Effect.succeed({
+		method: "api-key",
+		token
+	})
+}));
+const fromOidc = ambientToken.pipe(Effect.map((token) => ({
+	method: "oidc",
+	token
+})), Effect.mapError((cause) => new AiGatewayCredentialsError({
+	message: cause.message,
+	source: "oidc",
+	hints: cause.hints,
+	cause
+})));
+/** A fixed API key. */
+const layerFromApiKey = (apiKey) => Layer.succeed(AiGatewayCredentials)(Effect.succeed({
+	method: "api-key",
+	token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey)
+}));
+/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
+const layerFromEnv = Layer.succeed(AiGatewayCredentials)(fromEnv);
+/** The Vercel OIDC token (see `Oidc.ambientToken`). */
+const layerFromOidc = Layer.succeed(AiGatewayCredentials)(fromOidc);
+/**
+* The default: `layerFromEnv`, then `layerFromOidc`. Same order as
+* Vercel's own SDK, so it works locally with an API key and on Vercel without
+* one. Falls back only when the key is unset, not when it can't be read.
+*/
+const layer = Layer.succeed(AiGatewayCredentials)(Effect.flatMap(envApiKey, Option.match({
+	onNone: () => Effect.mapError(fromOidc, (cause) => new AiGatewayCredentialsError({
+		message: "No AI Gateway credential found.",
+		source: "default",
+		hints: hints.default,
+		cause
+	})),
+	onSome: (token) => Effect.succeed({
+		method: "api-key",
+		token
+	})
+})));
+//#endregion
+export { API_KEY_ENV, AiGatewayCredentials, AiGatewayCredentialsError, formatHeaders, layer, layerFromApiKey, layerFromEnv, layerFromOidc };
+
+//# sourceMappingURL=AiGatewayCredentials.js.map

package/dist/AiGatewayCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiGatewayCredentials.js","names":["Oidc.hints"],"sources":["../src/AiGatewayCredentials.ts"],"sourcesContent":["/**\n * How gateway requests authenticate.\n *\n * `AiGatewayCredentials` holds an effect that produces the credential for one\n * request. It runs per request rather than once at startup: on Vercel the OIDC\n * token arrives on the request context and rotates, so it must not be cached.\n * `layer` is the default; pick a `layerFrom*` layer to use one source only.\n *\n * @example\n * ```ts\n * import * as AiGatewayCredentials from \"effect-vercel/AiGatewayCredentials\"\n *\n * AiGatewayCredentials.layer                // AI_GATEWAY_API_KEY, else the Vercel OIDC token\n * AiGatewayCredentials.layerFromEnv         // AI_GATEWAY_API_KEY only\n * AiGatewayCredentials.layerFromOidc        // the Vercel OIDC token only\n * AiGatewayCredentials.layerFromApiKey(\"…\") // a fixed value\n * ```\n */\n\nimport { Config, Context, Data, Effect, Layer, Option, Redacted } from \"effect\"\nimport * as Oidc from \"./Oidc.js\"\n\n/** The environment variable `layerFromEnv` reads. */\nexport const API_KEY_ENV = \"AI_GATEWAY_API_KEY\"\n\n/** Which layer produced or failed to produce a credential. */\nexport type Source = \"api-key\" | \"env\" | \"oidc\" | \"default\"\n\n/**\n * A credential ready to put on a request. `method` is what the gateway\n * records as the auth method; it matches the values Vercel's own SDK sends.\n */\nexport interface Resolved {\n  readonly method: \"api-key\" | \"oidc\"\n  readonly token: Redacted.Redacted<string>\n}\n\n/** No credential could be produced for a gateway request. */\nexport class AiGatewayCredentialsError extends Data.TaggedError(\"AiGatewayCredentialsError\")<{\n  readonly message: string\n  readonly source: Source\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\nexport class AiGatewayCredentials extends Context.Service<\n  AiGatewayCredentials,\n  Effect.Effect<Resolved, AiGatewayCredentialsError>\n>()(\"effect-vercel/AiGatewayCredentials\") {}\n\n/** The request headers that carry `credentials`. */\nexport const formatHeaders = (credentials: Resolved): Record<string, string> => ({\n  \"x-api-key\": Redacted.value(credentials.token),\n  \"ai-gateway-auth-method\": credentials.method,\n})\n\nconst hints: Record<Source, ReadonlyArray<string>> = {\n  \"api-key\": [],\n  env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],\n  oidc: Oidc.hints,\n  default: [\n    `Set ${API_KEY_ENV} to an AI Gateway API key.`,\n    \"Or run on Vercel / `vercel env pull` so an OIDC token is available.\",\n  ],\n}\n\n/** `AI_GATEWAY_API_KEY`, or `None` when unset. Fails only when it can't be read. */\nconst envApiKey = Config.option(Config.Redacted(API_KEY_ENV)).pipe(\n  Effect.mapError(\n    (cause) =>\n      new AiGatewayCredentialsError({\n        message: `Failed to read ${API_KEY_ENV}.`,\n        source: \"env\",\n        hints: hints.env,\n        cause,\n      }),\n  ),\n)\n\nconst fromEnv: Effect.Effect<Resolved, AiGatewayCredentialsError> = Effect.flatMap(\n  envApiKey,\n  Option.match({\n    onNone: () =>\n      Effect.fail(\n        new AiGatewayCredentialsError({\n          message: `${API_KEY_ENV} is not set.`,\n          source: \"env\",\n          hints: hints.env,\n        }),\n      ),\n    onSome: (token) => Effect.succeed({ method: \"api-key\" as const, token }),\n  }),\n)\n\nconst fromOidc: Effect.Effect<Resolved, AiGatewayCredentialsError> = Oidc.ambientToken.pipe(\n  Effect.map((token) => ({ method: \"oidc\" as const, token })),\n  Effect.mapError(\n    (cause) =>\n      new AiGatewayCredentialsError({\n        message: cause.message,\n        source: \"oidc\",\n        hints: cause.hints,\n        cause,\n      }),\n  ),\n)\n\n/** A fixed API key. */\nexport const layerFromApiKey = (\n  apiKey: string | Redacted.Redacted<string>,\n): Layer.Layer<AiGatewayCredentials> =>\n  Layer.succeed(AiGatewayCredentials)(\n    Effect.succeed({\n      method: \"api-key\",\n      token: Redacted.isRedacted(apiKey) ? apiKey : Redacted.make(apiKey),\n    }),\n  )\n\n/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */\nexport const layerFromEnv: Layer.Layer<AiGatewayCredentials> =\n  Layer.succeed(AiGatewayCredentials)(fromEnv)\n\n/** The Vercel OIDC token (see `Oidc.ambientToken`). */\nexport const layerFromOidc: Layer.Layer<AiGatewayCredentials> =\n  Layer.succeed(AiGatewayCredentials)(fromOidc)\n\n/**\n * The default: `layerFromEnv`, then `layerFromOidc`. Same order as\n * Vercel's own SDK, so it works locally with an API key and on Vercel without\n * one. Falls back only when the key is unset, not when it can't be read.\n */\nexport const layer: Layer.Layer<AiGatewayCredentials> = Layer.succeed(AiGatewayCredentials)(\n  Effect.flatMap(\n    envApiKey,\n    Option.match({\n      onNone: () =>\n        Effect.mapError(\n          fromOidc,\n          (cause) =>\n            new AiGatewayCredentialsError({\n              message: \"No AI Gateway credential found.\",\n              source: \"default\",\n              hints: hints.default,\n              cause,\n            }),\n        ),\n      onSome: (token) => Effect.succeed({ method: \"api-key\" as const, token }),\n    }),\n  ),\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,cAAc;;AAe3B,IAAa,4BAAb,cAA+C,KAAK,YAAY,2BAA2B,CAAC,CAKzF,CAAC;AAEJ,IAAa,uBAAb,cAA0C,QAAQ,QAGhD,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;;AAG3C,MAAa,iBAAiB,iBAAmD;CAC/E,aAAa,SAAS,MAAM,YAAY,KAAK;CAC7C,0BAA0B,YAAY;AACxC;AAEA,MAAM,QAA+C;CACnD,WAAW,CAAC;CACZ,KAAK,CAAC,OAAO,YAAY,2BAA2B;CACpD,MAAMA;CACN,SAAS,CACP,OAAO,YAAY,6BACnB,qEACF;AACF;;AAGA,MAAM,YAAY,OAAO,OAAO,OAAO,SAAS,WAAW,CAAC,CAAC,CAAC,KAC5D,OAAO,UACJ,UACC,IAAI,0BAA0B;CAC5B,SAAS,kBAAkB,YAAY;CACvC,QAAQ;CACR,OAAO,MAAM;CACb;AACF,CAAC,CACL,CACF;AAEA,MAAM,UAA8D,OAAO,QACzE,WACA,OAAO,MAAM;CACX,cACE,OAAO,KACL,IAAI,0BAA0B;EAC5B,SAAS,GAAG,YAAY;EACxB,QAAQ;EACR,OAAO,MAAM;CACf,CAAC,CACH;CACF,SAAS,UAAU,OAAO,QAAQ;EAAE,QAAQ;EAAoB;CAAM,CAAC;AACzE,CAAC,CACH;AAEA,MAAM,WAAA,aAAiF,KACrF,OAAO,KAAK,WAAW;CAAE,QAAQ;CAAiB;AAAM,EAAE,GAC1D,OAAO,UACJ,UACC,IAAI,0BAA0B;CAC5B,SAAS,MAAM;CACf,QAAQ;CACR,OAAO,MAAM;CACb;AACF,CAAC,CACL,CACF;;AAGA,MAAa,mBACX,WAEA,MAAM,QAAQ,oBAAoB,CAAC,CACjC,OAAO,QAAQ;CACb,QAAQ;CACR,OAAO,SAAS,WAAW,MAAM,IAAI,SAAS,SAAS,KAAK,MAAM;AACpE,CAAC,CACH;;AAGF,MAAa,eACX,MAAM,QAAQ,oBAAoB,CAAC,CAAC,OAAO;;AAG7C,MAAa,gBACX,MAAM,QAAQ,oBAAoB,CAAC,CAAC,QAAQ;;;;;;AAO9C,MAAa,QAA2C,MAAM,QAAQ,oBAAoB,CAAC,CACzF,OAAO,QACL,WACA,OAAO,MAAM;CACX,cACE,OAAO,SACL,WACC,UACC,IAAI,0BAA0B;EAC5B,SAAS;EACT,QAAQ;EACR,OAAO,MAAM;EACb;CACF,CAAC,CACL;CACF,SAAS,UAAU,OAAO,QAAQ;EAAE,QAAQ;EAAoB;CAAM,CAAC;AACzE,CAAC,CACH,CACF"}

package/dist/Oidc.d.ts

@@ -0,0 +1,23 @@
+import { Effect, Redacted } from "effect";
+//#region src/Oidc.d.ts
+/** The environment variable read when no request carries a token. */
+export declare const TOKEN_ENV = "VERCEL_OIDC_TOKEN";
+declare const OidcError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "VercelOidcError";
+} & Readonly<A>;
+/** No usable OIDC token. */
+export declare class OidcError extends OidcError_base<{
+  readonly message: string;
+  readonly hints: ReadonlyArray<string>;
+  readonly cause?: unknown;
+}> {}
+/** How to make a token available. */
+export declare const hints: ReadonlyArray<string>;
+/**
+ * The ambient token: the request header, else `VERCEL_OIDC_TOKEN`. Empty
+ * values count as unset. Fails when neither is set. Does not refresh an
+ * expired local token; re-run `vercel env pull`.
+ */
+export declare const ambientToken: Effect.Effect<Redacted.Redacted<string>, OidcError>;
+//#endregion
+//# sourceMappingURL=Oidc.d.ts.map

package/dist/Oidc.js

@@ -0,0 +1,59 @@
+import { Config, Data, Effect, Redacted } from "effect";
+//#region src/Oidc.ts
+/**
+* The OIDC token Vercel issues to a deployment.
+*
+* `ambientToken` reads the token the platform provides. In Functions it
+* arrives on each request as the `x-vercel-oidc-token` header and rotates, so
+* it is read on every run, never cached. In builds and after `vercel env pull`
+* it is `VERCEL_OIDC_TOKEN`. Use it to authenticate to the AI Gateway, or
+* exchange it for cloud credentials (AWS `AssumeRoleWithWebIdentity`, GCP
+* workload identity federation).
+*
+* @example
+* ```ts
+* import * as Oidc from "effect-vercel/Oidc"
+* import { Effect, Redacted } from "effect"
+*
+* const program = Effect.gen(function* () {
+*   const token = yield* Oidc.ambientToken
+*   // pass Redacted.value(token) as the web identity token
+* })
+* ```
+*/
+/** The environment variable read when no request carries a token. */
+const TOKEN_ENV = "VERCEL_OIDC_TOKEN";
+/** No usable OIDC token. */
+var OidcError = class extends Data.TaggedError("VercelOidcError") {};
+/** How to make a token available. */
+const hints = ["Run on Vercel, where each request carries an OIDC token.", `Or run \`vercel env pull\` locally to populate ${TOKEN_ENV}.`];
+/**
+* Vercel exposes the current request's context on a well-known global symbol.
+* In Functions, the request's headers live there. `@vercel/oidc` reads the
+* same place.
+*/
+const REQUEST_CONTEXT = Symbol.for("@vercel/request-context");
+/** The `x-vercel-oidc-token` header of the current request, if set. */
+const requestToken = () => {
+	const token = globalThis[REQUEST_CONTEXT]?.get?.()?.headers?.["x-vercel-oidc-token"];
+	return token === "" ? void 0 : token;
+};
+const envToken = Config.NonEmptyString(TOKEN_ENV).pipe(Config.map(Redacted.make));
+/**
+* The ambient token: the request header, else `VERCEL_OIDC_TOKEN`. Empty
+* values count as unset. Fails when neither is set. Does not refresh an
+* expired local token; re-run `vercel env pull`.
+*/
+const ambientToken = Effect.suspend(() => {
+	const token = requestToken();
+	if (token !== void 0) return Effect.succeed(Redacted.make(token));
+	return Effect.mapError(envToken, (cause) => new OidcError({
+		message: "No Vercel OIDC token is available.",
+		hints,
+		cause
+	}));
+});
+//#endregion
+export { OidcError, TOKEN_ENV, ambientToken, hints };
+
+//# sourceMappingURL=Oidc.js.map

package/dist/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","names":["holder"],"sources":["../src/Oidc.ts"],"sourcesContent":["/**\n * The OIDC token Vercel issues to a deployment.\n *\n * `ambientToken` reads the token the platform provides. In Functions it\n * arrives on each request as the `x-vercel-oidc-token` header and rotates, so\n * it is read on every run, never cached. In builds and after `vercel env pull`\n * it is `VERCEL_OIDC_TOKEN`. Use it to authenticate to the AI Gateway, or\n * exchange it for cloud credentials (AWS `AssumeRoleWithWebIdentity`, GCP\n * workload identity federation).\n *\n * @example\n * ```ts\n * import * as Oidc from \"effect-vercel/Oidc\"\n * import { Effect, Redacted } from \"effect\"\n *\n * const program = Effect.gen(function* () {\n *   const token = yield* Oidc.ambientToken\n *   // pass Redacted.value(token) as the web identity token\n * })\n * ```\n */\n\nimport { Config, Data, Effect, Redacted } from \"effect\"\n\n/** The environment variable read when no request carries a token. */\nexport const TOKEN_ENV = \"VERCEL_OIDC_TOKEN\"\n\n/** No usable OIDC token. */\nexport class OidcError extends Data.TaggedError(\"VercelOidcError\")<{\n  readonly message: string\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\n/** How to make a token available. */\nexport const hints: ReadonlyArray<string> = [\n  \"Run on Vercel, where each request carries an OIDC token.\",\n  `Or run \\`vercel env pull\\` locally to populate ${TOKEN_ENV}.`,\n]\n\n/**\n * Vercel exposes the current request's context on a well-known global symbol.\n * In Functions, the request's headers live there. `@vercel/oidc` reads the\n * same place.\n */\nconst REQUEST_CONTEXT = Symbol.for(\"@vercel/request-context\")\n\ntype RequestContext = { readonly headers?: Record<string, string | undefined> }\n\n/** The `x-vercel-oidc-token` header of the current request, if set. */\nconst requestToken = (): string | undefined => {\n  const holder = globalThis as typeof globalThis & {\n    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }\n  }\n  const token = holder[REQUEST_CONTEXT]?.get?.()?.headers?.[\"x-vercel-oidc-token\"]\n  return token === \"\" ? undefined : token\n}\n\nconst envToken = Config.NonEmptyString(TOKEN_ENV).pipe(Config.map(Redacted.make))\n\n/**\n * The ambient token: the request header, else `VERCEL_OIDC_TOKEN`. Empty\n * values count as unset. Fails when neither is set. Does not refresh an\n * expired local token; re-run `vercel env pull`.\n */\nexport const ambientToken: Effect.Effect<Redacted.Redacted<string>, OidcError> = Effect.suspend(\n  () => {\n    const token = requestToken()\n    if (token !== undefined) return Effect.succeed(Redacted.make(token))\n    return Effect.mapError(\n      envToken,\n      (cause) => new OidcError({ message: \"No Vercel OIDC token is available.\", hints, cause }),\n    )\n  },\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY;;AAGzB,IAAa,YAAb,cAA+B,KAAK,YAAY,iBAAiB,CAAC,CAI/D,CAAC;;AAGJ,MAAa,QAA+B,CAC1C,4DACA,kDAAkD,UAAU,EAC9D;;;;;;AAOA,MAAM,kBAAkB,OAAO,IAAI,yBAAyB;;AAK5D,MAAM,qBAAyC;CAI7C,MAAM,QAAQA,WAAO,gBAAgB,EAAE,MAAM,CAAC,EAAE,UAAU;CAC1D,OAAO,UAAU,KAAK,KAAA,IAAY;AACpC;AAEA,MAAM,WAAW,OAAO,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,IAAI,CAAC;;;;;;AAOhF,MAAa,eAAoE,OAAO,cAChF;CACJ,MAAM,QAAQ,aAAa;CAC3B,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,QAAQ,SAAS,KAAK,KAAK,CAAC;CACnE,OAAO,OAAO,SACZ,WACC,UAAU,IAAI,UAAU;EAAE,SAAS;EAAsC;EAAO;CAAM,CAAC,CAC1F;AACF,CACF"}

package/dist/{runtime-cache.d.ts → RuntimeCache.d.ts}

@@ -1,9 +1,7 @@
 import { Layer } from "effect";
 import { RuntimeCache } from "@vercel/functions";
 import { Persistence } from "effect/persistence";
-declare namespace VercelRuntimeCache_d_exports {
-  export { layer, layerBacking, makeBacking };
-}
+//#region src/RuntimeCache.d.ts
 /**
  * A `BackingPersistence` over `cache`.
  *
@@ -17,11 +15,10 @@ declare namespace VercelRuntimeCache_d_exports {
  * `getCache()` hashes keys with a 32-bit hash by default, which can collide.
  * Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.
  */
-declare const makeBacking: (cache: RuntimeCache) => Persistence.BackingPersistence["Service"];
+export declare const makeBacking: (cache: RuntimeCache) => Persistence.BackingPersistence["Service"];
 /** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */
-declare const layerBacking: Layer.Layer<Persistence.BackingPersistence>;
+export declare const layerBacking: Layer.Layer<Persistence.BackingPersistence>;
 /** `Persistence` backed by the Vercel Runtime Cache. */
-declare const layer: Layer.Layer<Persistence.Persistence>;
+export declare const layer: Layer.Layer<Persistence.Persistence>;
 //#endregion
-export { VercelRuntimeCache_d_exports as VercelRuntimeCache };
-//# sourceMappingURL=runtime-cache.d.ts.map
+//# sourceMappingURL=RuntimeCache.d.ts.map