effect-vercel 0.3.0 → 0.5.0

package/dist/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","names":["holder"],"sources":["../src/Oidc.ts"],"sourcesContent":["/**\n * The OIDC token Vercel issues to a deployment.\n *\n * `ambientToken` reads the token the platform provides. In Functions it\n * arrives on each request as the `x-vercel-oidc-token` header and rotates, so\n * it is read on every run, never cached. In builds and after `vercel env pull`\n * it is `VERCEL_OIDC_TOKEN`. Use it to authenticate to the AI Gateway, or\n * exchange it for cloud credentials (AWS `AssumeRoleWithWebIdentity`, GCP\n * workload identity federation).\n *\n * @example\n * ```ts\n * import * as Oidc from \"effect-vercel/Oidc\"\n * import { Effect, Redacted } from \"effect\"\n *\n * const program = Effect.gen(function* () {\n *   const token = yield* Oidc.ambientToken\n *   // pass Redacted.value(token) as the web identity token\n * })\n * ```\n */\n\nimport { Config, Data, Effect, Redacted } from \"effect\"\n\n/** The environment variable read when no request carries a token. */\nexport const TOKEN_ENV = \"VERCEL_OIDC_TOKEN\"\n\n/** No usable OIDC token. */\nexport class OidcError extends Data.TaggedError(\"VercelOidcError\")<{\n  readonly message: string\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\n/** How to make a token available. */\nexport const hints: ReadonlyArray<string> = [\n  \"Run on Vercel, where each request carries an OIDC token.\",\n  `Or run \\`vercel env pull\\` locally to populate ${TOKEN_ENV}.`,\n]\n\n/**\n * Vercel exposes the current request's context on a well-known global symbol.\n * In Functions, the request's headers live there. `@vercel/oidc` reads the\n * same place.\n */\nconst REQUEST_CONTEXT = Symbol.for(\"@vercel/request-context\")\n\ntype RequestContext = { readonly headers?: Record<string, string | undefined> }\n\n/** The `x-vercel-oidc-token` header of the current request, if set. */\nconst requestToken = (): string | undefined => {\n  const holder = globalThis as typeof globalThis & {\n    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }\n  }\n  const token = holder[REQUEST_CONTEXT]?.get?.()?.headers?.[\"x-vercel-oidc-token\"]\n  return token === \"\" ? undefined : token\n}\n\nconst envToken = Config.NonEmptyString(TOKEN_ENV).pipe(Config.map(Redacted.make))\n\n/**\n * The ambient token: the request header, else `VERCEL_OIDC_TOKEN`. Empty\n * values count as unset. Fails when neither is set. Does not refresh an\n * expired local token; re-run `vercel env pull`.\n */\nexport const ambientToken: Effect.Effect<Redacted.Redacted<string>, OidcError> = Effect.suspend(\n  () => {\n    const token = requestToken()\n    if (token !== undefined) return Effect.succeed(Redacted.make(token))\n    return Effect.mapError(\n      envToken,\n      (cause) => new OidcError({ message: \"No Vercel OIDC token is available.\", hints, cause }),\n    )\n  },\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY;;AAGzB,IAAa,YAAb,cAA+B,KAAK,YAAY,iBAAiB,CAAC,CAI/D,CAAC;;AAGJ,MAAa,QAA+B,CAC1C,4DACA,kDAAkD,UAAU,EAC9D;;;;;;AAOA,MAAM,kBAAkB,OAAO,IAAI,yBAAyB;;AAK5D,MAAM,qBAAyC;CAI7C,MAAM,QAAQA,WAAO,gBAAgB,EAAE,MAAM,CAAC,EAAE,UAAU;CAC1D,OAAO,UAAU,KAAK,KAAA,IAAY;AACpC;AAEA,MAAM,WAAW,OAAO,eAAe,SAAS,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,IAAI,CAAC;;;;;;AAOhF,MAAa,eAAoE,OAAO,cAChF;CACJ,MAAM,QAAQ,aAAa;CAC3B,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,QAAQ,SAAS,KAAK,KAAK,CAAC;CACnE,OAAO,OAAO,SACZ,WACC,UAAU,IAAI,UAAU;EAAE,SAAS;EAAsC;EAAO;CAAM,CAAC,CAC1F;AACF,CACF"}

package/dist/{runtime-cache.d.ts → RuntimeCache.d.ts}

@@ -1,9 +1,7 @@
 import { Layer } from "effect";
 import { RuntimeCache } from "@vercel/functions";
 import { Persistence } from "effect/persistence";
-declare namespace VercelRuntimeCache_d_exports {
-  export { layer, layerBacking, makeBacking };
-}
+//#region src/RuntimeCache.d.ts
 /**
  * A `BackingPersistence` over `cache`.
  *
@@ -17,11 +15,10 @@ declare namespace VercelRuntimeCache_d_exports {
  * `getCache()` hashes keys with a 32-bit hash by default, which can collide.
  * Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.
  */
-declare const makeBacking: (cache: RuntimeCache) => Persistence.BackingPersistence["Service"];
+export declare const makeBacking: (cache: RuntimeCache) => Persistence.BackingPersistence["Service"];
 /** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */
-declare const layerBacking: Layer.Layer<Persistence.BackingPersistence>;
+export declare const layerBacking: Layer.Layer<Persistence.BackingPersistence>;
 /** `Persistence` backed by the Vercel Runtime Cache. */
-declare const layer: Layer.Layer<Persistence.Persistence>;
+export declare const layer: Layer.Layer<Persistence.Persistence>;
 //#endregion
-export { VercelRuntimeCache_d_exports as VercelRuntimeCache };
-//# sourceMappingURL=runtime-cache.d.ts.map
+//# sourceMappingURL=RuntimeCache.d.ts.map

package/dist/{runtime-cache.js → RuntimeCache.js}

@@ -1,9 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { Duration, Effect, Layer } from "effect";
-import { createHash } from "node:crypto";
 import { getCache } from "@vercel/functions";
+import { createHash } from "node:crypto";
 import { Persistence } from "effect/persistence";
-//#region src/VercelRuntimeCache.ts
+//#region src/RuntimeCache.ts
 /**
 * Effect `Persistence` backed by the Vercel Runtime Cache, so a
 * `PersistedCache` shares results across Function instances in a region.
@@ -13,7 +12,7 @@ import { Persistence } from "effect/persistence";
 *
 * @example
 * ```ts
-* import { VercelRuntimeCache } from "effect-vercel/runtime-cache"
+* import * as RuntimeCache from "effect-vercel/RuntimeCache"
 * import { Effect } from "effect"
 * import { PersistedCache } from "effect/persistence"
 *
@@ -23,14 +22,9 @@ import { Persistence } from "effect/persistence";
 *     timeToLive: () => "1 hour",
 *   })
 *   return yield* users.get(new GetUser({ id: 1 }))
-* }).pipe(Effect.scoped, Effect.provide(VercelRuntimeCache.layer))
+* }).pipe(Effect.scoped, Effect.provide(RuntimeCache.layer))
 * ```
 */
-var VercelRuntimeCache_exports = /* @__PURE__ */ __exportAll({
-	layer: () => layer,
-	layerBacking: () => layerBacking,
-	makeBacking: () => makeBacking
-});
 const sha256 = (key) => createHash("sha256").update(key).digest("hex");
 /**
 * A `BackingPersistence` over `cache`.
@@ -95,6 +89,6 @@ const layerBacking = Layer.sync(Persistence.BackingPersistence)(() => makeBackin
 /** `Persistence` backed by the Vercel Runtime Cache. */
 const layer = Persistence.layer.pipe(Layer.provide(layerBacking));
 //#endregion
-export { VercelRuntimeCache_exports as VercelRuntimeCache };
+export { layer, layerBacking, makeBacking };
 
-//# sourceMappingURL=runtime-cache.js.map
+//# sourceMappingURL=RuntimeCache.js.map

package/dist/RuntimeCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimeCache.js","names":[],"sources":["../src/RuntimeCache.ts"],"sourcesContent":["/**\n * Effect `Persistence` backed by the Vercel Runtime Cache, so a\n * `PersistedCache` shares results across Function instances in a region.\n *\n * Outside Vercel, `getCache` falls back to an in-memory cache, so the same\n * layer works in local dev and tests.\n *\n * @example\n * ```ts\n * import * as RuntimeCache from \"effect-vercel/RuntimeCache\"\n * import { Effect } from \"effect\"\n * import { PersistedCache } from \"effect/persistence\"\n *\n * const program = Effect.gen(function* () {\n *   const users = yield* PersistedCache.make(fetchUser, {\n *     storeId: \"users\",\n *     timeToLive: () => \"1 hour\",\n *   })\n *   return yield* users.get(new GetUser({ id: 1 }))\n * }).pipe(Effect.scoped, Effect.provide(RuntimeCache.layer))\n * ```\n */\n\nimport { createHash } from \"node:crypto\"\nimport { getCache, type RuntimeCache } from \"@vercel/functions\"\nimport { Duration, Effect, Layer } from \"effect\"\nimport { Persistence } from \"effect/persistence\"\n\nconst sha256 = (key: string) => createHash(\"sha256\").update(key).digest(\"hex\")\n\n/**\n * A `BackingPersistence` over `cache`.\n *\n * Entries are keyed by the JSON pair `[storeId, key]`, so no two stores share\n * a key. Each entry is tagged with a hash of the store id, since tags are\n * joined with `,` and sent unescaped, and `clear` expires that tag. Entries\n * are sent without a name, so keys don't reach Vercel's o11y or the request\n * headers, where non-Latin-1 characters would make the write fail. TTLs round\n * up to whole seconds, the cache's resolution.\n *\n * `getCache()` hashes keys with a 32-bit hash by default, which can collide.\n * Pass a cache made with a stronger `keyHashFunction`, as `layerBacking` does.\n */\nexport const makeBacking = (cache: RuntimeCache): Persistence.BackingPersistence[\"Service\"] =>\n  Persistence.BackingPersistence.of({\n    make: (storeId) =>\n      Effect.sync(() => {\n        const prefixed = (key: string) => JSON.stringify([storeId, key])\n        const tag = `effect-persistence:${sha256(storeId)}`\n\n        const get = (key: string) =>\n          Effect.tryPromise({\n            try: () => cache.get(prefixed(key)),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to get key ${key}`, cause }),\n          }).pipe(\n            Effect.map((value) =>\n              typeof value === \"object\" && value !== null ? value : undefined,\n            ),\n          )\n\n        const set = (key: string, value: object, ttl: Duration.Duration | undefined) =>\n          Effect.tryPromise({\n            try: () =>\n              cache.set(prefixed(key), value, {\n                name: \"\",\n                tags: [tag],\n                ...(ttl && { ttl: Math.max(1, Math.ceil(Duration.toSeconds(ttl))) }),\n              }),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to set key ${key}`, cause }),\n          })\n\n        return {\n          get,\n          getMany: (keys) => Effect.forEach(keys, get, { concurrency: \"unbounded\" }),\n          set,\n          // Writes run concurrently, so keep only the last entry for each key.\n          setMany: (entries) =>\n            Effect.forEach(\n              new Map(entries.map(([key, value, ttl]) => [key, [value, ttl] as const])),\n              ([key, [value, ttl]]) => set(key, value, ttl),\n              { concurrency: \"unbounded\", discard: true },\n            ),\n          remove: (key) =>\n            Effect.tryPromise({\n              try: () => cache.delete(prefixed(key)),\n              catch: (cause) =>\n                new Persistence.PersistenceError({ message: `Failed to remove key ${key}`, cause }),\n            }),\n          clear: Effect.tryPromise({\n            try: () => cache.expireTag(tag),\n            catch: (cause) =>\n              new Persistence.PersistenceError({ message: `Failed to clear ${storeId}`, cause }),\n          }),\n        }\n      }),\n  })\n\n/** `BackingPersistence` over `getCache()`, with SHA-256 key hashing. */\nexport const layerBacking: Layer.Layer<Persistence.BackingPersistence> = Layer.sync(\n  Persistence.BackingPersistence,\n)(() => makeBacking(getCache({ keyHashFunction: sha256 })))\n\n/** `Persistence` backed by the Vercel Runtime Cache. */\nexport const layer: Layer.Layer<Persistence.Persistence> = Persistence.layer.pipe(\n  Layer.provide(layerBacking),\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,UAAU,QAAgB,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK;;;;;;;;;;;;;;AAe7E,MAAa,eAAe,UAC1B,YAAY,mBAAmB,GAAG,EAChC,OAAO,YACL,OAAO,WAAW;CAChB,MAAM,YAAY,QAAgB,KAAK,UAAU,CAAC,SAAS,GAAG,CAAC;CAC/D,MAAM,MAAM,sBAAsB,OAAO,OAAO;CAEhD,MAAM,OAAO,QACX,OAAO,WAAW;EAChB,WAAW,MAAM,IAAI,SAAS,GAAG,CAAC;EAClC,QAAQ,UACN,IAAI,YAAY,iBAAiB;GAAE,SAAS,qBAAqB;GAAO;EAAM,CAAC;CACnF,CAAC,CAAC,CAAC,KACD,OAAO,KAAK,UACV,OAAO,UAAU,YAAY,UAAU,OAAO,QAAQ,KAAA,CACxD,CACF;CAEF,MAAM,OAAO,KAAa,OAAe,QACvC,OAAO,WAAW;EAChB,WACE,MAAM,IAAI,SAAS,GAAG,GAAG,OAAO;GAC9B,MAAM;GACN,MAAM,CAAC,GAAG;GACV,GAAI,OAAO,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC,EAAE;EACpE,CAAC;EACH,QAAQ,UACN,IAAI,YAAY,iBAAiB;GAAE,SAAS,qBAAqB;GAAO;EAAM,CAAC;CACnF,CAAC;CAEH,OAAO;EACL;EACA,UAAU,SAAS,OAAO,QAAQ,MAAM,KAAK,EAAE,aAAa,YAAY,CAAC;EACzE;EAEA,UAAU,YACR,OAAO,QACL,IAAI,IAAI,QAAQ,KAAK,CAAC,KAAK,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAU,CAAC,CAAC,IACvE,CAAC,KAAK,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GAAG,GAC5C;GAAE,aAAa;GAAa,SAAS;EAAK,CAC5C;EACF,SAAS,QACP,OAAO,WAAW;GAChB,WAAW,MAAM,OAAO,SAAS,GAAG,CAAC;GACrC,QAAQ,UACN,IAAI,YAAY,iBAAiB;IAAE,SAAS,wBAAwB;IAAO;GAAM,CAAC;EACtF,CAAC;EACH,OAAO,OAAO,WAAW;GACvB,WAAW,MAAM,UAAU,GAAG;GAC9B,QAAQ,UACN,IAAI,YAAY,iBAAiB;IAAE,SAAS,mBAAmB;IAAW;GAAM,CAAC;EACrF,CAAC;CACH;AACF,CAAC,EACL,CAAC;;AAGH,MAAa,eAA4D,MAAM,KAC7E,YAAY,kBACd,CAAC,OAAO,YAAY,SAAS,EAAE,iBAAiB,OAAO,CAAC,CAAC,CAAC;;AAG1D,MAAa,QAA8C,YAAY,MAAM,KAC3E,MAAM,QAAQ,YAAY,CAC5B"}

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "effect-vercel",
-  "version": "0.3.0",
-  "description": "Effect integrations for Vercel: AI Gateway, OIDC, Runtime Cache",
+  "version": "0.5.0",
+  "description": "Effect integrations for Vercel: AI Gateway, OIDC, Runtime Cache, waitUntil",
   "keywords": [
     "ai-gateway",
     "effect",
     "effect-ai",
     "oidc",
     "runtime-cache",
-    "vercel"
+    "vercel",
+    "wait-until"
   ],
   "homepage": "https://github.com/duailibe/effect-vercel#readme",
   "bugs": {
@@ -27,9 +28,11 @@
   "type": "module",
   "sideEffects": false,
   "exports": {
-    "./ai-gateway": "./dist/ai-gateway.js",
-    "./oidc": "./dist/oidc.js",
-    "./runtime-cache": "./dist/runtime-cache.js",
+    "./AiGateway": "./dist/AiGateway.js",
+    "./AiGatewayCredentials": "./dist/AiGatewayCredentials.js",
+    "./Functions": "./dist/Functions.js",
+    "./Oidc": "./dist/Oidc.js",
+    "./RuntimeCache": "./dist/RuntimeCache.js",
     "./package.json": "./package.json"
   },
   "publishConfig": {

package/src/AiGateway.ts

@@ -15,7 +15,7 @@
  *
  * @example
  * ```ts
- * import { AiGateway } from "effect-vercel/ai-gateway"
+ * import * as AiGateway from "effect-vercel/AiGateway"
  * import { AnthropicLanguageModel } from "@effect/ai-anthropic"
  * import { Layer } from "effect"
  * import { FetchHttpClient } from "effect/http"

package/src/AiGatewayCredentials.ts

@@ -8,23 +8,23 @@
  *
  * @example
  * ```ts
- * import { AiGatewayCredentials } from "effect-vercel/ai-gateway"
+ * import * as AiGatewayCredentials from "effect-vercel/AiGatewayCredentials"
  *
- * AiGatewayCredentials.layer           // AI_GATEWAY_API_KEY, else the Vercel OIDC token
+ * AiGatewayCredentials.layer                // AI_GATEWAY_API_KEY, else the Vercel OIDC token
  * AiGatewayCredentials.layerFromEnv         // AI_GATEWAY_API_KEY only
- * AiGatewayCredentials.layerFromVercelOidc  // the Vercel OIDC token only
+ * AiGatewayCredentials.layerFromOidc        // the Vercel OIDC token only
  * AiGatewayCredentials.layerFromApiKey("…") // a fixed value
  * ```
  */
 
 import { Config, Context, Data, Effect, Layer, Option, Redacted } from "effect"
-import * as VercelOidc from "./VercelOidc.js"
+import * as Oidc from "./Oidc.js"
 
 /** The environment variable `layerFromEnv` reads. */
 export const API_KEY_ENV = "AI_GATEWAY_API_KEY"
 
 /** Which layer produced or failed to produce a credential. */
-export type Source = "api-key" | "env" | "vercel-oidc" | "default"
+export type Source = "api-key" | "env" | "oidc" | "default"
 
 /**
  * A credential ready to put on a request. `method` is what the gateway
@@ -46,7 +46,7 @@ export class AiGatewayCredentialsError extends Data.TaggedError("AiGatewayCreden
 export class AiGatewayCredentials extends Context.Service<
   AiGatewayCredentials,
   Effect.Effect<Resolved, AiGatewayCredentialsError>
->()("effect-vercel/ai-gateway/AiGatewayCredentials") {}
+>()("effect-vercel/AiGatewayCredentials") {}
 
 /** The request headers that carry `credentials`. */
 export const formatHeaders = (credentials: Resolved): Record<string, string> => ({
@@ -57,23 +57,16 @@ export const formatHeaders = (credentials: Resolved): Record<string, string> =>
 const hints: Record<Source, ReadonlyArray<string>> = {
   "api-key": [],
   env: [`Set ${API_KEY_ENV} to an AI Gateway API key.`],
-  "vercel-oidc": VercelOidc.hints,
+  oidc: Oidc.hints,
   default: [
     `Set ${API_KEY_ENV} to an AI Gateway API key.`,
     "Or run on Vercel / `vercel env pull` so an OIDC token is available.",
   ],
 }
 
-/**
- * Where a credential may come from. `None` means the place is not configured,
- * so a chain can move on; a failure means it is configured but unusable.
- */
-type Lookup = Effect.Effect<Option.Option<Resolved>, AiGatewayCredentialsError>
-
-const apiKeyLookup: Lookup = Config.option(Config.Redacted(API_KEY_ENV)).pipe(
-  Effect.map(Option.map((token) => ({ method: "api-key" as const, token }))),
-  Effect.catchTag(
-    "ConfigError",
+/** `AI_GATEWAY_API_KEY`, or `None` when unset. Fails only when it can't be read. */
+const envApiKey = Config.option(Config.Redacted(API_KEY_ENV)).pipe(
+  Effect.mapError(
     (cause) =>
       new AiGatewayCredentialsError({
         message: `Failed to read ${API_KEY_ENV}.`,
@@ -84,37 +77,34 @@ const apiKeyLookup: Lookup = Config.option(Config.Redacted(API_KEY_ENV)).pipe(
   ),
 )
 
-const vercelOidcLookup: Lookup = VercelOidc.find.pipe(
-  Effect.map(Option.map((token) => ({ method: "oidc" as const, token }))),
+const fromEnv: Effect.Effect<Resolved, AiGatewayCredentialsError> = Effect.flatMap(
+  envApiKey,
+  Option.match({
+    onNone: () =>
+      Effect.fail(
+        new AiGatewayCredentialsError({
+          message: `${API_KEY_ENV} is not set.`,
+          source: "env",
+          hints: hints.env,
+        }),
+      ),
+    onSome: (token) => Effect.succeed({ method: "api-key" as const, token }),
+  }),
+)
+
+const fromOidc: Effect.Effect<Resolved, AiGatewayCredentialsError> = Oidc.ambientToken.pipe(
+  Effect.map((token) => ({ method: "oidc" as const, token })),
   Effect.mapError(
     (cause) =>
       new AiGatewayCredentialsError({
         message: cause.message,
-        source: "vercel-oidc",
+        source: "oidc",
         hints: cause.hints,
         cause,
       }),
   ),
 )
 
-const firstOf = (lookups: ReadonlyArray<Lookup>): Lookup =>
-  Effect.gen(function* () {
-    for (const lookup of lookups) {
-      const found = yield* lookup
-      if (Option.isSome(found)) return found
-    }
-    return Option.none()
-  })
-
-const toLayer = (lookup: Lookup, source: Source, message: string) =>
-  Layer.succeed(AiGatewayCredentials)(
-    Effect.flatMap(lookup, (found) =>
-      Option.isSome(found)
-        ? Effect.succeed(found.value)
-        : Effect.fail(new AiGatewayCredentialsError({ message, source, hints: hints[source] })),
-    ),
-  )
-
 /** A fixed API key. */
 export const layerFromApiKey = (
   apiKey: string | Redacted.Redacted<string>,
@@ -127,26 +117,34 @@ export const layerFromApiKey = (
   )
 
 /** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
-export const layerFromEnv: Layer.Layer<AiGatewayCredentials> = toLayer(
-  apiKeyLookup,
-  "env",
-  `${API_KEY_ENV} is not set.`,
-)
+export const layerFromEnv: Layer.Layer<AiGatewayCredentials> =
+  Layer.succeed(AiGatewayCredentials)(fromEnv)
 
-/** The Vercel OIDC token (see `VercelOidc.find`). Not refreshed when it expires locally. */
-export const layerFromVercelOidc: Layer.Layer<AiGatewayCredentials> = toLayer(
-  vercelOidcLookup,
-  "vercel-oidc",
-  "No Vercel OIDC token is available.",
-)
+/** The Vercel OIDC token (see `Oidc.ambientToken`). */
+export const layerFromOidc: Layer.Layer<AiGatewayCredentials> =
+  Layer.succeed(AiGatewayCredentials)(fromOidc)
 
 /**
- * The default: `layerFromEnv`, then `layerFromVercelOidc`. Same order as
+ * The default: `layerFromEnv`, then `layerFromOidc`. Same order as
  * Vercel's own SDK, so it works locally with an API key and on Vercel without
- * one.
+ * one. Falls back only when the key is unset, not when it can't be read.
  */
-export const layer: Layer.Layer<AiGatewayCredentials> = toLayer(
-  firstOf([apiKeyLookup, vercelOidcLookup]),
-  "default",
-  "No AI Gateway credential found.",
+export const layer: Layer.Layer<AiGatewayCredentials> = Layer.succeed(AiGatewayCredentials)(
+  Effect.flatMap(
+    envApiKey,
+    Option.match({
+      onNone: () =>
+        Effect.mapError(
+          fromOidc,
+          (cause) =>
+            new AiGatewayCredentialsError({
+              message: "No AI Gateway credential found.",
+              source: "default",
+              hints: hints.default,
+              cause,
+            }),
+        ),
+      onSome: (token) => Effect.succeed({ method: "api-key" as const, token }),
+    }),
+  ),
 )

package/src/Functions.ts

@@ -0,0 +1,34 @@
+/**
+ * Effect bindings for `@vercel/functions`.
+ *
+ * `waitUntil` keeps the Function running until a fiber ends, so work forked
+ * during a request can finish after the response is sent.
+ *
+ * @example
+ * ```ts
+ * import * as Functions from "effect-vercel/Functions"
+ * import { Effect } from "effect"
+ *
+ * const handler = Effect.gen(function* () {
+ *   yield* Effect.forkDetach(sendReceipt).pipe(Effect.tap(Functions.waitUntil))
+ *   return new Response("OK")
+ * })
+ * ```
+ */
+
+import { waitUntil as vercelWaitUntil } from "@vercel/functions"
+import { Effect, type Fiber } from "effect"
+
+/**
+ * Keeps the Function running until `fiber` ends, as `waitUntil` from
+ * `@vercel/functions` does for a promise. Off Vercel it does nothing.
+ *
+ * The fiber must outlive the request fiber, so fork it with
+ * `Effect.forkDetach` or into a scope that outlives the request. A child
+ * fiber is interrupted when the request fiber ends. Failures are not
+ * reported, so handle them in the forked effect.
+ */
+export const waitUntil = <A, E>(fiber: Fiber.Fiber<A, E>): Effect.Effect<void> =>
+  Effect.sync(() =>
+    vercelWaitUntil(new Promise<void>((resolve) => fiber.addObserver(() => resolve()))),
+  )

package/src/Oidc.ts

@@ -0,0 +1,75 @@
+/**
+ * The OIDC token Vercel issues to a deployment.
+ *
+ * `ambientToken` reads the token the platform provides. In Functions it
+ * arrives on each request as the `x-vercel-oidc-token` header and rotates, so
+ * it is read on every run, never cached. In builds and after `vercel env pull`
+ * it is `VERCEL_OIDC_TOKEN`. Use it to authenticate to the AI Gateway, or
+ * exchange it for cloud credentials (AWS `AssumeRoleWithWebIdentity`, GCP
+ * workload identity federation).
+ *
+ * @example
+ * ```ts
+ * import * as Oidc from "effect-vercel/Oidc"
+ * import { Effect, Redacted } from "effect"
+ *
+ * const program = Effect.gen(function* () {
+ *   const token = yield* Oidc.ambientToken
+ *   // pass Redacted.value(token) as the web identity token
+ * })
+ * ```
+ */
+
+import { Config, Data, Effect, Redacted } from "effect"
+
+/** The environment variable read when no request carries a token. */
+export const TOKEN_ENV = "VERCEL_OIDC_TOKEN"
+
+/** No usable OIDC token. */
+export class OidcError extends Data.TaggedError("VercelOidcError")<{
+  readonly message: string
+  readonly hints: ReadonlyArray<string>
+  readonly cause?: unknown
+}> {}
+
+/** How to make a token available. */
+export const hints: ReadonlyArray<string> = [
+  "Run on Vercel, where each request carries an OIDC token.",
+  `Or run \`vercel env pull\` locally to populate ${TOKEN_ENV}.`,
+]
+
+/**
+ * Vercel exposes the current request's context on a well-known global symbol.
+ * In Functions, the request's headers live there. `@vercel/oidc` reads the
+ * same place.
+ */
+const REQUEST_CONTEXT = Symbol.for("@vercel/request-context")
+
+type RequestContext = { readonly headers?: Record<string, string | undefined> }
+
+/** The `x-vercel-oidc-token` header of the current request, if set. */
+const requestToken = (): string | undefined => {
+  const holder = globalThis as typeof globalThis & {
+    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }
+  }
+  const token = holder[REQUEST_CONTEXT]?.get?.()?.headers?.["x-vercel-oidc-token"]
+  return token === "" ? undefined : token
+}
+
+const envToken = Config.NonEmptyString(TOKEN_ENV).pipe(Config.map(Redacted.make))
+
+/**
+ * The ambient token: the request header, else `VERCEL_OIDC_TOKEN`. Empty
+ * values count as unset. Fails when neither is set. Does not refresh an
+ * expired local token; re-run `vercel env pull`.
+ */
+export const ambientToken: Effect.Effect<Redacted.Redacted<string>, OidcError> = Effect.suspend(
+  () => {
+    const token = requestToken()
+    if (token !== undefined) return Effect.succeed(Redacted.make(token))
+    return Effect.mapError(
+      envToken,
+      (cause) => new OidcError({ message: "No Vercel OIDC token is available.", hints, cause }),
+    )
+  },
+)

package/src/{VercelRuntimeCache.ts → RuntimeCache.ts}

@@ -7,7 +7,7 @@
  *
  * @example
  * ```ts
- * import { VercelRuntimeCache } from "effect-vercel/runtime-cache"
+ * import * as RuntimeCache from "effect-vercel/RuntimeCache"
  * import { Effect } from "effect"
  * import { PersistedCache } from "effect/persistence"
  *
@@ -17,7 +17,7 @@
  *     timeToLive: () => "1 hour",
  *   })
  *   return yield* users.get(new GetUser({ id: 1 }))
- * }).pipe(Effect.scoped, Effect.provide(VercelRuntimeCache.layer))
+ * }).pipe(Effect.scoped, Effect.provide(RuntimeCache.layer))
  * ```
  */
 

package/dist/VercelOidc-DCkdXW3E.js

@@ -1,70 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { Config, Data, Effect, Option, Redacted } from "effect";
-//#region src/VercelOidc.ts
-/**
-* The OIDC token Vercel issues to a deployment.
-*
-* In Functions the token arrives on each request as the `x-vercel-oidc-token`
-* header and rotates, so it is read on every run of `token`/`find`, never
-* cached. In builds and after `vercel env pull` it is `VERCEL_OIDC_TOKEN`.
-* Use it to authenticate to the AI Gateway, or exchange it for cloud
-* credentials (AWS `AssumeRoleWithWebIdentity`, GCP workload identity
-* federation).
-*
-* @example
-* ```ts
-* import { VercelOidc } from "effect-vercel/oidc"
-* import { Effect, Redacted } from "effect"
-*
-* const program = Effect.gen(function* () {
-*   const token = yield* VercelOidc.token
-*   // pass Redacted.value(token) as the web identity token
-* })
-* ```
-*/
-var VercelOidc_exports = /* @__PURE__ */ __exportAll({
-	TOKEN_ENV: () => TOKEN_ENV,
-	VercelOidcError: () => VercelOidcError,
-	find: () => find,
-	hints: () => hints,
-	token: () => token
-});
-/** The environment variable read when no request carries a token. */
-const TOKEN_ENV = "VERCEL_OIDC_TOKEN";
-/** No usable OIDC token. */
-var VercelOidcError = class extends Data.TaggedError("VercelOidcError") {};
-/** How to make a token available. */
-const hints = ["Run on Vercel, where each request carries an OIDC token.", `Or run \`vercel env pull\` locally to populate ${TOKEN_ENV}.`];
-/**
-* Vercel exposes the current request's context on a well-known global symbol.
-* In Functions, the `x-vercel-oidc-token` header of the request lives there.
-* Mirrors `@vercel/oidc`'s `getVercelOidcTokenSync`, minus the dev-time
-* refresh that package also offers.
-*/
-const REQUEST_CONTEXT = Symbol.for("@vercel/request-context");
-const fromRequestContext = Effect.sync(() => {
-	const holder = globalThis;
-	return Option.fromNullishOr(holder[REQUEST_CONTEXT]?.get?.()?.headers?.["x-vercel-oidc-token"]).pipe(Option.map(Redacted.make));
-});
-const fromEnv = Config.option(Config.Redacted(TOKEN_ENV)).pipe(Effect.catchTag("ConfigError", (cause) => new VercelOidcError({
-	message: `Failed to read ${TOKEN_ENV}.`,
-	hints,
-	cause
-})));
-/**
-* The token if one is available: the request header, else `VERCEL_OIDC_TOKEN`.
-* `None` means neither is set, so a caller can fall back to something else.
-*/
-const find = Effect.flatMap(fromRequestContext, (found) => Option.isSome(found) ? Effect.succeed(found) : fromEnv);
-/** Like `find`, but fails when no token is available. */
-const token = Effect.flatMap(find, Option.match({
-	onNone: () => Effect.fail(new VercelOidcError({
-		message: "No Vercel OIDC token is available.",
-		hints
-	})),
-	onSome: Effect.succeed
-}));
-//#endregion
-export { find as n, hints as r, VercelOidc_exports as t };
-
-//# sourceMappingURL=VercelOidc-DCkdXW3E.js.map

package/dist/VercelOidc-DCkdXW3E.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"VercelOidc-DCkdXW3E.js","names":[],"sources":["../src/VercelOidc.ts"],"sourcesContent":["/**\n * The OIDC token Vercel issues to a deployment.\n *\n * In Functions the token arrives on each request as the `x-vercel-oidc-token`\n * header and rotates, so it is read on every run of `token`/`find`, never\n * cached. In builds and after `vercel env pull` it is `VERCEL_OIDC_TOKEN`.\n * Use it to authenticate to the AI Gateway, or exchange it for cloud\n * credentials (AWS `AssumeRoleWithWebIdentity`, GCP workload identity\n * federation).\n *\n * @example\n * ```ts\n * import { VercelOidc } from \"effect-vercel/oidc\"\n * import { Effect, Redacted } from \"effect\"\n *\n * const program = Effect.gen(function* () {\n *   const token = yield* VercelOidc.token\n *   // pass Redacted.value(token) as the web identity token\n * })\n * ```\n */\n\nimport { Config, Data, Effect, Option, Redacted } from \"effect\"\n\n/** The environment variable read when no request carries a token. */\nexport const TOKEN_ENV = \"VERCEL_OIDC_TOKEN\"\n\n/** No usable OIDC token. */\nexport class VercelOidcError extends Data.TaggedError(\"VercelOidcError\")<{\n  readonly message: string\n  readonly hints: ReadonlyArray<string>\n  readonly cause?: unknown\n}> {}\n\n/** How to make a token available. */\nexport const hints: ReadonlyArray<string> = [\n  \"Run on Vercel, where each request carries an OIDC token.\",\n  `Or run \\`vercel env pull\\` locally to populate ${TOKEN_ENV}.`,\n]\n\n/**\n * Vercel exposes the current request's context on a well-known global symbol.\n * In Functions, the `x-vercel-oidc-token` header of the request lives there.\n * Mirrors `@vercel/oidc`'s `getVercelOidcTokenSync`, minus the dev-time\n * refresh that package also offers.\n */\nconst REQUEST_CONTEXT = Symbol.for(\"@vercel/request-context\")\n\ntype RequestContext = { readonly headers?: Record<string, string | undefined> }\n\nconst fromRequestContext = Effect.sync(() => {\n  const holder = globalThis as typeof globalThis & {\n    [REQUEST_CONTEXT]?: { get?: () => RequestContext | undefined }\n  }\n  return Option.fromNullishOr(\n    holder[REQUEST_CONTEXT]?.get?.()?.headers?.[\"x-vercel-oidc-token\"],\n  ).pipe(Option.map(Redacted.make))\n})\n\nconst fromEnv = Config.option(Config.Redacted(TOKEN_ENV)).pipe(\n  Effect.catchTag(\n    \"ConfigError\",\n    (cause) => new VercelOidcError({ message: `Failed to read ${TOKEN_ENV}.`, hints, cause }),\n  ),\n)\n\n/**\n * The token if one is available: the request header, else `VERCEL_OIDC_TOKEN`.\n * `None` means neither is set, so a caller can fall back to something else.\n */\nexport const find: Effect.Effect<\n  Option.Option<Redacted.Redacted<string>>,\n  VercelOidcError\n> = Effect.flatMap(fromRequestContext, (found) =>\n  Option.isSome(found) ? Effect.succeed(found) : fromEnv,\n)\n\n/** Like `find`, but fails when no token is available. */\nexport const token: Effect.Effect<Redacted.Redacted<string>, VercelOidcError> = Effect.flatMap(\n  find,\n  Option.match({\n    onNone: () =>\n      Effect.fail(new VercelOidcError({ message: \"No Vercel OIDC token is available.\", hints })),\n    onSome: Effect.succeed,\n  }),\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,YAAY;;AAGzB,IAAa,kBAAb,cAAqC,KAAK,YAAY,iBAAiB,CAAC,CAIrE,CAAC;;AAGJ,MAAa,QAA+B,CAC1C,4DACA,kDAAkD,UAAU,EAC9D;;;;;;;AAQA,MAAM,kBAAkB,OAAO,IAAI,yBAAyB;AAI5D,MAAM,qBAAqB,OAAO,WAAW;CAC3C,MAAM,SAAS;CAGf,OAAO,OAAO,cACZ,OAAO,gBAAgB,EAAE,MAAM,CAAC,EAAE,UAAU,sBAC9C,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,OAAO,OAAO,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC,KACxD,OAAO,SACL,gBACC,UAAU,IAAI,gBAAgB;CAAE,SAAS,kBAAkB,UAAU;CAAI;CAAO;AAAM,CAAC,CAC1F,CACF;;;;;AAMA,MAAa,OAGT,OAAO,QAAQ,qBAAqB,UACtC,OAAO,OAAO,KAAK,IAAI,OAAO,QAAQ,KAAK,IAAI,OACjD;;AAGA,MAAa,QAAmE,OAAO,QACrF,MACA,OAAO,MAAM;CACX,cACE,OAAO,KAAK,IAAI,gBAAgB;EAAE,SAAS;EAAsC;CAAM,CAAC,CAAC;CAC3F,QAAQ,OAAO;AACjB,CAAC,CACH"}

package/dist/ai-gateway.d.ts

@@ -1,87 +0,0 @@
-import { AnthropicClient } from "@effect/ai-anthropic";
-import { Context, Effect, Layer, Redacted } from "effect";
-import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
-declare namespace AiGatewayCredentials_d_exports {
-  export { API_KEY_ENV, AiGatewayCredentials, AiGatewayCredentialsError, Resolved, Source, formatHeaders, layer$1 as layer, layerFromApiKey, layerFromEnv, layerFromVercelOidc };
-}
-/** The environment variable `layerFromEnv` reads. */
-declare const API_KEY_ENV = "AI_GATEWAY_API_KEY";
-/** Which layer produced or failed to produce a credential. */
-type Source = "api-key" | "env" | "vercel-oidc" | "default";
-/**
- * A credential ready to put on a request. `method` is what the gateway
- * records as the auth method; it matches the values Vercel's own SDK sends.
- */
-interface Resolved {
-  readonly method: "api-key" | "oidc";
-  readonly token: Redacted.Redacted<string>;
-}
-declare const AiGatewayCredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "AiGatewayCredentialsError";
-} & Readonly<A>;
-/** No credential could be produced for a gateway request. */
-declare class AiGatewayCredentialsError extends AiGatewayCredentialsError_base<{
-  readonly message: string;
-  readonly source: Source;
-  readonly hints: ReadonlyArray<string>;
-  readonly cause?: unknown;
-}> {}
-declare const AiGatewayCredentials_base: Context.ServiceClass<AiGatewayCredentials, "effect-vercel/ai-gateway/AiGatewayCredentials", Effect.Effect<Resolved, AiGatewayCredentialsError, never>>;
-declare class AiGatewayCredentials extends AiGatewayCredentials_base {}
-/** The request headers that carry `credentials`. */
-declare const formatHeaders: (credentials: Resolved) => Record<string, string>;
-/** A fixed API key. */
-declare const layerFromApiKey: (apiKey: string | Redacted.Redacted<string>) => Layer.Layer<AiGatewayCredentials>;
-/** `AI_GATEWAY_API_KEY`: local dev, CI, or anywhere off Vercel. */
-declare const layerFromEnv: Layer.Layer<AiGatewayCredentials>;
-/** The Vercel OIDC token (see `VercelOidc.find`). Not refreshed when it expires locally. */
-declare const layerFromVercelOidc: Layer.Layer<AiGatewayCredentials>;
-/**
- * The default: `layerFromEnv`, then `layerFromVercelOidc`. Same order as
- * Vercel's own SDK, so it works locally with an API key and on Vercel without
- * one.
- */
-declare const layer$1: Layer.Layer<AiGatewayCredentials>;
-declare namespace AiGateway_d_exports {
-  export { AI_GATEWAY_URL, dropNullCacheControl, fillMissingResponseKeys, layer, layerWithoutCredentials, make, patchResponseBody };
-}
-/** Base URL of the Vercel AI Gateway. */
-declare const AI_GATEWAY_URL = "https://ai-gateway.vercel.sh";
-/**
- * Builds the Anthropic client against the gateway, authenticating each
- * request with `credentials`. A credential failure fails that request as an
- * `HttpClientError`, which Effect AI surfaces as a network `AiError`.
- */
-declare const make: (credentials: typeof AiGatewayCredentials.Service) => Effect.Effect<AnthropicClient.Service, never, HttpClient.HttpClient>;
-/**
- * `AnthropicClient` backed by the gateway, authenticating with the
- * `AiGatewayCredentials` you provide (see that module's `layerFrom*` layers).
- * Needs an `HttpClient` too.
- */
-declare const layerWithoutCredentials: Layer.Layer<AnthropicClient.AnthropicClient, never, AiGatewayCredentials | HttpClient.HttpClient>;
-/**
- * `layerWithoutCredentials` with the default `AiGatewayCredentials.layer`:
- * `AI_GATEWAY_API_KEY`, else the Vercel OIDC token. Needs an `HttpClient`.
- * Building never fails; without a usable credential, the requests fail.
- */
-declare const layer: Layer.Layer<AnthropicClient.AnthropicClient, never, HttpClient.HttpClient>;
-/**
- * The Effect provider writes `"cache_control": null` on every content block
- * it has no cache setting for. Anthropic accepts that; the gateway rejects
- * the request with `messages.0.content: Invalid input`. Remove the null keys.
- */
-declare function dropNullCacheControl(request: HttpClientRequest.HttpClientRequest): HttpClientRequest.HttpClientRequest;
-/**
- * The gateway's Anthropic-shaped responses leave out keys that Anthropic
- * always sends and the Effect provider's schema requires: the cache and
- * service-tier usage fields, the `signature` of a thinking block from a
- * non-Anthropic model, and `type`/`request_id` on error envelopes, whose
- * `error.type` may also be a gateway-specific value. Fill them with the values
- * Anthropic uses when there is nothing to report. Streaming responses are not
- * JSON and pass through untouched.
- */
-declare function fillMissingResponseKeys(response: HttpClientResponse.HttpClientResponse): Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>;
-declare function patchResponseBody(body: Record<string, unknown>): Record<string, unknown>;
-//#endregion
-export { AiGateway_d_exports as AiGateway, AiGatewayCredentials_d_exports as AiGatewayCredentials };
-//# sourceMappingURL=ai-gateway.d.ts.map