@nylorun/runtime 0.28.0-beta → 0.30.0-beta

package/dist/mcp/connect.d.ts

@@ -42,6 +42,8 @@ export interface McpToolPage {
         readonly annotations?: Readonly<Record<string, unknown>>;
     }[];
     readonly nextCursor?: string;
+    /** What the server, or a gateway in front of it, says besides the tools (MCP `_meta`). */
+    readonly _meta?: Readonly<Record<string, unknown>>;
 }
 /**
  * A `tools/call` answer: the raw `CallToolResult`, with each credential value sent for the call
@@ -90,6 +92,8 @@ export type McpToolFailure = {
     readonly retryable?: boolean;
     /** With `credential_rejected`: the server. */
     readonly server?: string;
+    /** With `credential_rejected` of the workload token: the gateway that refused it (#496). */
+    readonly gateway?: string;
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 };
@@ -103,7 +107,8 @@ export type McpToolOutcome = {
  * How a tool call failed at the transport or the server (R2b C7), as the gate answers it:
  * - `mcp.unreachable`: never sent (address policy, DNS, refused connection, TLS, a connection
  *   that could not be opened). Calling again may work.
- * - `credential_rejected`: the server answered `401` (C1).
+ * - `credential_rejected`: the server answered `401` (C1), or the gateway of a credential's `via`
+ *   reported that the server behind it did (#495).
  * - `mcp.forbidden`: the server answered `403`.
  * - `mcp.error`: the server answered a JSON-RPC error; the message has its code.
  * - `mcp.status`: the server answered another HTTP error status, without a JSON-RPC error.
@@ -121,6 +126,8 @@ export interface McpCallFailure {
     readonly retryable: boolean;
     /** With `credential_rejected`: the server. */
     readonly server?: string;
+    /** With `credential_rejected` of the workload token: the gateway that refused it (#496). */
+    readonly gateway?: string;
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 }
@@ -136,27 +143,32 @@ export declare class McpCallFailed extends Error {
 }
 /**
  * A request the server answered `401` (R2b C1): it rejected the vault's credential, or wanted one
- * and got none. Never retried, since nothing the gate holds changes between tries (Q4). A tool
+ * and got none. Through a credential's `via`, also a gateway's answer reporting that the server
+ * behind it did (`gateway-outcomes.ts`, #495). Never retried, since nothing the gate holds changes between tries (Q4). A tool
  * call that meets it fails with `credential_rejected` for the model to see; at discovery it is the
  * server's `failed` diagnostic.
  */
 export declare class CredentialRejected extends McpCallFailed {
     readonly server: string;
-    /** Whether a credential of the session's Environment was sent. */
+    /** Whether a credential of the session's Agent was sent. */
     readonly sent: boolean;
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
     readonly challenge?: string | undefined;
+    /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
+    readonly gateway?: string | undefined;
     constructor(server: string, 
-    /** Whether a credential of the session's Environment was sent. */
+    /** Whether a credential of the session's Agent was sent. */
     sent: boolean, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
-    challenge?: string | undefined);
+    challenge?: string | undefined, 
+    /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
+    gateway?: string | undefined);
 }
 /**
  * A request its connection can no longer make, refused before it reached a tool: the server
@@ -180,12 +192,27 @@ export declare function unreachable(server: string, error: unknown, chars?: numb
  * so a server that reads it can run the call once.
  */
 export declare const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
+/** How a connection reaches its server through a gateway: the credential's routing. */
+export interface GatewayRouting {
+    /** Where the server's requests go (the credential's `via`). */
+    readonly via: string;
+    /** What the gateway puts before each tool name it lists (the credential's `toolPrefix`, #494). */
+    readonly toolPrefix?: string;
+}
+/**
+ * Where a `tools/list` page names the tools a gateway listed without the credential's
+ * `toolPrefix` (#494): kept under their listed names, for discovery's diagnostic.
+ */
+export declare const UNPREFIXED_TOOLS_META_KEY = "nylorun/unprefixed-tools";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
  * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
- * `_meta` (R5.5).
+ * `_meta` (R5.5). Through a `gateway`, an answer that reports the server refused the credential
+ * is `CredentialRejected`, as a `401` is (#495), and a gateway's `toolPrefix` is taken off the
+ * tools it lists and put back on the calls (#494): everything after this client names the
+ * server's own tools.
  */
-export declare function sdkClient(client: Client, serverName: string, errorChars: number): McpClient;
+export declare function sdkClient(client: Client, serverName: string, errorChars: number, gateway?: GatewayRouting): McpClient;
 export declare function openMcpServer(input: {
     server: McpServerManifest;
     authorize: (url: string) => Promise<AuthorizeResult>;
@@ -225,6 +252,8 @@ export declare function listMcpTools(client: McpClient, input: {
     omitted: string[];
     disabled: number;
     unknownTools: string[];
+    /** The tools a gateway listed without the credential's `toolPrefix`, as it named them (#494). */
+    unprefixed: string[];
 }>;
 /**
  * One tool call and what it came to. Rejects with `McpConnectionStale` when the connection must

package/dist/mcp/connect.js

@@ -7,6 +7,7 @@ import { MCP_TOOL_DEFAULTS, mcpToolSettings } from "@nylorun/core/define";
 import { scrub, scrubValues } from "../redact.js";
 import { guardedFetch, OutboundFailed, OutboundRefused, } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
+import { gatewayAuthFailure } from "./gateway-outcomes.js";
 import { hostTuning } from "../tuning.js";
 /** A tool call that failed with a code the model can act on (R2b C7). */
 export class McpCallFailed extends Error {
@@ -22,7 +23,7 @@ export class McpCallFailed extends Error {
     /** The failure the gate answered, as the class the loop's own call would have thrown. */
     static from(failure) {
         return failure.code === "credential_rejected" && failure.server !== undefined
-            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"))
+            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"), undefined, failure.gateway)
             : new McpCallFailed(failure);
     }
     /** The failed tool outcome the model sees. */
@@ -34,13 +35,15 @@ export class McpCallFailed extends Error {
             message: failure.message,
             retryable: failure.retryable,
             ...(failure.server === undefined ? {} : { server: failure.server }),
+            ...(failure.gateway === undefined ? {} : { gateway: failure.gateway }),
             ...(failure.redacted ? { redacted: failure.redacted } : {}),
         };
     }
 }
 /**
  * A request the server answered `401` (R2b C1): it rejected the vault's credential, or wanted one
- * and got none. Never retried, since nothing the gate holds changes between tries (Q4). A tool
+ * and got none. Through a credential's `via`, also a gateway's answer reporting that the server
+ * behind it did (`gateway-outcomes.ts`, #495). Never retried, since nothing the gate holds changes between tries (Q4). A tool
  * call that meets it fails with `credential_rejected` for the model to see; at discovery it is the
  * server's `failed` diagnostic.
  */
@@ -48,26 +51,33 @@ export class CredentialRejected extends McpCallFailed {
     server;
     sent;
     challenge;
+    gateway;
     constructor(server, 
-    /** Whether a credential of the session's Environment was sent. */
+    /** Whether a credential of the session's Agent was sent. */
     sent, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
-    challenge) {
+    challenge, 
+    /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
+    gateway) {
         super({
             code: "credential_rejected",
-            message: sent
-                ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Environment`
-                : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Environment holds none for it`,
+            message: gateway
+                ? `The gateway ${gateway} answered HTTP 401 for the MCP server '${server}': it rejected the Runtime's workload token`
+                : sent
+                    ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Agent`
+                    : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Agent holds none for it`,
             sent: true,
             retryable: false,
             server,
+            ...(gateway === undefined ? {} : { gateway }),
         });
         this.server = server;
         this.sent = sent;
         this.challenge = challenge;
+        this.gateway = gateway;
         this.name = "CredentialRejected";
     }
 }
@@ -121,17 +131,58 @@ function tracked(call, run, options) {
  * so a server that reads it can run the call once.
  */
 export const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
+/**
+ * Where a `tools/list` page names the tools a gateway listed without the credential's
+ * `toolPrefix` (#494): kept under their listed names, for discovery's diagnostic.
+ */
+export const UNPREFIXED_TOOLS_META_KEY = "nylorun/unprefixed-tools";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
  * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
- * `_meta` (R5.5).
+ * `_meta` (R5.5). Through a `gateway`, an answer that reports the server refused the credential
+ * is `CredentialRejected`, as a `401` is (#495), and a gateway's `toolPrefix` is taken off the
+ * tools it lists and put back on the calls (#494): everything after this client names the
+ * server's own tools.
  */
-export function sdkClient(client, serverName, errorChars) {
+export function sdkClient(client, serverName, errorChars, gateway) {
+    const prefix = gateway?.toolPrefix;
+    // The gateway may name the server by the prefix's stem (LiteLLM's `github-` for `github`).
+    const keys = prefix === undefined ? [serverName] : [serverName, prefix.replace(/[^A-Za-z0-9]+$/, "")];
+    const rejected = (answer) => gateway !== undefined && gatewayAuthFailure(answer, keys);
+    // The name the gateway listed for each tool, by the server's own name, and the names it listed
+    // without the prefix: a call sends the tool's name as the gateway listed it.
+    const listedAs = new Map();
+    const unprefixed = new Set();
+    const listedName = (name) => prefix === undefined || unprefixed.has(name) ? name : (listedAs.get(name) ?? `${prefix}${name}`);
+    const stripped = (page) => {
+        if (prefix === undefined)
+            return page;
+        const missing = [];
+        const tools = page.tools.map((tool) => {
+            if (typeof tool.name === "string" && tool.name.startsWith(prefix) && tool.name.length > prefix.length) {
+                const name = tool.name.slice(prefix.length);
+                listedAs.set(name, tool.name);
+                return { ...tool, name };
+            }
+            if (typeof tool.name === "string") {
+                unprefixed.add(tool.name);
+                missing.push(tool.name);
+            }
+            return tool;
+        });
+        return {
+            ...page,
+            tools,
+            ...(missing.length === 0 ? {} : { _meta: { ...page._meta, [UNPREFIXED_TOOLS_META_KEY]: missing } }),
+        };
+    };
     return {
         listTools: (params, options) => tracked(false, async (tracker) => {
             try {
                 const page = await client.listTools(params, options?.signal ? { signal: options.signal } : undefined);
-                return scrubbed(page, tracker);
+                if (rejected(page))
+                    throw new CredentialRejected(serverName, true);
+                return stripped(scrubbed(page, tracker));
             }
             catch (error) {
                 throw scrubError(error, tracker);
@@ -144,15 +195,18 @@ export function sdkClient(client, serverName, errorChars) {
             return tracked(true, async (tracker) => {
                 const lost = tracker.calling.signal;
                 try {
+                    const named = { ...params, name: listedName(params.name) };
                     const keyed = options?.key === undefined
-                        ? params
-                        : { ...params, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
+                        ? named
+                        : { ...named, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
                     const result = (await client.callTool(keyed, undefined, {
                         signal: options?.signal ? AbortSignal.any([options.signal, lost]) : lost,
                     }));
                     // An answer the stream did not count (an `sse` server answers on its event stream).
                     if (Buffer.byteLength(JSON.stringify(result)) > maxResultBytes)
                         throw tooLargeFailure(serverName, maxResultBytes);
+                    if (result.isError === true && rejected(result))
+                        throw new CredentialRejected(serverName, true);
                     const answer = scrubValues(result, [...tracker.secrets]);
                     return { result: answer.value, ...(answer.redacted > 0 ? { redacted: answer.redacted } : {}) };
                 }
@@ -202,8 +256,11 @@ export async function openMcpServer(input) {
             serverInfo: info ? scrubbed({ ...info }, tracker) : undefined,
         };
     }, { errorChars });
+    const gateway = initial.status === "authorized" && initial.via !== undefined
+        ? { via: initial.via, ...(initial.toolPrefix === undefined ? {} : { toolPrefix: initial.toolPrefix }) }
+        : undefined;
     return {
-        client: sdkClient(client, input.server.name, errorChars),
+        client: sdkClient(client, input.server.name, errorChars, gateway),
         ...(instructions === undefined ? {} : { instructions }),
         ...(serverInfo === undefined ? {} : { serverInfo }),
         close: () => client.close(),
@@ -227,11 +284,15 @@ export function serverInstructions(text, secrets) {
  */
 export async function listMcpTools(client, input) {
     const listed = [];
+    const unprefixed = [];
     let cursor;
     const pages = hostTuning().harness.mcpListPages;
     for (let page = 0; page < pages; page += 1) {
         const answer = await client.listTools(cursor ? { cursor } : undefined, input.signal ? { signal: input.signal } : undefined);
         listed.push(...answer.tools);
+        const missing = answer._meta?.[UNPREFIXED_TOOLS_META_KEY];
+        if (Array.isArray(missing))
+            unprefixed.push(...missing.filter((name) => typeof name === "string"));
         cursor = answer.nextCursor;
         if (!cursor)
             break;
@@ -267,7 +328,7 @@ export async function listMcpTools(client, input) {
             ...(annotations === undefined || Object.keys(annotations).length === 0 ? {} : { annotations }),
         });
     }
-    return { tools, omitted, disabled, unknownTools };
+    return { tools, omitted, disabled, unknownTools, unprefixed };
 }
 /**
  * One tool call and what it came to. Rejects with `McpConnectionStale` when the connection must
@@ -413,7 +474,7 @@ function authorizedFetch(server, endpoint, authorize, policy, errorChars) {
             tracker.sent = true;
         if (response.status === 401) {
             await response.body?.cancel().catch(() => undefined);
-            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined);
+            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined, result.status === "authorized" && result.workload ? endpoint.origin : undefined);
         }
         // The server ended the connection's session: the tool never saw the request.
         if (post && response.status === 404 && headers.has("mcp-session-id")) {

package/dist/mcp/gateway-outcomes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A gateway's report that the server behind it refused its credential (#495). A gateway that holds
+ * people's tokens may answer an upstream `401` with HTTP 200: LiteLLM lists no tools and names the
+ * outcome in the answer's `_meta`, and fails a tool call with `isError` and the upstream error's
+ * text. Only answers that came through a credential's `via` are read so: a server the Runtime talks
+ * to directly says `401` itself.
+ */
+/** The names a gateway may give the server under: the manifest's first, then any others. */
+export type GatewayServerKeys = readonly string[];
+/**
+ * Whether a `tools/list` page or a `tools/call` result reports that the server behind the
+ * gateway refused the credential. A call's text is read only when the result is an error.
+ */
+export declare function gatewayAuthFailure(answer: unknown, keys: GatewayServerKeys): boolean;

package/dist/mcp/gateway-outcomes.js

@@ -0,0 +1,46 @@
+/**
+ * A gateway's report that the server behind it refused its credential (#495). A gateway that holds
+ * people's tokens may answer an upstream `401` with HTTP 200: LiteLLM lists no tools and names the
+ * outcome in the answer's `_meta`, and fails a tool call with `isError` and the upstream error's
+ * text. Only answers that came through a credential's `via` are read so: a server the Runtime talks
+ * to directly says `401` itself.
+ */
+/** LiteLLM's outcome per server it reached: `{ status: "auth_required", http_status: 401 }`. */
+const LITELLM_SERVER_OUTCOMES = "litellm.ai/server_outcomes";
+/** LiteLLM's text for a tool call the upstream server answered `401` (httpx's error message). */
+const LITELLM_UNAUTHORIZED_TEXT = /HTTPStatusError: Client error '401 Unauthorized'/;
+/**
+ * Whether a `tools/list` page or a `tools/call` result reports that the server behind the
+ * gateway refused the credential. A call's text is read only when the result is an error.
+ */
+export function gatewayAuthFailure(answer, keys) {
+    if (!isRecord(answer))
+        return false;
+    const outcome = serverOutcome(answer._meta, keys);
+    if (outcome && (outcome.status === "auth_required" || outcome.http_status === 401))
+        return true;
+    return answer.isError === true && LITELLM_UNAUTHORIZED_TEXT.test(textOf(answer.content));
+}
+/** The gateway's outcome for this server: the entry one of `keys` names, else the only entry. */
+function serverOutcome(meta, keys) {
+    if (!isRecord(meta))
+        return undefined;
+    const outcomes = meta[LITELLM_SERVER_OUTCOMES];
+    if (!isRecord(outcomes))
+        return undefined;
+    for (const key of keys)
+        if (isRecord(outcomes[key]))
+            return outcomes[key];
+    const entries = Object.values(outcomes);
+    return entries.length === 1 && isRecord(entries[0]) ? entries[0] : undefined;
+}
+function textOf(content) {
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => (isRecord(part) && typeof part.text === "string" ? part.text : ""))
+        .join("\n");
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/dist/mcp/pool.js

@@ -52,6 +52,11 @@ export class McpPool {
                         ...(listed.unknownTools.length === 0
                             ? []
                             : [`Its tools settings name tools it does not list: ${listed.unknownTools.join(", ")}`]),
+                        ...(listed.unprefixed.length === 0
+                            ? []
+                            : [
+                                `${listed.unprefixed.length} of its tools lack the gateway's tool prefix and keep the names it listed: ${listed.unprefixed.join(", ")}`,
+                            ]),
                         ...(tooLong
                             ? [
                                 `Its instructions are ${Buffer.byteLength(text)} bytes, more than a record entry holds (the Runtime limit recordEntryBytes, ${input.maxInstructionBytes} bytes), and are left out`,

package/dist/model/call-headers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A custom endpoint's per-call headers (#493): each `callHeaders` entry's value, from the calling
+ * Agent, for a gateway that attributes or budgets each call, such as by the Agent's `org` label.
+ * A source with no value (a missing or empty label, a session whose owner is no person) sends no
+ * header, never an empty one.
+ */
+import type { ModelCallHeaderSource } from "@nylorun/core/contracts";
+/** What a model call knows of who makes it, read for the call. */
+export interface ModelCaller {
+    readonly agentId: string;
+    readonly labels: Readonly<Record<string, string>>;
+    /** The session's owner, when it is a person. */
+    readonly owner?: string;
+}
+export declare function callHeaders(sources: Readonly<Record<string, ModelCallHeaderSource>>, caller: ModelCaller): Record<string, string>;

package/dist/model/call-headers.js

@@ -0,0 +1,9 @@
+export function callHeaders(sources, caller) {
+    const headers = {};
+    for (const [name, source] of Object.entries(sources)) {
+        const value = source.from === "agent.label" ? caller.labels[source.key] : source.from === "agent.id" ? caller.agentId : caller.owner;
+        if (value)
+            headers[name] = value;
+    }
+    return headers;
+}

package/dist/model/models.d.ts

@@ -1,4 +1,5 @@
 import { type AuthContext, type CredentialStore } from "@earendil-works/pi-ai";
+import { type ModelCallHeaderSource } from "@nylorun/core/contracts";
 export type Selection = Readonly<{
     provider: string;
     model: string;
@@ -11,6 +12,10 @@ export type Selection = Readonly<{
         /** What the endpoint reads (protocol 12); text only unless it says so. */
         inputs?: readonly string[];
         compat?: Readonly<Record<string, unknown>>;
+        /** Sent on every call (#493). */
+        headers?: Readonly<Record<string, string>>;
+        /** Resolved per call from the calling Agent (`call-headers.ts`, #493). */
+        callHeaders?: Readonly<Record<string, ModelCallHeaderSource>>;
     }>;
 }>;
 /**
@@ -20,4 +25,6 @@ export type Selection = Readonly<{
 export declare function modelsFor(selection: Selection, credentials: CredentialStore, options?: {
     environment?: boolean;
     authContext?: AuthContext;
+    /** A custom endpoint's bearer read at each request instead of a stored key: the workload token (#496). */
+    bearer?: () => Promise<string>;
 }): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -30,6 +30,7 @@ export function modelsFor(selection, credentials, options = {}) {
         ...(selection.custom.compat
             ? { compat: { ...selection.custom.compat } }
             : {}),
+        ...(selection.custom.headers ? { headers: { ...selection.custom.headers } } : {}),
     };
     models.setProvider(createProvider({
         id: "custom",
@@ -39,6 +40,8 @@ export function modelsFor(selection, credentials, options = {}) {
             apiKey: {
                 name: "Custom API key",
                 async resolve() {
+                    if (options.bearer)
+                        return { type: "api_key", auth: { apiKey: await options.bearer() } };
                     const credential = await credentials.read("custom");
                     if (!credential || credential.type !== "api_key")
                         return undefined;

package/dist/model/pi-model.d.ts

@@ -3,6 +3,7 @@ import type { RuntimeModelAdapter } from "../contracts.js";
 import { type RuntimeLimits } from "@nylorun/core/contracts";
 import { type FileResolver } from "../artifacts/files.js";
 import type { HostModelSecret } from "../vault/service.js";
+import { type ModelCaller } from "./call-headers.js";
 export interface ModelPreview {
     readonly invocationId: string;
     readonly text: string;
@@ -39,6 +40,11 @@ export interface PiModelOptions {
     readonly readHostModel?: () => HostModelSecret | undefined | Promise<HostModelSecret | undefined>;
     readonly writeHostCredential?: (credential: Credential) => void | Promise<void>;
     readonly settings?: ModelCallSettings;
+    /**
+     * Who makes the call: read only when the custom endpoint has `callHeaders` (#493), whose values
+     * come from it. Without it, a call sends none of them.
+     */
+    readonly caller?: () => Promise<ModelCaller | undefined>;
 }
 /**
  * Node model adapter. Local provider configuration is read only when invoked.

package/dist/model/pi-model.js

@@ -7,6 +7,8 @@ import { scrub } from "../redact.js";
 import { classifyAssistantError, failure } from "./classify.js";
 import { addedInputsOf, describeModel, selectionOf } from "./descriptor.js";
 import { modelsFor } from "./models.js";
+import { callHeaders } from "./call-headers.js";
+import { workloadToken, WorkloadTokenUnavailable } from "../vault/workload-token.js";
 import { NativeBlocks, nativeKindsOf } from "./native-blocks.js";
 import { projectSecrets } from "./settings.js";
 /** The model call settings the Runtime limits `limits` set. */
@@ -53,16 +55,37 @@ export function piModel(options = {}) {
         const stored = await options.readHostModel?.();
         if (!stored)
             return failure("auth", "Model provider is not configured. Set it in Studio, or run nylorun tenant models set.", false);
+        // The workload token (#496): read from its file now and at each request, never stored.
+        let workload;
+        if (stored.authType === "workload") {
+            try {
+                workload = await workloadToken();
+            }
+            catch (error) {
+                if (error instanceof WorkloadTokenUnavailable)
+                    return failure("auth", error.message, false);
+                throw error;
+            }
+        }
         const secrets = [
             ...projectSecrets(root),
             ...credentialSecrets(stored.credential),
+            ...(workload === undefined ? [] : [workload]),
         ];
         const redacted = (outcome) => ({
             ...outcome,
             message: String(scrub(outcome.message, secrets)),
         });
         const selection = selectionOf(stored, call.model?.id);
-        const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), { environment: false, authContext: noAmbientAuth });
+        // A custom endpoint's per-call headers (#493), from the calling Agent; static ones are the model's.
+        const sources = selection.custom?.callHeaders;
+        const caller = sources && options.caller ? await options.caller() : undefined;
+        const perCall = sources && caller ? callHeaders(sources, caller) : {};
+        const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), {
+            environment: false,
+            authContext: noAmbientAuth,
+            ...(workload === undefined ? {} : { bearer: workloadToken }),
+        });
         const found = registry.getModel(selection.provider, selection.model);
         if (!found)
             return failure("invalid_request", "Unknown model. Run nylorun tenant models set.", false);
@@ -95,6 +118,7 @@ export function piModel(options = {}) {
             // The session id keys the provider's prompt cache and session affinity.
             sessionId: call.executionId,
             cacheRetention: "short",
+            ...(Object.keys(perCall).length > 0 ? { headers: perCall } : {}),
             timeoutMs: settings.requestTimeoutMs,
             maxRetries: settings.providerRetries,
             maxRetryDelayMs: settings.maxRetryDelayMs,
@@ -225,6 +249,13 @@ export function piModel(options = {}) {
                     // pi-ai initializes missing counters to zero; reporting provenance is unknown.
                     tokensReported: null,
                     costKnown: !selection.custom,
+                    // The cost by token kind, at the catalog's prices: the usage ledger keeps it.
+                    costSplit: {
+                        input: response.usage.cost.input,
+                        cacheRead: response.usage.cost.cacheRead,
+                        cacheWrite: response.usage.cost.cacheWrite,
+                        output: response.usage.cost.output,
+                    },
                     producer: {
                         provider: selected.provider,
                         api: selected.api,
@@ -474,14 +505,16 @@ function idleTimeout(selected, idleTimeoutMs) {
 }
 function hostCredentialStore(stored, write) {
     let current = stored.credential;
+    // A workload model stores no credential: pi-ai then asks the provider's `resolve` (`modelsFor`).
+    const stores = stored.authType !== "workload";
     return {
         async read(providerId) {
-            if (providerId !== stored.provider)
+            if (providerId !== stored.provider || !stores)
                 return undefined;
             return current;
         },
         async list() {
-            return [{ providerId: stored.provider, type: current.type }];
+            return stores ? [{ providerId: stored.provider, type: current.type }] : [];
         },
         async modify(providerId, fn) {
             if (providerId !== stored.provider)