@nylorun/runtime 0.28.0-beta → 0.30.0-beta

package/dist/store/postgres/drizzle/0037_model_usage_cost_split.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "cost_input_usd" double precision;--> statement-breakpoint
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "cost_cache_read_usd" double precision;--> statement-breakpoint
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "cost_cache_write_usd" double precision;--> statement-breakpoint
+ALTER TABLE "nylorun"."model_usage" ADD COLUMN "cost_output_usd" double precision;

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -260,6 +260,13 @@
       "when": 1792172016681,
       "tag": "0036_t5_memories",
       "breakpoints": true
+    },
+    {
+      "idx": 37,
+      "version": "7",
+      "when": 1792238141315,
+      "tag": "0037_model_usage_cost_split",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/reads.js

@@ -32,6 +32,18 @@ function grantsWhere(column, grants) {
 function accessWhere(access) {
     return and(access.owner === undefined ? undefined : eq(sessions.ownerUserId, access.owner), access.agents === undefined ? undefined : grantsWhere(sessions.agentId, access.agents));
 }
+/** A row's cost by token kind, when the adapter kept it (migration 0037). */
+function costSplitOf(row) {
+    const { costInputUsd, costCacheReadUsd, costCacheWriteUsd, costOutputUsd } = row;
+    if (costInputUsd === null || costCacheReadUsd === null || costCacheWriteUsd === null || costOutputUsd === null)
+        return null;
+    return {
+        input: costInputUsd,
+        cacheRead: costCacheReadUsd,
+        cacheWrite: costCacheWriteUsd,
+        output: costOutputUsd,
+    };
+}
 function publicCall(row) {
     return {
         id: row.id,
@@ -42,6 +54,8 @@ function publicCall(row) {
         provider: row.provider,
         model: row.model,
         at: row.createdAt,
+        startedAt: row.startedAt,
+        endedAt: row.endedAt,
         outcome: "completed",
         usage: {
             inputTokens: row.inputTokens,
@@ -54,6 +68,7 @@ function publicCall(row) {
             duplicate: row.duplicate,
             tokensReported: row.tokensReported,
             costKnown: row.costKnown,
+            costSplit: costSplitOf(row),
         },
     };
 }
@@ -225,11 +240,26 @@ export function createPostgresReadStore(source, tenantId) {
                 unpricedCalls: sql `count(*) filter (where ${modelUsage.costKnown} = false)`.mapWith(Number),
                 unreportedCalls: sql `count(*) filter (where ${modelUsage.tokensReported} = false)`.mapWith(Number),
                 unknownQualityCalls: sql `count(*) filter (where ${modelUsage.tokensReported} is null or ${modelUsage.costKnown} is null)`.mapWith(Number),
+                costInput: sum(modelUsage.costInputUsd),
+                costCacheRead: sum(modelUsage.costCacheReadUsd),
+                costCacheWrite: sum(modelUsage.costCacheWriteUsd),
+                costOutput: sum(modelUsage.costOutputUsd),
+                splitCalls: sql `count(${modelUsage.costInputUsd})`.mapWith(Number),
+                // The gate's timing is ISO text; a row timed before migration 0022 has none.
+                modelTimeMs: sql `coalesce(round(sum(extract(epoch from (${modelUsage.endedAt}::timestamptz - ${modelUsage.startedAt}::timestamptz)) * 1000)), 0)`.mapWith(Number),
+                timedCalls: sql `count(*) filter (where ${modelUsage.startedAt} is not null and ${modelUsage.endedAt} is not null)`.mapWith(Number),
             })
                 .from(modelUsage)
                 .where(and(eq(modelUsage.sessionId, id), turnId === undefined ? undefined : eq(modelUsage.turnId, turnId)));
+            const { costInput, costCacheRead, costCacheWrite, costOutput, ...rest } = totals;
             return {
-                ...totals,
+                ...rest,
+                costSplit: {
+                    input: costInput,
+                    cacheRead: costCacheRead,
+                    cacheWrite: costCacheWrite,
+                    output: costOutput,
+                },
                 sessionId: id,
                 turnId: turnId ?? null,
                 asOf: new Date().toISOString(),

package/dist/store/postgres/schema.d.ts

@@ -1793,7 +1793,7 @@ export declare const agentTriggers: import("drizzle-orm/pg-core").PgTableWithCol
 }>;
 /**
  * An Agent's memories (track T5, D72): one row per Markdown file under `/memories`, its content
- * inline (the Runtime limit `memoryBytes`, 100 KB by default, bounds it). `version` counts the
+ * inline (the Runtime limit `memoryBytes`, 100 KiB by default, bounds it). `version` counts the
  * changes to this path; `description` is its frontmatter's, for the pinned index. A write locks the
  * one row it changes, so writes to different memories never wait on each other.
  */
@@ -2737,14 +2737,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
+            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model" | "workload";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
+            enumValues: ["bearer", "headers", "workload", "environment_secret", "environment_variable", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -3401,7 +3401,8 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
  * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
  * when the provider sent none. `startedAt`, `endedAt` and `firstTokenMs` are the gate's own
  * timing of the call (R7.1, migration 0022); null on rows written before, and `firstTokenMs`
- * when the provider streamed nothing.
+ * when the provider streamed nothing. The `cost*Usd` columns split `costUsd` by token kind, at the
+ * prices the adapter applied (migration 0037); null on rows written before.
  */
 export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "model_usage";
@@ -3793,6 +3794,74 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        costInputUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costInputUsd";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgDoublePrecision";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        costCacheReadUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costCacheReadUsd";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgDoublePrecision";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        costCacheWriteUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costCacheWriteUsd";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgDoublePrecision";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        costOutputUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costOutputUsd";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgDoublePrecision";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: 'pg';
 }>;
@@ -5656,10 +5725,14 @@ export type EnvironmentRowColumns = typeof agents.$inferSelect;
 export type ArtifactRow = typeof artifacts.$inferSelect;
 export type ArtifactVersionRow = typeof artifactVersions.$inferSelect;
 export type DefinitionFileRow = typeof definitionFiles.$inferSelect;
-export type ModelUsageWrite = Omit<ModelUsageRow, "duplicate" | "txid" | "tokensReported" | "costKnown" | "startedAt" | "endedAt" | "firstTokenMs"> & {
+export type ModelUsageWrite = Omit<ModelUsageRow, "duplicate" | "txid" | "tokensReported" | "costKnown" | "startedAt" | "endedAt" | "firstTokenMs" | "costInputUsd" | "costCacheReadUsd" | "costCacheWriteUsd" | "costOutputUsd"> & {
     tokensReported?: boolean | null;
     costKnown?: boolean | null;
     startedAt?: string | null;
     endedAt?: string | null;
     firstTokenMs?: number | null;
+    costInputUsd?: number | null;
+    costCacheReadUsd?: number | null;
+    costCacheWriteUsd?: number | null;
+    costOutputUsd?: number | null;
 };

package/dist/store/postgres/schema.js

@@ -251,7 +251,7 @@ export const agentTriggers = nylorun.table("agent_triggers", {
 ]);
 /**
  * An Agent's memories (track T5, D72): one row per Markdown file under `/memories`, its content
- * inline (the Runtime limit `memoryBytes`, 100 KB by default, bounds it). `version` counts the
+ * inline (the Runtime limit `memoryBytes`, 100 KiB by default, bounds it). `version` counts the
  * changes to this path; `description` is its frontmatter's, for the pinned index. A write locks the
  * one row it changes, so writes to different memories never wait on each other.
  */
@@ -353,7 +353,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "headers", "environment_secret", "environment_variable", "model"] }).notNull(),
+    type: text({ enum: ["bearer", "headers", "workload", "environment_secret", "environment_variable", "model"] }).notNull(),
     /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),
@@ -425,7 +425,8 @@ export const signingKeys = nylorun.table("signing_keys", {
  * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
  * when the provider sent none. `startedAt`, `endedAt` and `firstTokenMs` are the gate's own
  * timing of the call (R7.1, migration 0022); null on rows written before, and `firstTokenMs`
- * when the provider streamed nothing.
+ * when the provider streamed nothing. The `cost*Usd` columns split `costUsd` by token kind, at the
+ * prices the adapter applied (migration 0037); null on rows written before.
  */
 export const modelUsage = nylorun.table("model_usage", {
     id: textC().primaryKey(),
@@ -459,6 +460,14 @@ export const modelUsage = nylorun.table("model_usage", {
     endedAt: text(),
     /** From `startedAt` to the provider's first stream event. */
     firstTokenMs: integer(),
+    /** What the uncached input cost. */
+    costInputUsd: doublePrecision(),
+    /** What the input read from the provider's cache cost. */
+    costCacheReadUsd: doublePrecision(),
+    /** What the input written to the provider's cache cost. */
+    costCacheWriteUsd: doublePrecision(),
+    /** What the output cost. */
+    costOutputUsd: doublePrecision(),
 }, (t) => [
     index("model_usage_session").on(t.sessionId, t.createdAt, t.id),
     index("model_usage_export").on(t.txid, t.id),

package/dist/tenant/agents.js

@@ -562,15 +562,19 @@ async function parseSecretRequest(ctx, id, name, raw) {
     const full = slotRequest(slot);
     if (raw !== null && typeof raw === "object" && "type" in raw) {
         const body = PutAgentSecretRequestSchema.parse(raw);
-        const { requestId: _, value: _v, headers: _h, ...binding } = body;
+        // The gateway's tool prefix is this installation's to add (`gateway-credentials`).
+        const { requestId: _, value: _v, headers: _h, toolPrefix: _p, ...binding } = body;
         if (canonical(binding) !== canonical(full))
             fail(409, `Secret ${name}'s type and binding come from Agent ${id}'s manifest: send only its value ({ "value": "…" }).`, {
                 code: "secret_not_in_manifest",
             });
         return body;
     }
-    const { requestId, value, headers } = PutAgentSecretValueRequestSchema.parse(raw);
-    const withId = requestId === undefined ? {} : { requestId };
+    const { requestId, value, headers, toolPrefix } = PutAgentSecretValueRequestSchema.parse(raw);
+    const withId = {
+        ...(requestId === undefined ? {} : { requestId }),
+        ...(toolPrefix === undefined ? {} : { toolPrefix }),
+    };
     if (slot.type === "headers") {
         if (headers === undefined)
             fail(400, `Secret ${name} is a headers credential: send { "headers": { … } }.`);

package/dist/tenant/transcript.d.ts

@@ -186,6 +186,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -208,6 +209,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -230,6 +232,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -252,6 +255,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -344,6 +348,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -368,6 +373,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -392,6 +398,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -416,6 +423,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;

package/dist/tenant/transcript.js

@@ -151,6 +151,8 @@ export function toolCompleted(request, value, facts) {
                 message: String(outcome.message ?? ""),
                 // `credential_rejected` (R2b C1): which server.
                 ...(typeof outcome.server === "string" ? { server: outcome.server } : {}),
+                // And the gateway that refused the Runtime's workload token (#496).
+                ...(typeof outcome.gateway === "string" ? { gateway: outcome.gateway } : {}),
                 ...(typeof outcome.retryable === "boolean" ? { retryable: outcome.retryable } : {}),
             },
         }

package/dist/tenant/types.d.ts

@@ -74,6 +74,11 @@ export interface TenantConfig {
      * the identity file (`NYLORUN_IDENTITY_FILE`). Absent: none.
      */
     issuers?: import("./issuers.js").TrustedIssuers;
+    /**
+     * The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`, no trailing slash): the base
+     * of webhook URLs and the OAuth resource. Absent: the origin each request reached.
+     */
+    publicUrl?: string;
     logger: Logger;
 }
 export interface Logger {

package/dist/vault/headers.d.ts

@@ -1,3 +1,11 @@
+/** Headers that describe one hop and are never forwarded or set by a credential or a setting. */
+export declare const HOP_BY_HOP_HEADERS: ReadonlySet<string>;
+/**
+ * Why a custom model endpoint's header (`settings.headers`, `settings.callHeaders`, #493) may not
+ * be `name`, or undefined when it may: the API key's `authorization`, a hop-by-hop header, a
+ * transport header or `Nylorun-*`.
+ */
+export declare function modelHeaderError(name: string): string | undefined;
 /**
  * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
  * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names

package/dist/vault/headers.js

@@ -18,6 +18,31 @@ const RESERVED_HEADERS = new Set([
     "last-event-id",
     "idempotency-key",
 ]);
+/** Headers that describe one hop and are never forwarded or set by a credential or a setting. */
+export const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/**
+ * Why a custom model endpoint's header (`settings.headers`, `settings.callHeaders`, #493) may not
+ * be `name`, or undefined when it may: the API key's `authorization`, a hop-by-hop header, a
+ * transport header or `Nylorun-*`.
+ */
+export function modelHeaderError(name) {
+    const lower = name.toLowerCase();
+    if (lower === "authorization")
+        return "A model header may not set authorization: the model's auth sends it";
+    if (HOP_BY_HOP_HEADERS.has(lower) || isReservedHeader(lower))
+        return `A model header may not set ${lower}`;
+    return undefined;
+}
 /**
  * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
  * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names

package/dist/vault/host-model.js

@@ -24,11 +24,14 @@ export class HostModelVault {
         const payload = readHostPayload(this.kek(), row, binding);
         const credential = binding.authType === "oauth"
             ? { type: "oauth", ...payload.oauth }
-            : {
-                type: "api_key",
-                key: payload.apiKey,
-                ...(payload.env ? { env: payload.env } : {}),
-            };
+            : binding.authType === "workload"
+                ? // The workload token is read from its file at each call (#496), never stored.
+                    { type: "workload" }
+                : {
+                    type: "api_key",
+                    key: payload.apiKey,
+                    ...(payload.env ? { env: payload.env } : {}),
+                };
         return {
             provider: binding.provider,
             model: binding.model,

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -10,9 +10,9 @@ export type HostModelSecret = {
     settings?: CustomModelSettings;
     /** The inputs the operator added to catalog models, by `<provider>/<model>` (protocol 12). */
     addedInputs?: Readonly<Record<string, readonly ModelInput[]>>;
-    authType: "api_key" | "oauth";
+    authType: HostModelAuthType;
     credential: {
-        type: "api_key" | "oauth";
+        type: HostModelAuthType;
         key?: string;
         env?: Record<string, string>;
         refresh?: string;
@@ -22,7 +22,7 @@ export type HostModelSecret = {
     };
 };
 type UserCredentialRow = VaultCredentialRow & {
-    type: "bearer" | "headers" | "environment_secret" | "environment_variable";
+    type: "bearer" | "headers" | "workload" | "environment_secret" | "environment_variable";
 };
 /**
  * A fork's secrets sealed for its new vault (`sealEnvironmentSecretCopies`): each copy's
@@ -54,6 +54,13 @@ export type AuthorizeResult = {
     headers: Record<string, string>;
     /** Where the request goes instead of `url` (a gateway), when the credential has one. */
     via?: string;
+    /** How the gateway at `via` prefixes the server's tool names, when it does. */
+    toolPrefix?: string;
+    /**
+     * A `workload` credential (#496): `sessionCredentials` adds the Runtime's workload token as
+     * the bearer, on the gate side, where `via`'s origin is one the operator lists.
+     */
+    workload?: true;
     /** The header that names the session owner; `sessionCredentials` adds it. */
     identity?: CredentialIdentity;
 } | {
@@ -195,7 +202,7 @@ type ModelBinding = {
     model: string;
     baseUrl?: string;
     settings?: CustomModelSettings;
-    authType: "api_key" | "oauth";
+    authType: HostModelAuthType;
 };
 type HostSecretPayload = {
     apiKey?: string;

package/dist/vault/service.js

@@ -83,7 +83,7 @@ import { canonical } from "../store/canonical.js";
 import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { credentialNeeds } from "./coverage.js";
-import { checkCredentialHeaders } from "./headers.js";
+import { checkCredentialHeaders, modelHeaderError } from "./headers.js";
 import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
 import { inputsError } from "../model/capabilities.js";
 import { readAddedInputs } from "../tenant/model-setting.js";
@@ -247,7 +247,8 @@ export class VaultService {
             ({ payload, binding } = environmentCredential(name, body));
         else {
             const url = normalizeVaultUrl(body.url);
-            payload = payloadOf(body);
+            // A workload credential holds no value: the bearer is the Runtime's workload token (#496).
+            payload = body.type === "workload" ? {} : payloadOf(body);
             binding = bindingOf(url, payload, body);
         }
         const kek = this.kek();
@@ -466,6 +467,8 @@ export class VaultService {
             url,
             headers,
             ...(binding.via === undefined ? {} : { via: binding.via }),
+            ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+            ...(row.type === "workload" ? { workload: true } : {}),
             ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         };
     }
@@ -541,15 +544,20 @@ export class VaultService {
         const kek = this.kek();
         return this.store.tx((t) => this.replay(t, `host-model:${body.idempotencyKey}`, body, async () => {
             this.validateHostModel(body);
+            if (body.auth.type === "workload" && body.provider !== "custom")
+                throw new VaultError(400, "The workload token authenticates a custom provider only.");
             await this.ensureHostVault(t);
             const credentialId = hostModelCredentialId(body.provider);
             await this.deleteHostProviderRows(t, body.provider);
+            // The workload token is read on every call and never stored (#496).
             const payload = body.auth.type === "api_key"
                 ? {
                     apiKey: body.auth.key,
                     ...(body.auth.env ? { env: body.auth.env } : {}),
                 }
-                : { oauth: body.auth };
+                : body.auth.type === "oauth"
+                    ? { oauth: body.auth }
+                    : {};
             await this.insertHostCredential(t, kek, {
                 id: credentialId,
                 provider: body.provider,
@@ -673,6 +681,7 @@ export class VaultService {
             }
             if (!["http:", "https:"].includes(url.protocol))
                 throw new VaultError(400, "Base URL must be an HTTP(S) URL.");
+            checkModelHeaders(body.settings);
             return;
         }
         if (body.baseUrl)
@@ -800,8 +809,9 @@ function conflictOf(type, binding, others) {
                 });
         }
     }
-    else if (type === "bearer" || type === "headers") {
-        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers") && credentialBinding(row).url === binding.url);
+    else if (type === "bearer" || type === "headers" || type === "workload") {
+        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers" || row.type === "workload") &&
+            credentialBinding(row).url === binding.url);
         if (existing)
             throw new VaultError(409, `${existing.name} is already bound to ${binding.url}`, {
                 code: "credential_conflict",
@@ -828,6 +838,7 @@ function secretViewOf(row) {
                 : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
         ...(binding.via === undefined ? {} : { via: binding.via }),
+        ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
@@ -909,6 +920,23 @@ export function readHostPayload(kek, row, binding) {
         plaintext.fill(0);
     }
 }
+/**
+ * A custom endpoint's `headers` and `callHeaders` (#493): no name the model's auth or the
+ * transport sets, and each name once across both maps, whatever its case.
+ */
+function checkModelHeaders(settings) {
+    const names = [...Object.keys(settings?.headers ?? {}), ...Object.keys(settings?.callHeaders ?? {})];
+    const seen = new Set();
+    for (const name of names) {
+        const refused = modelHeaderError(name);
+        if (refused)
+            throw new VaultError(400, refused);
+        const lower = name.toLowerCase();
+        if (seen.has(lower))
+            throw new VaultError(400, `The model header ${lower} is set twice`);
+        seen.add(lower);
+    }
+}
 /** The sealed part of a tool credential: a token, or a header map with lower-cased names. */
 function payloadOf(auth) {
     if (auth.type === "bearer")
@@ -924,12 +952,16 @@ function bindingOf(url, payload, routing) {
     return {
         url,
         ...(routing.via ? { via: routing.via } : {}),
+        ...(routing.via && routing.toolPrefix ? { toolPrefix: routing.toolPrefix } : {}),
         ...(routing.identity ? { identity: { header: routing.identity.header.toLowerCase() } } : {}),
         ...(payload.headers ? { headerNames: sent } : {}),
     };
 }
 /** The headers a credential sends, or undefined when its payload holds none. */
 function sendHeaders(row, payload) {
+    // Its bearer is the Runtime's workload token, which `sessionCredentials` adds.
+    if (row.type === "workload")
+        return {};
     if (row.type === "headers")
         return payload.headers && Object.keys(payload.headers).length > 0
             ? { ...payload.headers }
@@ -999,7 +1031,12 @@ function rebind(name, slot, row, payload, binding) {
             return undefined;
         const sealed = payloadOf(auth);
         const routing = slot;
-        return { type, payload: sealed, binding: bindingOf(normalizeVaultUrl(routing.url), sealed, routing) };
+        // The gateway's tool prefix is the vault's, not the slot's: it stays while the slot keeps `via`.
+        return {
+            type,
+            payload: sealed,
+            binding: bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, toolPrefix: binding.toolPrefix ?? null }),
+        };
     }
     catch (error) {
         if (error instanceof VaultError)

package/dist/vault/sources.js

@@ -8,6 +8,7 @@
  * and Tool Gate). The session comes from its row, never from the harness.
  */
 import { isSubject } from "@nylorun/core/contracts";
+import { workloadOriginRefused, workloadToken, WorkloadTokenUnavailable } from "./workload-token.js";
 /**
  * The credential of one request made for `session`: the answer of its Environment's vault
  * (`VaultService.authorize`). A credential with an identity header (R2b C2)
@@ -16,11 +17,12 @@ import { isSubject } from "@nylorun/core/contracts";
  * person (the reserved `installation`) sends none (Q3).
  */
 export async function sessionCredentials(vault, session, request) {
-    const result = await vault.authorize({
+    const authorized = await vault.authorize({
         sessionId: session.id,
         ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
         url: request.url,
     });
+    const result = authorized.status === "authorized" && authorized.workload ? await withWorkloadToken(authorized) : authorized;
     if (result.status !== "authorized" || !result.identity || !isSubject(session.ownerUserId))
         return result;
     return {
@@ -28,3 +30,22 @@ export async function sessionCredentials(vault, session, request) {
         headers: { ...result.headers, [result.identity.header]: session.ownerUserId },
     };
 }
+/**
+ * A `workload` credential's request with the Runtime's workload token as its bearer, read now
+ * (#496), or refused: when `via`'s origin is not one the operator lists, or the token cannot be
+ * read. Never sent without it.
+ */
+async function withWorkloadToken(result) {
+    const refused = (reason) => ({ status: "refused", url: result.url, credentialIds: [], reason });
+    const origin = result.via === undefined ? "a workload credential needs via" : workloadOriginRefused(result.via);
+    if (origin !== undefined)
+        return refused(origin);
+    try {
+        return { ...result, headers: { ...result.headers, authorization: `Bearer ${await workloadToken()}` } };
+    }
+    catch (error) {
+        if (error instanceof WorkloadTokenUnavailable)
+            return refused(error.message);
+        throw error;
+    }
+}