@nylorun/runtime 0.29.0-beta → 0.30.0-beta

package/dist/mcp/connect.js

@@ -7,6 +7,7 @@ import { MCP_TOOL_DEFAULTS, mcpToolSettings } from "@nylorun/core/define";
 import { scrub, scrubValues } from "../redact.js";
 import { guardedFetch, OutboundFailed, OutboundRefused, } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
+import { gatewayAuthFailure } from "./gateway-outcomes.js";
 import { hostTuning } from "../tuning.js";
 /** A tool call that failed with a code the model can act on (R2b C7). */
 export class McpCallFailed extends Error {
@@ -22,7 +23,7 @@ export class McpCallFailed extends Error {
     /** The failure the gate answered, as the class the loop's own call would have thrown. */
     static from(failure) {
         return failure.code === "credential_rejected" && failure.server !== undefined
-            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"))
+            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"), undefined, failure.gateway)
             : new McpCallFailed(failure);
     }
     /** The failed tool outcome the model sees. */
@@ -34,13 +35,15 @@ export class McpCallFailed extends Error {
             message: failure.message,
             retryable: failure.retryable,
             ...(failure.server === undefined ? {} : { server: failure.server }),
+            ...(failure.gateway === undefined ? {} : { gateway: failure.gateway }),
             ...(failure.redacted ? { redacted: failure.redacted } : {}),
         };
     }
 }
 /**
  * A request the server answered `401` (R2b C1): it rejected the vault's credential, or wanted one
- * and got none. Never retried, since nothing the gate holds changes between tries (Q4). A tool
+ * and got none. Through a credential's `via`, also a gateway's answer reporting that the server
+ * behind it did (`gateway-outcomes.ts`, #495). Never retried, since nothing the gate holds changes between tries (Q4). A tool
  * call that meets it fails with `credential_rejected` for the model to see; at discovery it is the
  * server's `failed` diagnostic.
  */
@@ -48,6 +51,7 @@ export class CredentialRejected extends McpCallFailed {
     server;
     sent;
     challenge;
+    gateway;
     constructor(server, 
     /** Whether a credential of the session's Agent was sent. */
     sent, 
@@ -55,19 +59,25 @@ export class CredentialRejected extends McpCallFailed {
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
-    challenge) {
+    challenge, 
+    /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
+    gateway) {
         super({
             code: "credential_rejected",
-            message: sent
-                ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Agent`
-                : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Agent holds none for it`,
+            message: gateway
+                ? `The gateway ${gateway} answered HTTP 401 for the MCP server '${server}': it rejected the Runtime's workload token`
+                : sent
+                    ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Agent`
+                    : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Agent holds none for it`,
             sent: true,
             retryable: false,
             server,
+            ...(gateway === undefined ? {} : { gateway }),
         });
         this.server = server;
         this.sent = sent;
         this.challenge = challenge;
+        this.gateway = gateway;
         this.name = "CredentialRejected";
     }
 }
@@ -121,17 +131,58 @@ function tracked(call, run, options) {
  * so a server that reads it can run the call once.
  */
 export const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
+/**
+ * Where a `tools/list` page names the tools a gateway listed without the credential's
+ * `toolPrefix` (#494): kept under their listed names, for discovery's diagnostic.
+ */
+export const UNPREFIXED_TOOLS_META_KEY = "nylorun/unprefixed-tools";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
  * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
- * `_meta` (R5.5).
+ * `_meta` (R5.5). Through a `gateway`, an answer that reports the server refused the credential
+ * is `CredentialRejected`, as a `401` is (#495), and a gateway's `toolPrefix` is taken off the
+ * tools it lists and put back on the calls (#494): everything after this client names the
+ * server's own tools.
  */
-export function sdkClient(client, serverName, errorChars) {
+export function sdkClient(client, serverName, errorChars, gateway) {
+    const prefix = gateway?.toolPrefix;
+    // The gateway may name the server by the prefix's stem (LiteLLM's `github-` for `github`).
+    const keys = prefix === undefined ? [serverName] : [serverName, prefix.replace(/[^A-Za-z0-9]+$/, "")];
+    const rejected = (answer) => gateway !== undefined && gatewayAuthFailure(answer, keys);
+    // The name the gateway listed for each tool, by the server's own name, and the names it listed
+    // without the prefix: a call sends the tool's name as the gateway listed it.
+    const listedAs = new Map();
+    const unprefixed = new Set();
+    const listedName = (name) => prefix === undefined || unprefixed.has(name) ? name : (listedAs.get(name) ?? `${prefix}${name}`);
+    const stripped = (page) => {
+        if (prefix === undefined)
+            return page;
+        const missing = [];
+        const tools = page.tools.map((tool) => {
+            if (typeof tool.name === "string" && tool.name.startsWith(prefix) && tool.name.length > prefix.length) {
+                const name = tool.name.slice(prefix.length);
+                listedAs.set(name, tool.name);
+                return { ...tool, name };
+            }
+            if (typeof tool.name === "string") {
+                unprefixed.add(tool.name);
+                missing.push(tool.name);
+            }
+            return tool;
+        });
+        return {
+            ...page,
+            tools,
+            ...(missing.length === 0 ? {} : { _meta: { ...page._meta, [UNPREFIXED_TOOLS_META_KEY]: missing } }),
+        };
+    };
     return {
         listTools: (params, options) => tracked(false, async (tracker) => {
             try {
                 const page = await client.listTools(params, options?.signal ? { signal: options.signal } : undefined);
-                return scrubbed(page, tracker);
+                if (rejected(page))
+                    throw new CredentialRejected(serverName, true);
+                return stripped(scrubbed(page, tracker));
             }
             catch (error) {
                 throw scrubError(error, tracker);
@@ -144,15 +195,18 @@ export function sdkClient(client, serverName, errorChars) {
             return tracked(true, async (tracker) => {
                 const lost = tracker.calling.signal;
                 try {
+                    const named = { ...params, name: listedName(params.name) };
                     const keyed = options?.key === undefined
-                        ? params
-                        : { ...params, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
+                        ? named
+                        : { ...named, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
                     const result = (await client.callTool(keyed, undefined, {
                         signal: options?.signal ? AbortSignal.any([options.signal, lost]) : lost,
                     }));
                     // An answer the stream did not count (an `sse` server answers on its event stream).
                     if (Buffer.byteLength(JSON.stringify(result)) > maxResultBytes)
                         throw tooLargeFailure(serverName, maxResultBytes);
+                    if (result.isError === true && rejected(result))
+                        throw new CredentialRejected(serverName, true);
                     const answer = scrubValues(result, [...tracker.secrets]);
                     return { result: answer.value, ...(answer.redacted > 0 ? { redacted: answer.redacted } : {}) };
                 }
@@ -202,8 +256,11 @@ export async function openMcpServer(input) {
             serverInfo: info ? scrubbed({ ...info }, tracker) : undefined,
         };
     }, { errorChars });
+    const gateway = initial.status === "authorized" && initial.via !== undefined
+        ? { via: initial.via, ...(initial.toolPrefix === undefined ? {} : { toolPrefix: initial.toolPrefix }) }
+        : undefined;
     return {
-        client: sdkClient(client, input.server.name, errorChars),
+        client: sdkClient(client, input.server.name, errorChars, gateway),
         ...(instructions === undefined ? {} : { instructions }),
         ...(serverInfo === undefined ? {} : { serverInfo }),
         close: () => client.close(),
@@ -227,11 +284,15 @@ export function serverInstructions(text, secrets) {
  */
 export async function listMcpTools(client, input) {
     const listed = [];
+    const unprefixed = [];
     let cursor;
     const pages = hostTuning().harness.mcpListPages;
     for (let page = 0; page < pages; page += 1) {
         const answer = await client.listTools(cursor ? { cursor } : undefined, input.signal ? { signal: input.signal } : undefined);
         listed.push(...answer.tools);
+        const missing = answer._meta?.[UNPREFIXED_TOOLS_META_KEY];
+        if (Array.isArray(missing))
+            unprefixed.push(...missing.filter((name) => typeof name === "string"));
         cursor = answer.nextCursor;
         if (!cursor)
             break;
@@ -267,7 +328,7 @@ export async function listMcpTools(client, input) {
             ...(annotations === undefined || Object.keys(annotations).length === 0 ? {} : { annotations }),
         });
     }
-    return { tools, omitted, disabled, unknownTools };
+    return { tools, omitted, disabled, unknownTools, unprefixed };
 }
 /**
  * One tool call and what it came to. Rejects with `McpConnectionStale` when the connection must
@@ -413,7 +474,7 @@ function authorizedFetch(server, endpoint, authorize, policy, errorChars) {
             tracker.sent = true;
         if (response.status === 401) {
             await response.body?.cancel().catch(() => undefined);
-            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined);
+            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined, result.status === "authorized" && result.workload ? endpoint.origin : undefined);
         }
         // The server ended the connection's session: the tool never saw the request.
         if (post && response.status === 404 && headers.has("mcp-session-id")) {

package/dist/mcp/gateway-outcomes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A gateway's report that the server behind it refused its credential (#495). A gateway that holds
+ * people's tokens may answer an upstream `401` with HTTP 200: LiteLLM lists no tools and names the
+ * outcome in the answer's `_meta`, and fails a tool call with `isError` and the upstream error's
+ * text. Only answers that came through a credential's `via` are read so: a server the Runtime talks
+ * to directly says `401` itself.
+ */
+/** The names a gateway may give the server under: the manifest's first, then any others. */
+export type GatewayServerKeys = readonly string[];
+/**
+ * Whether a `tools/list` page or a `tools/call` result reports that the server behind the
+ * gateway refused the credential. A call's text is read only when the result is an error.
+ */
+export declare function gatewayAuthFailure(answer: unknown, keys: GatewayServerKeys): boolean;

package/dist/mcp/gateway-outcomes.js

@@ -0,0 +1,46 @@
+/**
+ * A gateway's report that the server behind it refused its credential (#495). A gateway that holds
+ * people's tokens may answer an upstream `401` with HTTP 200: LiteLLM lists no tools and names the
+ * outcome in the answer's `_meta`, and fails a tool call with `isError` and the upstream error's
+ * text. Only answers that came through a credential's `via` are read so: a server the Runtime talks
+ * to directly says `401` itself.
+ */
+/** LiteLLM's outcome per server it reached: `{ status: "auth_required", http_status: 401 }`. */
+const LITELLM_SERVER_OUTCOMES = "litellm.ai/server_outcomes";
+/** LiteLLM's text for a tool call the upstream server answered `401` (httpx's error message). */
+const LITELLM_UNAUTHORIZED_TEXT = /HTTPStatusError: Client error '401 Unauthorized'/;
+/**
+ * Whether a `tools/list` page or a `tools/call` result reports that the server behind the
+ * gateway refused the credential. A call's text is read only when the result is an error.
+ */
+export function gatewayAuthFailure(answer, keys) {
+    if (!isRecord(answer))
+        return false;
+    const outcome = serverOutcome(answer._meta, keys);
+    if (outcome && (outcome.status === "auth_required" || outcome.http_status === 401))
+        return true;
+    return answer.isError === true && LITELLM_UNAUTHORIZED_TEXT.test(textOf(answer.content));
+}
+/** The gateway's outcome for this server: the entry one of `keys` names, else the only entry. */
+function serverOutcome(meta, keys) {
+    if (!isRecord(meta))
+        return undefined;
+    const outcomes = meta[LITELLM_SERVER_OUTCOMES];
+    if (!isRecord(outcomes))
+        return undefined;
+    for (const key of keys)
+        if (isRecord(outcomes[key]))
+            return outcomes[key];
+    const entries = Object.values(outcomes);
+    return entries.length === 1 && isRecord(entries[0]) ? entries[0] : undefined;
+}
+function textOf(content) {
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => (isRecord(part) && typeof part.text === "string" ? part.text : ""))
+        .join("\n");
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/dist/mcp/pool.js

@@ -52,6 +52,11 @@ export class McpPool {
                         ...(listed.unknownTools.length === 0
                             ? []
                             : [`Its tools settings name tools it does not list: ${listed.unknownTools.join(", ")}`]),
+                        ...(listed.unprefixed.length === 0
+                            ? []
+                            : [
+                                `${listed.unprefixed.length} of its tools lack the gateway's tool prefix and keep the names it listed: ${listed.unprefixed.join(", ")}`,
+                            ]),
                         ...(tooLong
                             ? [
                                 `Its instructions are ${Buffer.byteLength(text)} bytes, more than a record entry holds (the Runtime limit recordEntryBytes, ${input.maxInstructionBytes} bytes), and are left out`,

package/dist/model/call-headers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A custom endpoint's per-call headers (#493): each `callHeaders` entry's value, from the calling
+ * Agent, for a gateway that attributes or budgets each call, such as by the Agent's `org` label.
+ * A source with no value (a missing or empty label, a session whose owner is no person) sends no
+ * header, never an empty one.
+ */
+import type { ModelCallHeaderSource } from "@nylorun/core/contracts";
+/** What a model call knows of who makes it, read for the call. */
+export interface ModelCaller {
+    readonly agentId: string;
+    readonly labels: Readonly<Record<string, string>>;
+    /** The session's owner, when it is a person. */
+    readonly owner?: string;
+}
+export declare function callHeaders(sources: Readonly<Record<string, ModelCallHeaderSource>>, caller: ModelCaller): Record<string, string>;

package/dist/model/call-headers.js

@@ -0,0 +1,9 @@
+export function callHeaders(sources, caller) {
+    const headers = {};
+    for (const [name, source] of Object.entries(sources)) {
+        const value = source.from === "agent.label" ? caller.labels[source.key] : source.from === "agent.id" ? caller.agentId : caller.owner;
+        if (value)
+            headers[name] = value;
+    }
+    return headers;
+}

package/dist/model/models.d.ts

@@ -1,4 +1,5 @@
 import { type AuthContext, type CredentialStore } from "@earendil-works/pi-ai";
+import { type ModelCallHeaderSource } from "@nylorun/core/contracts";
 export type Selection = Readonly<{
     provider: string;
     model: string;
@@ -11,6 +12,10 @@ export type Selection = Readonly<{
         /** What the endpoint reads (protocol 12); text only unless it says so. */
         inputs?: readonly string[];
         compat?: Readonly<Record<string, unknown>>;
+        /** Sent on every call (#493). */
+        headers?: Readonly<Record<string, string>>;
+        /** Resolved per call from the calling Agent (`call-headers.ts`, #493). */
+        callHeaders?: Readonly<Record<string, ModelCallHeaderSource>>;
     }>;
 }>;
 /**
@@ -20,4 +25,6 @@ export type Selection = Readonly<{
 export declare function modelsFor(selection: Selection, credentials: CredentialStore, options?: {
     environment?: boolean;
     authContext?: AuthContext;
+    /** A custom endpoint's bearer read at each request instead of a stored key: the workload token (#496). */
+    bearer?: () => Promise<string>;
 }): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -30,6 +30,7 @@ export function modelsFor(selection, credentials, options = {}) {
         ...(selection.custom.compat
             ? { compat: { ...selection.custom.compat } }
             : {}),
+        ...(selection.custom.headers ? { headers: { ...selection.custom.headers } } : {}),
     };
     models.setProvider(createProvider({
         id: "custom",
@@ -39,6 +40,8 @@ export function modelsFor(selection, credentials, options = {}) {
             apiKey: {
                 name: "Custom API key",
                 async resolve() {
+                    if (options.bearer)
+                        return { type: "api_key", auth: { apiKey: await options.bearer() } };
                     const credential = await credentials.read("custom");
                     if (!credential || credential.type !== "api_key")
                         return undefined;

package/dist/model/pi-model.d.ts

@@ -3,6 +3,7 @@ import type { RuntimeModelAdapter } from "../contracts.js";
 import { type RuntimeLimits } from "@nylorun/core/contracts";
 import { type FileResolver } from "../artifacts/files.js";
 import type { HostModelSecret } from "../vault/service.js";
+import { type ModelCaller } from "./call-headers.js";
 export interface ModelPreview {
     readonly invocationId: string;
     readonly text: string;
@@ -39,6 +40,11 @@ export interface PiModelOptions {
     readonly readHostModel?: () => HostModelSecret | undefined | Promise<HostModelSecret | undefined>;
     readonly writeHostCredential?: (credential: Credential) => void | Promise<void>;
     readonly settings?: ModelCallSettings;
+    /**
+     * Who makes the call: read only when the custom endpoint has `callHeaders` (#493), whose values
+     * come from it. Without it, a call sends none of them.
+     */
+    readonly caller?: () => Promise<ModelCaller | undefined>;
 }
 /**
  * Node model adapter. Local provider configuration is read only when invoked.

package/dist/model/pi-model.js

@@ -7,6 +7,8 @@ import { scrub } from "../redact.js";
 import { classifyAssistantError, failure } from "./classify.js";
 import { addedInputsOf, describeModel, selectionOf } from "./descriptor.js";
 import { modelsFor } from "./models.js";
+import { callHeaders } from "./call-headers.js";
+import { workloadToken, WorkloadTokenUnavailable } from "../vault/workload-token.js";
 import { NativeBlocks, nativeKindsOf } from "./native-blocks.js";
 import { projectSecrets } from "./settings.js";
 /** The model call settings the Runtime limits `limits` set. */
@@ -53,16 +55,37 @@ export function piModel(options = {}) {
         const stored = await options.readHostModel?.();
         if (!stored)
             return failure("auth", "Model provider is not configured. Set it in Studio, or run nylorun tenant models set.", false);
+        // The workload token (#496): read from its file now and at each request, never stored.
+        let workload;
+        if (stored.authType === "workload") {
+            try {
+                workload = await workloadToken();
+            }
+            catch (error) {
+                if (error instanceof WorkloadTokenUnavailable)
+                    return failure("auth", error.message, false);
+                throw error;
+            }
+        }
         const secrets = [
             ...projectSecrets(root),
             ...credentialSecrets(stored.credential),
+            ...(workload === undefined ? [] : [workload]),
         ];
         const redacted = (outcome) => ({
             ...outcome,
             message: String(scrub(outcome.message, secrets)),
         });
         const selection = selectionOf(stored, call.model?.id);
-        const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), { environment: false, authContext: noAmbientAuth });
+        // A custom endpoint's per-call headers (#493), from the calling Agent; static ones are the model's.
+        const sources = selection.custom?.callHeaders;
+        const caller = sources && options.caller ? await options.caller() : undefined;
+        const perCall = sources && caller ? callHeaders(sources, caller) : {};
+        const registry = modelsFor(selection, hostCredentialStore(stored, options.writeHostCredential), {
+            environment: false,
+            authContext: noAmbientAuth,
+            ...(workload === undefined ? {} : { bearer: workloadToken }),
+        });
         const found = registry.getModel(selection.provider, selection.model);
         if (!found)
             return failure("invalid_request", "Unknown model. Run nylorun tenant models set.", false);
@@ -95,6 +118,7 @@ export function piModel(options = {}) {
             // The session id keys the provider's prompt cache and session affinity.
             sessionId: call.executionId,
             cacheRetention: "short",
+            ...(Object.keys(perCall).length > 0 ? { headers: perCall } : {}),
             timeoutMs: settings.requestTimeoutMs,
             maxRetries: settings.providerRetries,
             maxRetryDelayMs: settings.maxRetryDelayMs,
@@ -481,14 +505,16 @@ function idleTimeout(selected, idleTimeoutMs) {
 }
 function hostCredentialStore(stored, write) {
     let current = stored.credential;
+    // A workload model stores no credential: pi-ai then asks the provider's `resolve` (`modelsFor`).
+    const stores = stored.authType !== "workload";
     return {
         async read(providerId) {
-            if (providerId !== stored.provider)
+            if (providerId !== stored.provider || !stores)
                 return undefined;
             return current;
         },
         async list() {
-            return [{ providerId: stored.provider, type: current.type }];
+            return stores ? [{ providerId: stored.provider, type: current.type }] : [];
         },
         async modify(providerId, fn) {
             if (providerId !== stored.provider)

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.29.0-beta",
+    "version": "0.30.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -32,7 +32,8 @@
         "environment-disk-versions",
         "tool-policy",
         "traces",
-        "artifact-reads"
+        "artifact-reads",
+        "gateway-credentials"
       ]
     },
     "description": "For developers: agent manifests, Agents, sessions (with AG-UI and A2A) and artifacts, through `@nylorun/agents`. Every Tenant serves it on its one URL, beside the Management API (`/openapi/management.json`). Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields: an application key (servers) or a trusted issuer's token (browsers and apps)."
@@ -12922,6 +12923,9 @@
                   "server": {
                     "type": "string"
                   },
+                  "gateway": {
+                    "type": "string"
+                  },
                   "retryable": {
                     "type": "boolean"
                   }
@@ -20801,6 +20805,7 @@
                   "enum": [
                     "bearer",
                     "headers",
+                    "workload",
                     "environment_secret",
                     "environment_variable"
                   ]
@@ -20847,6 +20852,9 @@
                 "via": {
                   "type": "string"
                 },
+                "toolPrefix": {
+                  "type": "string"
+                },
                 "identity": {
                   "type": "object",
                   "properties": {
@@ -20893,6 +20901,7 @@
             "enum": [
               "bearer",
               "headers",
+              "workload",
               "environment_secret",
               "environment_variable"
             ]
@@ -20939,6 +20948,9 @@
           "via": {
             "type": "string"
           },
+          "toolPrefix": {
+            "type": "string"
+          },
           "identity": {
             "type": "object",
             "properties": {
@@ -20984,6 +20996,12 @@
               "type": "string",
               "minLength": 1
             }
+          },
+          "toolPrefix": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[\\x21-\\x7e]+$"
           }
         },
         "additionalProperties": false
@@ -27597,6 +27615,12 @@
                           "header"
                         ],
                         "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
                       }
                     },
                     "required": [
@@ -27645,6 +27669,12 @@
                           "header"
                         ],
                         "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
                       }
                     },
                     "required": [
@@ -27654,6 +27684,53 @@
                     ],
                     "additionalProperties": false
                   },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "requestId": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "workload"
+                        ]
+                      },
+                      "url": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "via": {
+                        "type": "string"
+                      },
+                      "identity": {
+                        "type": "object",
+                        "properties": {
+                          "header": {
+                            "type": "string",
+                            "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                          }
+                        },
+                        "required": [
+                          "header"
+                        ],
+                        "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
+                      }
+                    },
+                    "required": [
+                      "type",
+                      "url",
+                      "via"
+                    ],
+                    "additionalProperties": false
+                  },
                   {
                     "$ref": "#/components/schemas/PutAgentSecretValueRequest"
                   }

package/dist/store/postgres/schema.d.ts

@@ -2737,14 +2737,14 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
+            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model" | "workload";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
+            enumValues: ["bearer", "headers", "workload", "environment_secret", "environment_variable", "model"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/store/postgres/schema.js

@@ -353,7 +353,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
     id: textC().primaryKey(),
     vaultId: text().notNull(),
     name: text().notNull(),
-    type: text({ enum: ["bearer", "headers", "environment_secret", "environment_variable", "model"] }).notNull(),
+    type: text({ enum: ["bearer", "headers", "workload", "environment_secret", "environment_variable", "model"] }).notNull(),
     /** JSON text of the non-secret binding: url (and via, identity, header names), or provider and model. */
     bindingJson: text().notNull(),
     expiresAt: text(),

package/dist/tenant/agents.js

@@ -562,15 +562,19 @@ async function parseSecretRequest(ctx, id, name, raw) {
     const full = slotRequest(slot);
     if (raw !== null && typeof raw === "object" && "type" in raw) {
         const body = PutAgentSecretRequestSchema.parse(raw);
-        const { requestId: _, value: _v, headers: _h, ...binding } = body;
+        // The gateway's tool prefix is this installation's to add (`gateway-credentials`).
+        const { requestId: _, value: _v, headers: _h, toolPrefix: _p, ...binding } = body;
         if (canonical(binding) !== canonical(full))
             fail(409, `Secret ${name}'s type and binding come from Agent ${id}'s manifest: send only its value ({ "value": "…" }).`, {
                 code: "secret_not_in_manifest",
             });
         return body;
     }
-    const { requestId, value, headers } = PutAgentSecretValueRequestSchema.parse(raw);
-    const withId = requestId === undefined ? {} : { requestId };
+    const { requestId, value, headers, toolPrefix } = PutAgentSecretValueRequestSchema.parse(raw);
+    const withId = {
+        ...(requestId === undefined ? {} : { requestId }),
+        ...(toolPrefix === undefined ? {} : { toolPrefix }),
+    };
     if (slot.type === "headers") {
         if (headers === undefined)
             fail(400, `Secret ${name} is a headers credential: send { "headers": { … } }.`);