@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/providers/__tests__/dispatch-connection-routing.test.ts

@@ -407,7 +407,14 @@ describe("routing identities", () => {
       "claude-opus-4-8",
     );
 
-    expect(provider).toEqual({ name: "anthropic", tag: "managed" } as never);
+    expect(provider).toEqual({
+      name: "anthropic",
+      tag: "managed",
+      routeAttribution: {
+        connectionName: "vellum",
+        isManagedRoute: true,
+      },
+    } as never);
     expect(resolveProviderCalls[0]?.name).toBe("vellum");
     expect(resolveProviderOpts[0]?.providerOverride).toBe("anthropic");
   });
@@ -433,13 +440,47 @@ describe("routing identities", () => {
       "gpt-5.5",
     );
 
-    expect(provider).toEqual({ name: "openai", tag: "subscription" } as never);
+    expect(provider).toEqual({
+      name: "openai",
+      tag: "subscription",
+      routeAttribution: {
+        connectionName: "chatgpt-subscription",
+        isManagedRoute: false,
+      },
+    } as never);
     expect(resolveProviderCalls[0]?.name).toBe("chatgpt-subscription");
     // No override needed: the subscription row itself carries provider
     // "openai", so the adapter resolves from the row.
     expect(resolveProviderCalls[0]?.provider).toBe("openai");
   });
 
+  // A second managed row is creatable under any non-reserved name: only the
+  // canonical name is refused at the create route, and `provider: "vellum"`
+  // derives platform auth. Managed-ness is the row, never its name.
+  test("a managed row under a non-canonical name carries managed route attribution", async () => {
+    fakeConnections.set("managed-openai", {
+      name: "managed-openai",
+      provider: "vellum",
+      auth: { type: "platform" },
+    });
+    fakeProviders.set("conn:managed-openai", {
+      name: "openai",
+      tag: "managed",
+    });
+
+    const provider = await tryResolveProviderForConnectionName(
+      "managed-openai",
+      { llm: {} } as never,
+      "openai",
+      "gpt-5.5",
+    );
+
+    expect(provider?.routeAttribution).toEqual({
+      connectionName: "managed-openai",
+      isManagedRoute: true,
+    });
+  });
+
   test("chatgpt identity with no subscription row throws not_found (never a silent fallback)", async () => {
     await expect(
       tryResolveProviderForConnectionName(

package/src/providers/__tests__/vellum-mismatch-routing.test.ts

@@ -86,6 +86,10 @@ describe("vellum connection mismatch handling", () => {
       "accounts/fireworks/models/kimi-k2p5",
     );
     expect(provider).not.toBeNull();
+    expect(provider?.routeAttribution).toEqual({
+      connectionName: "vellum",
+      isManagedRoute: true,
+    });
     expect(resolveCalls).toHaveLength(1);
     expect(resolveCalls[0].connection.name).toBe("vellum");
     expect(resolveCalls[0].opts.providerOverride).toBe("fireworks");
@@ -129,6 +133,10 @@ describe("vellum connection mismatch handling", () => {
       "anthropic/claude-fable-5",
     );
     expect(provider).not.toBeNull();
+    expect(provider?.routeAttribution).toEqual({
+      connectionName: "openrouter-personal",
+      isManagedRoute: false,
+    });
     expect(resolveCalls).toHaveLength(1);
     expect(resolveCalls[0].connection.name).toBe("openrouter-personal");
     expect(resolveCalls[0].opts.providerOverride).toBeUndefined();

package/src/providers/call-site-routing.ts

@@ -21,9 +21,16 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 
-import { resolveCallSiteConfig } from "../config/llm-resolver.js";
+import {
+  resolveCallSiteConfig,
+  resolveCallSiteConfigWithProfile,
+} from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import { getDb } from "../persistence/db-connection.js";
+import {
+  ProviderError,
+  type ProviderRouteAttribution,
+} from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
 import {
   describeSubscriptionModelIncompatibility,
@@ -31,6 +38,7 @@ import {
 } from "./connection-model-compat.js";
 import {
   ConnectionResolutionError,
+  isManagedConnectionRoute,
   resolveRoutingIdentity,
   tryResolveProviderForConnectionName,
 } from "./connection-resolution.js";
@@ -46,6 +54,14 @@ import type {
 } from "./types.js";
 
 const log = getLogger("providers/call-site-routing");
+
+interface SelectedProviderRoute {
+  provider: Provider;
+  connectionName?: string;
+  profileName?: string;
+  isManagedRoute?: boolean;
+}
+
 export class CallSiteRoutingProvider implements Provider {
   public readonly tokenEstimationProvider?: string;
   // Forward native web-search capability so it survives the wrapper chain
@@ -99,6 +115,7 @@ export class CallSiteRoutingProvider implements Provider {
       expectedProvider: string,
       model: string | undefined,
     ) => Promise<Provider | null>,
+    private readonly defaultRouteAttribution?: ProviderRouteAttribution,
   ) {
     this.tokenEstimationProvider = defaultProvider.tokenEstimationProvider;
     this.supportsNativeWebSearch = defaultProvider.supportsNativeWebSearch;
@@ -112,11 +129,30 @@ export class CallSiteRoutingProvider implements Provider {
     messages: Message[],
     options?: SendMessageOptions,
   ): Promise<ProviderResponse> {
-    const target = await this.selectProvider(options);
+    const selectedRoute = await this.selectProvider(options);
+    const target = selectedRoute.provider;
     const isRouted = target !== this.defaultProvider;
 
     const doSend = async (): Promise<ProviderResponse> => {
-      const response = await target.sendMessage(messages, options);
+      let response: ProviderResponse;
+      try {
+        response = await target.sendMessage(messages, options);
+      } catch (error) {
+        if (error instanceof ProviderError) {
+          error.attachRouteAttribution({
+            ...(selectedRoute.connectionName
+              ? { connectionName: selectedRoute.connectionName }
+              : {}),
+            ...(selectedRoute.profileName
+              ? { profileName: selectedRoute.profileName }
+              : {}),
+            ...(selectedRoute.isManagedRoute !== undefined
+              ? { isManagedRoute: selectedRoute.isManagedRoute }
+              : {}),
+          });
+        }
+        throw error;
+      }
       // Also stamp actualProvider on the response so that handleUsage
       // (which reads event.actualProvider, not provider.name) attributes
       // the call to the right provider.
@@ -199,10 +235,10 @@ export class CallSiteRoutingProvider implements Provider {
    */
   private async selectProvider(
     options?: SendMessageOptions,
-  ): Promise<Provider> {
+  ): Promise<SelectedProviderRoute> {
     const callSite = options?.config?.callSite;
     if (!callSite) {
-      return this.defaultProvider;
+      return this.defaultRoute();
     }
 
     const overrideProfile = options?.config?.overrideProfile;
@@ -213,11 +249,15 @@ export class CallSiteRoutingProvider implements Provider {
     // request params.
     const forceOverrideProfile = options?.config?.forceOverrideProfile;
     const selectionSeed = options?.config?.selectionSeed;
-    const resolved = resolveCallSiteConfig(callSite, getConfig().llm, {
-      overrideProfile,
-      forceOverrideProfile,
-      selectionSeed,
-    });
+    const { config: resolved, profileName } = resolveCallSiteConfigWithProfile(
+      callSite,
+      getConfig().llm,
+      {
+        overrideProfile,
+        forceOverrideProfile,
+        selectionSeed,
+      },
+    );
 
     let connectionName = resolved.provider_connection;
 
@@ -267,13 +307,27 @@ export class CallSiteRoutingProvider implements Provider {
         resolved.model,
       );
       if (connectionProvider) {
+        const actualRoute = {
+          connectionName:
+            connectionProvider.routeAttribution?.connectionName ??
+            connectionName,
+          isManagedRoute:
+            connectionProvider.routeAttribution?.isManagedRoute ??
+            isManagedConnectionRoute(connectionName),
+        };
         // The connection whose credential the call authenticates with is only
         // known here, and diagnostics for a failed request are unactionable
         // without it ("which key was this?"). Recorded once the adapter exists,
         // so a connection that fell back to the default transport is not
         // reported as the one that signed the request.
-        recordProviderRequestDiagnostics({ connection_name: connectionName });
-        return connectionProvider;
+        recordProviderRequestDiagnostics({
+          connection_name: actualRoute.connectionName,
+        });
+        return {
+          provider: connectionProvider,
+          ...actualRoute,
+          ...(profileName ? { profileName } : {}),
+        };
       }
       // Soft credential failure: the routed connection yielded no usable
       // adapter and dispatch is landing on the default transport, which may
@@ -289,11 +343,11 @@ export class CallSiteRoutingProvider implements Provider {
         },
         "Routed connection yielded no adapter — falling back to the default transport",
       );
-      return this.defaultProvider;
+      return this.defaultRoute(profileName);
     }
 
     if (resolved.provider === this.defaultProvider.name) {
-      return this.defaultProvider;
+      return this.defaultRoute(profileName);
     }
 
     if (autoResolveCandidates) {
@@ -317,6 +371,14 @@ export class CallSiteRoutingProvider implements Provider {
       `call-site "${callSite}" resolves to provider "${resolved.provider}" but no provider_connection is set — alternate-provider routing requires a connection`,
     );
   }
+
+  private defaultRoute(profileName?: string): SelectedProviderRoute {
+    return {
+      provider: this.defaultProvider,
+      ...this.defaultRouteAttribution,
+      ...(profileName ? { profileName } : {}),
+    };
+  }
 }
 
 /**
@@ -341,5 +403,6 @@ export function wrapWithCallSiteRouting(
         expectedProvider,
         model,
       ),
+    base.routeAttribution,
   );
 }

package/src/providers/connection-resolution.ts

@@ -132,11 +132,12 @@ export async function tryResolveProviderForConnectionName(
     connectionName === VELLUM_MANAGED_CONNECTION_NAME &&
     !isVellumManagedConnection(connection)
   ) {
-    return resolveThroughPlatform(
+    const provider = await resolveThroughPlatform(
       config,
       expectedProvider ?? declaredProvider,
       model,
     );
+    return attachProviderRoute(provider, canonicalVellumConnection());
   }
   // The provider-agnostic Vellum-managed connection carries only the `vellum`
   // sentinel, so the usual `connection.provider === expectedProvider` equality
@@ -221,10 +222,11 @@ export async function tryResolveProviderForConnectionName(
   // catch is specifically for in-flight failures that should not take
   // dispatch offline.
   try {
-    return await resolveProviderFromConnection(connection, config, {
+    const provider = await resolveProviderFromConnection(connection, config, {
       model,
       providerOverride: isVellumRoute ? expectedProvider : undefined,
     });
+    return attachProviderRoute(provider, connection);
   } catch (err) {
     log.warn(
       { err, connectionName },
@@ -234,6 +236,44 @@ export async function tryResolveProviderForConnectionName(
   }
 }
 
+function attachProviderRoute(
+  provider: Provider | null,
+  connection: { name: string; provider: string; auth: { type: string } },
+): Provider | null {
+  if (provider) {
+    provider.routeAttribution = {
+      connectionName: connection.name,
+      isManagedRoute: isVellumManagedConnection(connection),
+    };
+  }
+  return provider;
+}
+
+/**
+ * Whether a route through this connection name is Vellum-managed
+ * (platform-billed), for callers that hold only the name. Returns undefined
+ * when the row can't be read, so the caller can fall back rather than assert
+ * a BYOK route it never confirmed.
+ *
+ * The canonical name is always managed: a user-owned row claiming it is
+ * ignored and the route resolves through platform auth regardless (see
+ * `tryResolveProviderForConnectionName`).
+ */
+export function isManagedConnectionRoute(
+  connectionName: string,
+): boolean | undefined {
+  if (connectionName === VELLUM_MANAGED_CONNECTION_NAME) {
+    return true;
+  }
+  let connection;
+  try {
+    connection = getConnection(getDb(), connectionName);
+  } catch {
+    return undefined;
+  }
+  return connection ? isVellumManagedConnection(connection) : undefined;
+}
+
 /**
  * Resolve a managed route through platform auth without reading a connection
  * row. Used when the canonical `vellum` row is claimed by a user-owned

package/src/providers/inference/__tests__/adapter-factory-openai-compatible.test.ts

@@ -7,7 +7,33 @@ import {
 } from "../adapter-factory.js";
 import type { ProviderConnection, ResolvedAuth } from "../auth.js";
 
-describe("openai-compatible adapter factory", () => {
+interface RetryOptions {
+  credentialSource?: string;
+  connectionName?: string;
+  refreshCredentialProvider?: () => Promise<unknown>;
+}
+
+/**
+ * Read the `RetryProvider` options the factory stamped. Walks the `inner`
+ * chain rather than assuming a fixed wrapper nesting, so reordering the
+ * wrappers fails a behavior assertion instead of this accessor.
+ */
+function retryOptions(adapter: unknown): RetryOptions {
+  let node = adapter;
+  for (let depth = 0; node && depth < 8; depth++) {
+    const { options, inner } = node as {
+      options?: RetryOptions;
+      inner?: unknown;
+    };
+    if (options) {
+      return options;
+    }
+    node = inner;
+  }
+  throw new Error("no RetryProvider found in the adapter wrapper chain");
+}
+
+describe("adapter factory", () => {
   test("buildProviderAdapter returns an OpenAIChatCompletionsProvider", () => {
     const adapter = buildProviderAdapter("openai-compatible", {
       apiKey: "test-key",
@@ -71,6 +97,10 @@ describe("openai-compatible adapter factory", () => {
     });
 
     expect(adapter).not.toBeNull();
+    expect(retryOptions(adapter)).toMatchObject({
+      credentialSource: "no-auth",
+      connectionName: "my-vllm",
+    });
   });
 
   test("createAdapterFromConnection still rejects 'none' auth for keyed catalog providers", () => {
@@ -94,4 +124,100 @@ describe("openai-compatible adapter factory", () => {
 
     expect(adapter).toBeNull();
   });
+
+  test("attributes OAuth subscription credentials separately from API keys", () => {
+    const connection: ProviderConnection = {
+      name: "chatgpt-subscription",
+      provider: "openai",
+      auth: {
+        type: "oauth_subscription",
+        credential: "chatgpt-subscription-oauth",
+      },
+      label: "ChatGPT",
+      baseUrl: null,
+      models: null,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: false,
+    };
+
+    const adapter = createAdapterFromConnection(
+      connection,
+      {
+        kind: "header",
+        headers: { Authorization: "Bearer test-token" },
+      },
+      { model: "gpt-5.4" },
+    );
+
+    expect(adapter).not.toBeNull();
+    expect(retryOptions(adapter)).toMatchObject({
+      credentialSource: "oauth-subscription",
+      connectionName: "chatgpt-subscription",
+    });
+  });
+
+  test("wires managed connections to reload rotated assistant credentials", () => {
+    const connection: ProviderConnection = {
+      name: "vellum",
+      provider: "vellum",
+      auth: { type: "platform" },
+      label: "Vellum",
+      baseUrl: null,
+      models: null,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: true,
+    };
+
+    const adapter = createAdapterFromConnection(
+      connection,
+      {
+        kind: "header",
+        headers: { Authorization: "Bearer managed-key" },
+        baseUrl: "https://example.com/runtime-proxy/anthropic",
+      },
+      { model: "claude-opus-4-8", provider: "anthropic" },
+    );
+
+    expect(adapter).not.toBeNull();
+    const options = retryOptions(adapter);
+    expect(options).toMatchObject({
+      credentialSource: "vellum-managed",
+      connectionName: "vellum",
+    });
+    expect(typeof options.refreshCredentialProvider).toBe("function");
+  });
+
+  test("credential refresh declines when it cannot re-read a changed key", async () => {
+    const connection: ProviderConnection = {
+      name: "vellum",
+      provider: "vellum",
+      auth: { type: "platform" },
+      label: "Vellum",
+      baseUrl: null,
+      models: null,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+      isManaged: true,
+    };
+
+    const adapter = createAdapterFromConnection(
+      connection,
+      {
+        kind: "header",
+        headers: { Authorization: "Bearer managed-key" },
+        baseUrl: "https://example.com/runtime-proxy/anthropic",
+      },
+      { model: "claude-opus-4-8", provider: "anthropic" },
+    );
+
+    // Guards the doubled-upstream-call regression: a refresh that cannot
+    // produce a credential different from the one that just failed must
+    // hand back nothing, so the retry loop surfaces the auth error instead
+    // of replaying the request against an identical key.
+    const refresh = retryOptions(adapter).refreshCredentialProvider;
+    expect(await refresh?.()).toBeNull();
+    expect(await refresh?.()).toBeNull();
+  });
 });

package/src/providers/inference/adapter-factory.ts

@@ -37,6 +37,7 @@ import { UsageTrackingProvider } from "../usage-tracking.js";
 import { VercelAIGatewayProvider } from "../vercel-ai-gateway/client.js";
 import type { ResolvedAuth } from "./auth.js";
 import type { ProviderConnection } from "./auth.js";
+import { resolveAuth } from "./resolve-auth.js";
 
 /** Unified construction opts. Adapters ignore fields they don't consume. */
 export interface AdapterCreateOpts {
@@ -225,6 +226,74 @@ export function createAdapterFromConnection(
      */
     provider?: string;
   },
+): Provider | null {
+  const provider = opts.provider ?? connection.provider;
+  const adapter = buildConnectionAdapter(connection, resolvedAuth, opts);
+  if (!adapter) {
+    return null;
+  }
+
+  /**
+   * Re-read the managed credential after an auth rejection and rebuild the
+   * adapter around it, so a key rotated out-of-band is picked up without a
+   * restart. Returns `null` when the store hands back the same credential
+   * that just failed — otherwise a proxy 401 from any other cause (platform
+   * auth degraded, revoked account) would make every request pay a second
+   * doomed upstream call forever.
+   */
+  function makeCredentialRefresher(): () => Promise<Provider | null> {
+    let lastAuth = JSON.stringify(resolvedAuth);
+    return async (): Promise<Provider | null> => {
+      const refreshedAuth = await resolveAuth(connection.auth, provider, {
+        baseUrl: connection.baseUrl,
+      });
+      if (!refreshedAuth.ok) {
+        return null;
+      }
+      const nextAuth = JSON.stringify(refreshedAuth.resolved);
+      if (nextAuth === lastAuth) {
+        return null;
+      }
+      lastAuth = nextAuth;
+      return buildConnectionAdapter(connection, refreshedAuth.resolved, opts);
+    };
+  }
+
+  // Usage-attribution headers (`X-Vellum-*`) are only meaningful when the
+  // request is routed through the Vellum-managed proxy. They carry billing
+  // metadata for our own backend. Forwarding them to a third-party endpoint
+  // would leak internal Vellum metadata, so gate on the auth type:
+  // `platform` is the only auth that flows through our proxy.
+  const isManagedProxy = connection.auth.type === "platform";
+  return new UsageTrackingProvider(
+    new RetryProvider(adapter, {
+      forwardUsageAttributionHeaders: isManagedProxy,
+      credentialSource: isManagedProxy
+        ? "vellum-managed"
+        : connection.auth.type === "api_key"
+          ? "byok"
+          : connection.auth.type === "oauth_subscription"
+            ? "oauth-subscription"
+            : connection.auth.type === "none"
+              ? "no-auth"
+              : undefined,
+      connectionName: connection.name,
+      ...(isManagedProxy
+        ? { refreshCredentialProvider: makeCredentialRefresher() }
+        : {}),
+    }),
+  );
+}
+
+function buildConnectionAdapter(
+  connection: ProviderConnection,
+  resolvedAuth: ResolvedAuth,
+  opts: {
+    model: string;
+    streamTimeoutMs?: number;
+    useNativeWebSearch?: boolean;
+    provider?: string;
+  },
 ): Provider | null {
   const provider = opts.provider ?? connection.provider;
   const entry = PROVIDER_CATALOG.find((e) => e.id === provider);
@@ -264,16 +333,5 @@ export function createAdapterFromConnection(
   if (!adapter) {
     return null;
   }
-
-  // Usage-attribution headers (`X-Vellum-*`) are only meaningful when the
-  // request is routed through the Vellum-managed proxy — they carry billing
-  // metadata for our own backend. Forwarding them to a third-party endpoint
-  // would leak internal Vellum metadata, so gate on the auth type:
-  // `platform` is the only auth that flows through our proxy.
-  const isManagedProxy = connection.auth.type === "platform";
-  return new UsageTrackingProvider(
-    new RetryProvider(adapter, {
-      forwardUsageAttributionHeaders: isManagedProxy,
-    }),
-  );
+  return adapter;
 }

package/src/providers/model-catalog.ts

@@ -926,17 +926,6 @@ const RAW_PROVIDER_CATALOG: ProviderCatalogEntry[] = [
         supportsToolUse: true,
         pricing: { inputPer1mTokens: 0.3, outputPer1mTokens: 1.2 },
       },
-      {
-        id: "accounts/fireworks/models/minimax-m2p5",
-        displayName: "MiniMax M2.5",
-        contextWindowTokens: 196608,
-        maxOutputTokens: 25000,
-        supportsThinking: false,
-        supportsCaching: false,
-        supportsVision: false,
-        supportsToolUse: true,
-        pricing: { inputPer1mTokens: 0.3, outputPer1mTokens: 1.2 },
-      },
       {
         id: "accounts/fireworks/models/deepseek-v4-pro",
         displayName: "DeepSeek V4 Pro",

package/src/providers/model-intents.ts

@@ -9,45 +9,55 @@ const PROVIDER_DEFAULT_MODELS: Record<string, string> = Object.fromEntries(
   PROVIDER_CATALOG.map((entry) => [entry.id, entry.defaultModel]),
 );
 
+// `cost-optimized` is the cheapest model a provider serves, `latency-optimized`
+// the fastest to first token. On anthropic, ollama and fireworks the same model
+// is both, so those columns repeat by construction rather than by oversight.
 const PROVIDER_MODEL_INTENTS: Record<string, Record<ModelIntent, string>> = {
   anthropic: {
     balanced: "claude-sonnet-4-6",
+    "cost-optimized": "claude-haiku-4-5-20251001",
     "latency-optimized": "claude-haiku-4-5-20251001",
     "quality-optimized": "claude-fable-5",
     "vision-optimized": "claude-opus-4-6",
   },
   openai: {
     balanced: "gpt-5.4-mini",
+    "cost-optimized": "gpt-5.4-nano",
     "latency-optimized": "gpt-5.6-luna",
     "quality-optimized": "gpt-5.4",
     "vision-optimized": "gpt-5.4",
   },
   gemini: {
     balanced: "gemini-3-flash-preview",
+    "cost-optimized": "gemini-2.5-flash-lite",
     "latency-optimized": "gemini-3.1-flash-lite",
     "quality-optimized": "gemini-3.1-pro-preview",
     "vision-optimized": "gemini-3-flash-preview",
   },
   ollama: {
     balanced: "llama3.2",
+    "cost-optimized": "llama3.2",
     "latency-optimized": "llama3.2",
     "quality-optimized": "llama3.2",
     "vision-optimized": "llama3.2",
   },
   fireworks: {
     balanced: "accounts/fireworks/models/minimax-m3",
+    "cost-optimized": "accounts/fireworks/models/deepseek-v4-flash",
     "latency-optimized": "accounts/fireworks/models/deepseek-v4-flash",
     "quality-optimized": "accounts/fireworks/models/kimi-k2p6",
     "vision-optimized": "accounts/fireworks/models/kimi-k2p6",
   },
   openrouter: {
     balanced: "anthropic/claude-sonnet-4.6",
+    "cost-optimized": "deepseek/deepseek-v4-flash",
     "latency-optimized": "anthropic/claude-haiku-4.5",
     "quality-optimized": "anthropic/claude-fable-5",
     "vision-optimized": "anthropic/claude-opus-4.6",
   },
   "vercel-ai-gateway": {
     balanced: "anthropic/claude-sonnet-4.6",
+    "cost-optimized": "deepseek/deepseek-v4-flash",
     "latency-optimized": "anthropic/claude-haiku-4.5",
     "quality-optimized": "anthropic/claude-fable-5",
     "vision-optimized": "anthropic/claude-opus-4.6",
@@ -58,6 +68,7 @@ const FALLBACK_DEFAULT_MODEL = "claude-opus-4-8";
 
 const MODEL_INTENTS = new Set<ModelIntent>([
   "balanced",
+  "cost-optimized",
   "latency-optimized",
   "quality-optimized",
   "vision-optimized",

package/src/providers/registry.ts

@@ -265,6 +265,14 @@ export async function initializeProviders(
       entry.id,
       new RetryProvider(adapter, {
         forwardUsageAttributionHeaders: source === "managed-proxy",
+        // A keyless provider booted without a key has no credential to blame,
+        // so don't let its rejections render as "update your personal key".
+        credentialSource:
+          source === "managed-proxy"
+            ? "vellum-managed"
+            : isKeyless && !apiKey
+              ? "no-auth"
+              : "byok",
       }),
     );
     routingSources.set(entry.id, source);