Add support for Google Vertex AI BYOK to gateway

[chrarnoldus]

Summary

• promote Google Vertex AI to a configurable Vercel user BYOK provider using the documented project, location, and service-account credential shape
• map Vercel's internal vertexAnthropic endpoint identity to the single public vertex BYOK key so the same credential serves Gemini and Claude models
• validate structured credentials before storage and add the Vertex setup form to personal and organization BYOK settings

Verification

• pnpm format:changed
• git diff --check
• test suites intentionally left to CI

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 2bad376e: the BYOK error test now asserts a defined response before calling .json(), replacing optional chaining that could hide an undefined result.

Files Reviewed (1 file)

• apps/web/src/lib/ai-gateway/llm-proxy-helpers.test.ts

Previous Review Summaries (12 snapshots, latest commit 8645138)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 8645138)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 86451382: the Vertex BYOK 404 rewrite now passes userByokProviderIds via an explicit userByok === null guard so TypeScript narrows before .map(); behavior is equivalent for BYOKResult[] | null.

Files Reviewed (1 file)

• apps/web/src/app/api/openrouter/[...path]/route.ts

Previous review (commit 4c3ecf0)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 4c3ecf06: Vertex 404 rewrite now uses an explicit userByokProviderIds === null guard so TypeScript narrows before .includes('vertex'); behavior is equivalent for all typed inputs.

Files Reviewed (1 file)

• apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts

Previous review (commit edff44d)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of c328e0ca: Vertex BYOK 404s now rewrite from the request-scoped hasVertexUserByok flag instead of gateway routing metadata; tests cover the non-Vertex path, and no secret leakage or logic issues were found.

Files Reviewed (3 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.test.ts
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts

Previous review (commit c328e0c)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of c328e0ca: Vertex BYOK 404s now rewrite from the request-scoped hasVertexUserByok flag instead of gateway routing metadata; tests cover the non-Vertex path, and no secret leakage or logic issues were found.

Files Reviewed (3 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.test.ts
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts

Previous review (commit 837933e)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 837933e: Vertex user-BYOK 404s now rewrite to a project/location enablement hint when gateway routing metadata shows a failed vertex or vertexAnthropic BYOK attempt; tests cover false positives, and no secret leakage or logic issues were found.

Files Reviewed (2 files)

• apps/web/src/lib/ai-gateway/llm-proxy-helpers.test.ts
• apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts

Previous review (commit 48b1ee6)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Full review of rewritten HEAD 48b1ee6: Vertex user BYOK stores Vercel-shaped {project, location, googleCredentials}, the settings UI now recommends location global, and no secret leakage, memory leaks, or logic issues were found.

Files Reviewed (11 files)

• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx
• apps/web/src/lib/ai-gateway/byok/index.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inject-extra-provider-models.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inject-extra-provider-models.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/types.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts
• apps/web/src/routers/byok-router.test.ts
• apps/web/src/routers/byok-router.ts

Previous review (commit 3c33c2e)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 3c33c2e: added a regression test that Vertex Anthropic BYOK keeps credentials under vertex while routing Claude through vertexAnthropic alongside other providers; no production-code changes, secret leakage, or memory leaks.

Files Reviewed (1 file)

• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts

Previous review (commit 5e20a2b)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 5e20a2b: Vertex BYOK now accepts native Google service-account JSON, maps it to Vercel’s {project, location, googleCredentials} shape with a documented us-east5 location, and routes Claude through vertexAnthropic while keeping credentials under vertex; no leftover VertexCredentialsSchema references, secret leakage, or memory leaks.

Files Reviewed (7 files)

• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/types.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts
• apps/web/src/routers/byok-router.test.ts
• apps/web/src/routers/byok-router.ts

Previous review (commit 512de7d)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 512de7d: restoring VercelInferenceProviderIdSchema/VercelInferenceProviderId from KnownVercel* is complete with no leftover references, and the rename-only mapping/type updates introduce no Vertex BYOK regressions.

Files Reviewed (2 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts

Previous review (commit 06a8442)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of 06a8442b: restoring VercelNonUserByokInferenceProviderIdSchema is complete with no leftover KnownVercelNonUserByok* references, and the main-merge Vercel routing/OpenAI managed-BYOK hunks in this PR's files introduce no Vertex BYOK regressions, secret leakage, or memory leaks.

Files Reviewed (4 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts

Previous review (commit 964be60)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the follow-up commits: the Vercel provider-ID schemas were consistently renamed to KnownVercel* (no stale references remain), and unknown provider IDs now pass through normalization instead of being schema-filtered — a deliberate, test-covered behavior change in injectExtraProviderModels; the removed !== undefined guards in vercel/index.ts were dead code since openRouterToVercelInferenceProviderId always returned a string. No memory leaks, security issues, or logic regressions introduced.

Files Reviewed (6 files)

• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inject-extra-provider-models.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inject-extra-provider-models.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts

Previous review (commit bd22878)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the Vertex user-BYOK promotion across provider-id mapping, routing normalization (vertexAnthropic → vertex), credential validation (client + tRPC), BYOK pinning, and the settings UI; the logic is consistent, credential errors never echo secret contents, the earlier usage-billing experiment was fully reverted (net-zero diff on processUsage.ts/llm-proxy-helpers.ts), and no memory leaks or security issues were introduced.

Files Reviewed (10 files)

• apps/web/src/components/organizations/byok/BYOKKeysManager.tsx
• apps/web/src/lib/ai-gateway/byok/index.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inference-provider-id.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/inject-extra-provider-models.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/types.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.test.ts
• apps/web/src/lib/ai-gateway/providers/vercel/index.ts
• apps/web/src/routers/byok-router.test.ts
• apps/web/src/routers/byok-router.ts

---

_{Reviewed by grok-4.6 · Input: 133.1K · Output: 4.1K · Cached: 82.7K}

_{Review guidance: REVIEW.md from base branch main}