fix: retain Vercel providers and prefer Bedrock for Kimi

[chrarnoldus]

Summary

• Preserve snapshot-listed inference providers when the exact mapped model has a Vercel endpoint, even when OpenRouter endpoint metadata omits that provider.
• Keep organization allowlists enforced and prevent paid Vercel endpoints from leaking into free model variants.
• Change the default Kimi provider order from Novita to Amazon Bedrock followed by Alibaba, preserving explicit caller routing preferences.

Regression Coverage

• Kimi Bedrock and Alibaba endpoints advertised through provider_name or tag.
• Exclusion of providers absent from both endpoint catalogs or absent from the snapshot.
• Free/paid variant isolation and Vercel model/provider ID mapping.
• Preferred ordering across Kimi model IDs and preservation of explicit only/order settings.

Validation

• Four focused Jest suites passed: 81 tests covering provider indexing, preferred routing, catalog injection, and organization model access.
• pnpm typecheck --changes-only passed.
• Targeted oxlint passed with no warnings or errors.
• Changed files formatted with pnpm format; git diff --check passed.
• Independent read-only review found no issues.

Scope

This fixes provider eligibility; existing Vercel rollout and model opt-out settings still govern gateway selection.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the only change since b26e083 (commit 24d4018f, "clarify OpenRouter model loader name"): the fetchStoredModels option was renamed to fetchOpenRouterModels, and the new name is applied consistently at the type definition, both call sites, the default loader wiring, and the test helper, with no remaining references to the old name. The Vercel provider-retention logic and Kimi preferred-order change are unchanged and were already verified.

Files Reviewed (4 files)

• apps/web/src/lib/ai-gateway/providers/apply-provider-specific-logic.ts
• apps/web/src/lib/ai-gateway/providers/apply-provider-specific-logic.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/models-by-provider-index.server.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/models-by-provider-index.server.test.ts

Verification Notes

• grep for fetchStoredModels across apps/web/src returns no matches; the rename is complete and type consistency is preserved (ProviderIndexLoaderOptions and both createModelsByProviderIndexLoader invocations agree).
• No new caches, unbounded maps, or retained listeners are introduced by the incremental change, so no new memory-leak risk.
• The merge from main only contributes already-merged main changes that are outside this PR's diff; no regression to the PR's provider-retention or Kimi ordering logic.

Previous Review Summary (commit b26e083)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit b26e083)

Status: No Issues Found | Recommendation: Merge

The changes correctly widen provider eligibility to Vercel-listed providers while keeping the snapshot as the universe and variant isolation intact, and the Kimi preferred-order change is consistently translated for the Vercel gateway.

Files Reviewed (4 files)

• apps/web/src/lib/ai-gateway/providers/apply-provider-specific-logic.ts
• apps/web/src/lib/ai-gateway/providers/apply-provider-specific-logic.test.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/models-by-provider-index.server.ts
• apps/web/src/lib/ai-gateway/providers/openrouter/models-by-provider-index.server.test.ts

Verification Notes

• vercelProviders uses provider_name ?? tag, and mapModelIdToVercel does not strip variant suffixes, so a :free request never resolves to the standard Vercel model id and cannot inherit its paid providers; the new free-variant test meaningfully guards this by keying the Vercel model on the unsuffixed id.
• Snapshot slugs remain the result namespace and openRouterToVercelInferenceProviderId plus normalizeVercelInferenceProviderIdForRouting are symmetric for the divergent ids (amazon-bedrock/bedrock, google-vertex/vertex/vertexAnthropic, google-ai-studio/google, z-ai/zai, seed/bytedance, together/togetherai, claude-on-aws/claudeaws), so no cross-provider collisions are introduced.
• getVercelModelsMetadataFromDatabase is wrapped in createCachedFetch (300s TTL) with a caught error fallback, so the added second fetch adds no per-call DB pressure and cannot throw into the allowlist predicate.
• No new caches or unbounded maps are introduced; the loader's index cache/in-flight state is unchanged, so no memory-leak risk was introduced.
• The Kimi provider.order values are OpenRouter-namespace slugs, which vercel/index.ts translates via openRouterToVercelInferenceProviderId before sending, and applyPreferredProvider still preserves an explicit caller order.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}