[emilieschario]

Summary

• Persist OpenRouter terms-of-service and privacy-policy URLs on the provider catalog.
• GET /api/v1/providers already returns dataPolicy.termsOfServiceURL and dataPolicy.privacyPolicyURL when they are stored, so they appear after the next provider sync.
• Name, training, prompt retention, and headquarters were already returned.

Test plan

• pnpm exec jest src/schema-types.test.ts --testNamePattern OpenRouterProvider in packages/db
• Confirm the next provider sync stores the URLs and /api/v1/providers returns them

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Small, additive change that threads OpenRouter dataPolicy.termsOfServiceURL/privacyPolicyURL through the raw-response Zod schema, the normalized snapshot, and the sync path; the fields stay optional, the read-side API schema already accepts them, and no consumer or audit-diff path is affected.

Files Reviewed (3 files)

• apps/web/src/lib/providers/openrouter/sync-providers.ts
• packages/db/src/schema-types.ts
• packages/db/src/schema-types.test.ts

Notes

• packages/db/src/schema-types.ts:1949-1950,1979-1980: The two fields are declared z.string().optional(), matching how the pre-existing read-side schema in packages/web-shared/src/lib/organizations/organization-types.ts:304-305 already models them, so stored snapshots with and without the fields both continue to parse.
• apps/web/src/lib/providers/openrouter/sync-providers.ts:280-281: The added assignments rely on the shard's canonical re-export (openrouter-types.ts re-exports from @kilocode/db/schema-types), so no duplicate type drift. Because z.object strips unknown keys, the raw-response schema addition is what makes these survive OpenRouterProvidersResponse.parse; the change is therefore the missing piece rather than a no-op.
• Snapshot diffing (snapshot-diff.ts) compares only provider→model pairs, so the extra provider fields do not trigger spurious auto-model-change audit logs on the next sync. No memory-retention or subscription concerns (no timers/listeners/caches added).
• Could not verify against the live OpenRouter response whether the upstream all-providers payload emits these under dataPolicy and never as null; the field names match the existing repository interfaces, but the PR's own test plan still lists "Confirm the next provider sync stores the URLs" as unchecked.

---

_{Reviewed by deepseek-v4.1-flash · Input: 75.7K · Output: 19.2K · Cached: 1.4M}

_{Review guidance: REVIEW.md from base branch main}