[iscekic]

What changed

packages/web-shared/src/lib/ai-gateway/byok/index.ts

addUserByokAvailability reached the Vercel model metadata map through
getModelUserByokProviders once per model, and that helper enumerated the whole
map's keys (Object.keys(vercelModelMetadata).length === 0) for every model it was
asked about. The pass therefore visited every metadata key once per model.

• The per-model derivation (endpoint-to-provider mapping, dedupe, the empty-provider
  diagnostic, and the codestral prepend) moves into one private helper
  deriveModelUserByokProviders(modelId, vercelModelMetadata) that takes the
  already-fetched map.
• getModelUserByokProviders keeps its exported signature, its output, and its
  per-model diagnostics; it fetches the map, keeps the empty-metadata early return,
  and delegates to the helper.
• addUserByokAvailability fetches the map once, tests emptiness once, and derives
  each model from it with a keyed lookup. The hasUserByokAvailable values, the
  isKiloExclusiveModel short circuit and the empty-metadata result (no model reports
  BYOK availability) are unchanged. The empty-metadata error is logged once per pass
  ([addUserByokAvailability] no Vercel model metadata) instead of once per model.

main now carries drain PR #8348, which shares the owner lookups
(getEnabledByokProviderIds, getByokRowsForOwner) and adds byok/index.test.ts.
The branch is merged with that state: those helpers stay exactly as main wrote
them, and only the metadata fetch, the per-model derivation helper and the
availability pass differ.

Regression test

New hermetic suite packages/web-shared/src/lib/ai-gateway/byok/availability.test.ts
(mocks getVercelModelsMetadataFromDatabase and mapModelIdToVercel, no database
rows) pins:

• exactly one metadata read for a five-model pass, with per-model availability:
  owned provider true, unowned provider false, model absent from the map false,
  Kilo-exclusive model false, and the public model fields left unmutated;
• empty map: every model false, still one metadata read;
• getModelUserByokProviders parity: deduped providers, codestral first, empty list
  for a model missing from the map and for an empty map.

Against the previous implementation the first test fails with
Expected number of calls: 1, Received number of calls: 4.

Verification

Environment: local dev stack on this VM (nextjs :3000, ai-gateway :3010, compose
Postgres/Redis), owned fake account byok-perf-20261021@example.com created directly
in the local database, app:byok-e2e-fixture minimax minimax/minimax-m2.5 seeding one
enabled BYOK key for minimax plus a Vercel metadata snapshot entry for that model,
and a local API token from app:api-token.

GET /api/v1/models with that bearer token, after restarting ai-gateway to clear the
60-second catalog and 300-second metadata caches:

run	models	hasUserByokAvailable: true
branch head	404	minimax/minimax-m2.5
main (implementation stashed, gateway restarted)	404	minimax/minimax-m2.5

The two response bodies are identical (same ids, same order, same flags, full JSON
equality), so the pass keeps its output while reading the metadata once.

Unit suites, run on the VM with a migrated local Postgres:

pnpm --filter web exec jest --runInBand \
  packages/web-shared/src/lib/ai-gateway/byok/availability.test.ts \
  packages/web-shared/src/lib/ai-gateway/handlers/models.test.ts \
  packages/web-shared/src/lib/organizations/organization-models.test.ts \
  src/tests/openrouter-models.test.ts
Test Suites: 4 passed, 4 total
Tests:       115 passed, 115 total

openrouter-models.test.ts drives the real addUserByokAvailability through its
staged-concurrency cases, so the pass still composes with the surrounding catalog
branches.

After merging main into the branch, the same suites plus the owner-lookup suite
packages/web-shared/src/lib/ai-gateway/byok/index.test.ts run on the merged tree:

pnpm exec jest --runInBand \
  packages/web-shared/src/lib/ai-gateway/byok/availability.test.ts \
  packages/web-shared/src/lib/ai-gateway/byok/index.test.ts \
  packages/web-shared/src/lib/ai-gateway/handlers/models.test.ts \
  packages/web-shared/src/lib/ai-gateway/handlers/organization-models.test.ts \
  packages/web-shared/src/lib/organizations/organization-models.test.ts
Test Suites: 5 passed, 5 total
Tests:       41 passed, 41 total

CI on the merged head: 55 checks passed, 0 failed. The one metadata read per pass
and the unchanged availability flags still hold; the merge only adopts main's
owner-lookup helpers.

pnpm --filter @kilocode/web-shared run typecheck   # clean
pnpm exec oxfmt --check <changed files>            # clean

No screenshots: the affected surface is a JSON API response, and the evidence above is
the observed response bodies.

Proxy answers

The owner's proxy gave these answers in the owner's place.

1. Question: Test file: The perf property (one metadata read per pass) needs a regression test. Open drain PR refactor(ai-gateway): share BYOK owner lookups and inline the direct BYOK dedupe #8348 also adds packages/web-shared/src/lib/ai-gateway/byok/index.test.ts (DB-backed, covers the other functions). Which test placement?
   Answer: New byok/availability.test.ts, hermetic mocks
   Confidence: 0.80 · Precedent: Keep CI checks that catch real errors in PRs: session 99e88001c4b4, "we want to catch errors in PRs, as early as possible"
2. Question: Empty metadata: When the Vercel metadata map is empty, today every model logs an error naming itself. The brief says log once per pass. What should the single line say?
   Answer: [addUserByokAvailability] no Vercel model metadata
   Confidence: 0.80 · Precedent: Autonomy: make executive decisions with "is this reasonable?" as the test (session 7f3470e0ba6f); the brief requires one log per pass
3. Question: Scope: Should the pass also hoist the other per-model lookups it now touches (mapModelIdToVercel's cached overrides and alias resolution)?
   Answer: No, hoist only the metadata map
   Confidence: 0.75 · Precedent: Keep each PR diff to files that the feature needs: session df491946927a, "PR should be checked for stray changes before merging"
4. Question: E2E: How should the fixed behavior be proven end to end on this VM?
   Answer: Dev stack, /api/v1/models before vs after
   Confidence: 0.85 · Precedent: Prove behavior with a real request through real clients: session 4807b1d78fc7, "you can use it to make an actual request"

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The refactor is output-preserving: addUserByokAvailability derives each model's providers from a single metadata read, the empty-metadata path is gated by hasMetadata, and getModelUserByokProviders keeps its exported signature, diagnostics and results.

Files Reviewed (2 files)

• packages/web-shared/src/lib/ai-gateway/byok/index.ts
• packages/web-shared/src/lib/ai-gateway/byok/availability.test.ts

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 52.7K · Output: 12.7K · Cached: 650.1K}

_{Review guidance: REVIEW.md from base branch main}