fix(ai-gateway): populate is_byok from Vercel gateway modelAttempts

[kilo-code-bot]

Summary

• Vercel AI Gateway responses were logging is_byok = null even though the gateway does report BYOK-vs-system credential information via provider_metadata.gateway.routing.modelAttempts[].providerAttempts[].credentialType. The messages, responses, and chat-completions code paths all hard-coded is_byok: null on the Vercel branch.
• Added extractVercelIsByok in processUsage.shared.ts that walks the successful modelAttempts → providerAttempts and maps credentialType ("byok" → true, "system" → false, otherwise null).
• Wired the helper into processMessagesApiUsage, processResponsesApiUsage, and processOpenRouterUsage (used by chat completions) so that Vercel-served requests populate is_byok whenever the gateway surfaces it. For chat completions we capture provider_metadata from both stream chunks and the non-streaming JSON and forward it to processOpenRouterUsage.
• Extended the VercelProviderMetaData type with modelAttempts/providerAttempts shape. Updated approval fixtures and added unit tests covering byok, system, and the case where the first provider attempt fails.

Verification

• Inspected the sample vercel-messages.log.resp.sse / vercel-responses.log.resp.sse fixtures: both contain credentialType: "byok" in the gateway routing, and the updated approval JSON now reflects is_byok: true.

Visual Changes

N/A

Reviewer Notes

• Falls back gracefully when modelAttempts is absent (some upstream paths/providers may omit it), preserving the previous null behavior rather than guessing.
• OpenRouter path is untouched when usage.is_byok is set; the Vercel metadata is only consulted when OpenRouter didn't provide a value.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/ai-gateway/processUsage.messages.test.ts
• apps/web/src/lib/ai-gateway/processUsage.responses.test.ts

---

_{Reviewed by gpt-5.5-2026-04-23 · 259,950 tokens}