fix(gateway): decode bounded Zstandard inference requests

[marius-kilocode]

What Problem This Solves

Large inference JSON can exceed the Vercel Function body limit even when the selected model still has context capacity. Images, tool context, and encrypted reasoning contribute to the request. The gateway currently reads compressed bytes as text, so a Zstandard request reaches the handler but fails JSON parsing.

Why This Change Was Made

Accept Content-Encoding: zstd at the shared OpenRouter gateway handler and its /api/gateway alias, then pass the decoded JSON through the existing validation, authentication, routing, and accounting flow. Ordinary identity requests retain Fetch UTF-8 and BOM handling. No image or reasoning transformation and no provider API schema change is introduced.

Use native Node Zstandard with application-defined 32 MiB input and decoded-output limits and a 32 MiB decoder-window limit. These are resource bounds, not claims about Vercel or provider limits. Unsupported or stacked encodings return 415, malformed frames 400, resource-limit failures 413, and cancellation 499. The upstream request does not inherit the compressed Content-Encoding or Content-Length.

Accept exactly one complete standard Zstandard frame. Node 24 can accept truncated frames or silently discard additional frames, so explicit frame-boundary validation rejects truncated, concatenated, and skippable bodies rather than accepting incomplete content.

User Impact

Clients can send larger decoded inference payloads within the wire-size limit without reducing image quality or discarding conversation content. This does not remove provider context limits or the Vercel limit on compressed bytes.

Deploy this gateway change before enabling the client counterpart: Kilo-Org/kilocode#13675. The client PR remains in draft for this server-first rollout. The repository pins Node 24; deployed runtimes must provide native Zstandard.

Evidence

Node 24.14.1 passed 112 focused tests across the decoder, existing gateway route suite, and upstream timeout suite. Web typecheck, changed-file lint, formatting, and whitespace checks pass. Route tests verify validation through both aliases and decoded upstream JSON without compressed transport headers. Independent offline review exercised framing and stalled-stream cleanup on Node 25 without finding an actionable issue.

A local Node 24 HTTP test connected the actual client encoder to this decoder: 4,711,235 identity bytes became 1,123,346 wire bytes, with identical decoded SHA-256 and unchanged image and reasoning fields. The fixture contains repeated images; this ratio is not a general compression guarantee. Additional local checks reject truncation and stacked encodings. No model provider was called, and this PR has not been deployed or validated end to end on hosted Vercel.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/src/app/api/openrouter/[...path]/route.ts
• apps/web/src/app/api/openrouter/[...path]/route.test.ts
• apps/web/src/lib/ai-gateway/request-body.ts
• apps/web/src/lib/ai-gateway/request-body.test.ts

---

_{Reviewed by grok-4.6 · Input: 340.8K · Output: 27.2K · Cached: 263K}

_{Review guidance: REVIEW.md from base branch main}