@unorouter/verify-core 0.1.0

package/dist/signals.js

@@ -0,0 +1,64 @@
+import { CJK_CHAR, CJK_LEAK_MIN_CHARS, CLOUD_HOST_PATTERNS, CODING_TOOL_NAMES, CODING_TOOL_REFUSAL_PATTERNS, SCAM_PAGE_PATTERNS, } from "./patterns";
+export const includesAny = (text, patterns) => patterns.some((p) => text.includes(p));
+export const hasCodingToolRefusal = (text) => includesAny(text, CODING_TOOL_NAMES) ||
+    includesAny(text, CODING_TOOL_REFUSAL_PATTERNS);
+export const hasScamPage = (text) => includesAny(text, SCAM_PAGE_PATTERNS);
+export function cjkLeak(text) {
+    const m = text.match(CJK_CHAR);
+    return m !== null && m.length >= CJK_LEAK_MIN_CHARS;
+}
+export function hasForeignIdentity(text, foreignPatterns, cloudModelNamePatterns, probe) {
+    if (includesAny(text, foreignPatterns))
+        return true;
+    if (probe === "model-name" && includesAny(text, cloudModelNamePatterns))
+        return true;
+    return false;
+}
+export function tierOf(text, tiers) {
+    const found = tiers.filter((tier) => text.includes(tier));
+    return found.length === 1 ? found[0] : null;
+}
+export function detectTierMismatch(requestedModel, modelNameText, tiers) {
+    const reqTier = tierOf(requestedModel.toLowerCase(), tiers);
+    if (!reqTier)
+        return null;
+    if (!modelNameText)
+        return null;
+    const saidTier = tierOf(modelNameText, tiers);
+    if (saidTier && saidTier !== reqTier)
+        return saidTier;
+    return null;
+}
+export function detectSignal(text, probeLabel, foreignPatterns, cloudModelNamePatterns, acceptsCloudHostIdentity) {
+    if (text.length === 0)
+        return "blank";
+    if (hasCodingToolRefusal(text))
+        return "coding-tool";
+    if (hasScamPage(text))
+        return "scam";
+    if (cjkLeak(text))
+        return "cjk-leak";
+    if (probeLabel === "identity" || probeLabel === "model-name") {
+        if (hasForeignIdentity(text, foreignPatterns, cloudModelNamePatterns, probeLabel))
+            return "foreign";
+        if (probeLabel === "identity" &&
+            acceptsCloudHostIdentity &&
+            includesAny(text, CLOUD_HOST_PATTERNS))
+            return "cloud-host";
+    }
+    return null;
+}
+const TRANSIENT_HTTP = [408, 425, 429, 500, 502, 503, 504, 520, 522, 524];
+export function isTransientError(msg) {
+    const m = msg.match(/HTTP (\d{3})/);
+    if (m && TRANSIENT_HTTP.includes(Number(m[1])))
+        return true;
+    const lower = msg.toLowerCase();
+    return (lower.includes("timeout") ||
+        lower.includes("timed out") ||
+        lower.includes("econnreset") ||
+        lower.includes("socket") ||
+        lower.includes("network") ||
+        lower.includes("fetch failed"));
+}
+//# sourceMappingURL=signals.js.map

package/dist/signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.js","sourceRoot":"","sources":["../src/signals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,EAAE,CACnD,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACpC,WAAW,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAC1C,WAAW,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AAExC,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,kBAAkB,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,eAAyB,EACzB,sBAAgC,EAChC,KAAiB;IAEjB,IAAI,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,KAAK,YAAY,IAAI,WAAW,CAAC,IAAI,EAAE,sBAAsB,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,cAAsB,EACtB,aAAiC,EACjC,KAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAsB,EACtB,eAAyB,EACzB,sBAAgC,EAChC,wBAAiC;IAEjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACtC,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACrD,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC7D,IACE,kBAAkB,CAChB,IAAI,EACJ,eAAe,EACf,sBAAsB,EACtB,UAAU,CACX;YAED,OAAO,SAAS,CAAC;QACnB,IACE,UAAU,KAAK,UAAU;YACzB,wBAAwB;YACxB,WAAW,CAAC,IAAI,EAAE,mBAAmB,CAAC;YAEtC,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE1E,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC/B,CAAC;AACJ,CAAC"}

package/dist/substitution.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Envelope-level model substitution: the endpoint answers with a different
+ * model id than the one requested.
+ *
+ * This catches the fraud that every behavioural probe passes, because the reply
+ * genuinely IS the vendor's model, just a cheaper one than billed for. It costs
+ * nothing: the id is already in the response every probe makes.
+ */
+/**
+ * Ported from new-api-sync (`core/testing/runner.ts`), where the leniency is
+ * load-bearing. A strict comparison once condemned an honest upstream and cost
+ * it all ten of its Claude models, so this tolerates the three ways vendors
+ * legitimately spell the same model:
+ *   - separator drift        claude-opus-4.8   vs claude-opus-4-8
+ *   - vendor-qualified ids   anthropic/claude-opus-5 vs claude-opus-5
+ *   - dated snapshots        claude-haiku-4-5  vs claude-haiku-4-5-20251001
+ */
+export declare function modelsMatch(requested: string, served: string): boolean;
+/**
+ * The served id when it contradicts the request, else null. A missing id is not
+ * evidence: plenty of honest relays omit it.
+ */
+export declare function detectSubstitution(requested: string, detectedModel: string | null | undefined): string | null;
+//# sourceMappingURL=substitution.d.ts.map

package/dist/substitution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substitution.d.ts","sourceRoot":"","sources":["../src/substitution.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOtE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,MAAM,GAAG,IAAI,CAGf"}

package/dist/substitution.js

@@ -0,0 +1,35 @@
+/**
+ * Envelope-level model substitution: the endpoint answers with a different
+ * model id than the one requested.
+ *
+ * This catches the fraud that every behavioural probe passes, because the reply
+ * genuinely IS the vendor's model, just a cheaper one than billed for. It costs
+ * nothing: the id is already in the response every probe makes.
+ */
+/**
+ * Ported from new-api-sync (`core/testing/runner.ts`), where the leniency is
+ * load-bearing. A strict comparison once condemned an honest upstream and cost
+ * it all ten of its Claude models, so this tolerates the three ways vendors
+ * legitimately spell the same model:
+ *   - separator drift        claude-opus-4.8   vs claude-opus-4-8
+ *   - vendor-qualified ids   anthropic/claude-opus-5 vs claude-opus-5
+ *   - dated snapshots        claude-haiku-4-5  vs claude-haiku-4-5-20251001
+ */
+export function modelsMatch(requested, served) {
+    const norm = (s) => s.toLowerCase().replace(/[.]/g, "-").split("/").pop() ?? "";
+    const a = norm(requested);
+    const b = norm(served);
+    if (!a || !b)
+        return true;
+    return a === b || a.startsWith(b) || b.startsWith(a);
+}
+/**
+ * The served id when it contradicts the request, else null. A missing id is not
+ * evidence: plenty of honest relays omit it.
+ */
+export function detectSubstitution(requested, detectedModel) {
+    if (!detectedModel)
+        return null;
+    return modelsMatch(requested, detectedModel) ? null : detectedModel;
+}
+//# sourceMappingURL=substitution.js.map

package/dist/substitution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substitution.js","sourceRoot":"","sources":["../src/substitution.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CACzB,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,aAAwC;IAExC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;AACtE,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,17 @@
+import type { TransportMode } from "./types";
+export type TransportResult = {
+    status: number | null;
+    data: unknown;
+    error: string | null;
+    corsBlocked: boolean;
+};
+export type TransportArgs = {
+    mode: TransportMode;
+    url: string;
+    headers: Record<string, string>;
+    reqBody: unknown;
+    timeoutMs: number;
+};
+export type TransportFn = (args: TransportArgs) => Promise<TransportResult>;
+export declare function probeTransport(args: TransportArgs): Promise<TransportResult>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAgF5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5E"}

package/dist/transport.js

@@ -0,0 +1,79 @@
+import { errMessage, rec } from "./internal/utils";
+// CORS block and dead host both surface as an opaque TypeError
+// (whatwg/fetch#1123). no-cors strips Authorization, so this proves reachability
+// ONLY and its opaque response must never be inspected.
+async function corsBlockedNotUnreachable(url, timeoutMs) {
+    try {
+        await fetch(url, {
+            method: "POST",
+            mode: "no-cors",
+            body: "{}",
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function direct(args) {
+    try {
+        const res = await fetch(args.url, {
+            method: "POST",
+            headers: args.headers,
+            body: JSON.stringify(args.reqBody),
+            signal: AbortSignal.timeout(args.timeoutMs),
+        });
+        const data = await res.json().catch(() => null);
+        return { status: res.status, data, error: null, corsBlocked: false };
+    }
+    catch (err) {
+        const isAbort = err instanceof DOMException && err.name === "AbortError";
+        const msg = errMessage(err);
+        return {
+            status: null,
+            data: null,
+            error: isAbort ? "timeout" : msg,
+            corsBlocked: !isAbort &&
+                err instanceof TypeError &&
+                (await corsBlockedNotUnreachable(args.url, args.timeoutMs)),
+        };
+    }
+}
+async function viaServer(args) {
+    try {
+        const res = await fetch("/api/models/verify/probe", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                url: args.url,
+                headers: args.headers,
+                reqBody: args.reqBody,
+            }),
+            signal: AbortSignal.timeout(args.timeoutMs + 5000),
+        });
+        const wrapped = rec(await res.json().catch(() => null));
+        const inner = rec(wrapped?.data);
+        if (!inner || typeof inner.status !== "number")
+            return {
+                status: null,
+                data: null,
+                error: `proxy HTTP ${res.status}`,
+                corsBlocked: false,
+            };
+        return {
+            status: inner.status,
+            data: inner.data,
+            error: null,
+            corsBlocked: false,
+        };
+    }
+    catch (err) {
+        const msg = errMessage(err);
+        return { status: null, data: null, error: msg, corsBlocked: false };
+    }
+}
+export function probeTransport(args) {
+    return args.mode === "server" ? viaServer(args) : direct(args);
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAoBnD,+DAA+D;AAC/D,iFAAiF;AACjF,wDAAwD;AACxD,KAAK,UAAU,yBAAyB,CACtC,GAAW,EACX,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAmB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YAChC,WAAW,EACT,CAAC,OAAO;gBACR,GAAG,YAAY,SAAS;gBACxB,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YAC5C,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,cAAc,GAAG,CAAC,MAAM,EAAE;gBACjC,WAAW,EAAE,KAAK;aACnB,CAAC;QACJ,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+export type VerifyProvider = "anthropic" | "openai" | "gemini";
+export type VerifyVerdict = "genuine" | "suspicious" | "unverified";
+export type ProbeLabel = "emotional" | "creative" | "identity" | "model-name";
+export type ProbeSignal = "coding-tool" | "scam" | "foreign" | "cloud-host" | "cjk-leak" | "blank" | null;
+export type TransportMode = "direct" | "server";
+export type ProbeUsage = {
+    prompt: number | null;
+    completion: number | null;
+    total: number | null;
+};
+export type ProbeOutcome = {
+    label: ProbeLabel;
+    pass: boolean;
+    signal: ProbeSignal;
+    muxFailure: boolean;
+    transient: boolean;
+    latencyMs: number;
+    prompt: string;
+    responseText: string | null;
+    httpStatus: number | null;
+    usage: ProbeUsage | null;
+    detectedModel: string | null;
+    reason: string | null;
+};
+export type VerifyResult = {
+    provider: VerifyProvider;
+    model: string;
+    baseUrlHost: string;
+    verdict: VerifyVerdict;
+    versionUnverifiable: boolean;
+    probes: ProbeOutcome[];
+    reasons: string[];
+    probesPassed: number;
+    probesTotal: number;
+    latencyMs: number;
+    transport: TransportMode;
+    corsBlocked: boolean;
+    detectedModel: string | null;
+    totalUsage: ProbeUsage | null;
+    resolvedProvider: VerifyProvider;
+    connectivityError: "cors-needs-backend" | "unreachable" | "invalid-key" | "no-format" | null;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAC;AAEpE,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;AAE9E,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,MAAM,GACN,SAAS,GACT,YAAY,GACZ,UAAU,GACV,OAAO,GACP,IAAI,CAAC;AAET,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,cAAc,CAAC;IACjC,iBAAiB,EACf,oBAAoB,GAAG,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,IAAI,CAAC;CAC7E,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/verdict.d.ts

@@ -0,0 +1,19 @@
+import type { ProviderConfig } from "./providers/config";
+import type { ProbeOutcome, ProbeSignal, VerifyVerdict } from "./types";
+export type ProbeEval = ProbeOutcome & {
+    text: string | undefined;
+};
+export type VerdictResult = {
+    verdict: VerifyVerdict;
+    reasons: string[];
+    versionUnverifiable: boolean;
+};
+export declare function aggregateVerdict(args: {
+    model: string;
+    cfg: ProviderConfig;
+    results: ProbeEval[];
+    /** Model id echoed by the endpoint, when it reported one. */
+    detectedModel?: string | null;
+}): VerdictResult;
+export declare function probeReason(pass: boolean, signal: ProbeSignal, muxFailure: boolean, transient: boolean): string;
+//# sourceMappingURL=verdict.d.ts.map

package/dist/verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAEV,YAAY,EACZ,WAAW,EACX,aAAa,EACd,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CAAC;AAWF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,cAAc,CAAC;IACpB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,aAAa,CAwEhB;AAUD,wBAAgB,WAAW,CACzB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,OAAO,EACnB,SAAS,EAAE,OAAO,GACjB,MAAM,CAUR"}

package/dist/verdict.js

@@ -0,0 +1,84 @@
+import { detectTierMismatch } from "./signals";
+import { detectSubstitution } from "./substitution";
+const labelsWith = (results, sig) => results
+    .filter((r) => r.signal === sig)
+    .map((r) => r.label)
+    .join(", ");
+const firstSignal = (results, sig) => results.some((r) => r.signal === sig) ? labelsWith(results, sig) : null;
+export function aggregateVerdict(args) {
+    const results = args.results;
+    const reasons = [];
+    const codingTool = firstSignal(results, "coding-tool");
+    if (codingTool)
+        return suspicious(`coding-tool-refusal: ${codingTool}`);
+    const scam = firstSignal(results, "scam");
+    if (scam)
+        return suspicious(`scam-page: ${scam}`);
+    const cjk = firstSignal(results, "cjk-leak");
+    if (cjk)
+        return suspicious(`cjk-language-leak: ${cjk}`);
+    const muxLabels = results.filter((r) => r.muxFailure).map((r) => r.label);
+    if (muxLabels.length >= 2)
+        return suspicious(`unsafe-proxy: response-mixing on ${muxLabels.join(", ")}`);
+    const foreignOnIdentity = results.some((r) => r.signal === "foreign" &&
+        (r.label === "model-name" || r.label === "identity"));
+    if (foreignOnIdentity)
+        return suspicious(`foreign-identity: ${labelsWith(results, "foreign")}`);
+    if (args.cfg.tiers) {
+        const modelNameText = results.find((r) => r.label === "model-name")?.text;
+        const served = detectTierMismatch(args.model, modelNameText, args.cfg.tiers);
+        if (served)
+            return suspicious(`tier-mismatch: requested ${args.model}, served ${served}`);
+    }
+    // Envelope check, free: the endpoint told us which model answered, and it is
+    // not the one asked for. Runs after tier-mismatch because that names the
+    // cheaper tier specifically, which reads better than a raw id diff.
+    const substituted = detectSubstitution(args.model, args.detectedModel);
+    if (substituted)
+        return suspicious(`substituted: requested ${args.model}, served ${substituted}`);
+    const passed = results.filter((r) => r.pass).length;
+    const failed = results.filter((r) => !r.pass);
+    const passing = passed >= 3;
+    if (passing)
+        return {
+            verdict: "genuine",
+            reasons,
+            versionUnverifiable: true,
+        };
+    const transientFails = failed.filter((r) => r.transient).length;
+    const nonTransientFails = failed.filter((r) => !r.transient && r.signal !== null).length;
+    if (transientFails > 0 && nonTransientFails === 0)
+        return {
+            verdict: "unverified",
+            reasons: [`transient: ${failed.map((r) => r.label).join(", ")}`],
+            versionUnverifiable: false,
+        };
+    return suspicious(`failed: ${failed.map((r) => r.label).join(", ")}`);
+}
+function suspicious(reason) {
+    return {
+        verdict: "suspicious",
+        reasons: [reason],
+        versionUnverifiable: false,
+    };
+}
+export function probeReason(pass, signal, muxFailure, transient) {
+    if (signal === "coding-tool")
+        return "coding-tool wrapper detected";
+    if (signal === "scam")
+        return "scam page detected";
+    if (signal === "cjk-leak")
+        return "CJK leaked into an English reply";
+    if (signal === "foreign")
+        return "foreign vendor named";
+    if (signal === "cloud-host")
+        return "cloud host named (accepted)";
+    if (signal === "blank")
+        return "blank response";
+    if (muxFailure)
+        return "response mixing (nonce mismatch)";
+    if (transient)
+        return "transient upstream error";
+    return pass ? "passed" : "failed quality check";
+}
+//# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAiBpD,MAAM,UAAU,GAAG,CAAC,OAAoB,EAAE,GAAgB,EAAE,EAAE,CAC5D,OAAO;KACJ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC;KAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACnB,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhB,MAAM,WAAW,GAAG,CAAC,OAAoB,EAAE,GAAgB,EAAE,EAAE,CAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE1E,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;QACvB,OAAO,UAAU,CACf,oCAAoC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;IAEJ,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CACvD,CAAC;IACF,IAAI,iBAAiB;QACnB,OAAO,UAAU,CAAC,qBAAqB,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAM,YAAkC,CACvD,EAAE,IAAI,CAAC;QACR,MAAM,MAAM,GAAG,kBAAkB,CAC/B,IAAI,CAAC,KAAK,EACV,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,KAAK,CACf,CAAC;QACF,IAAI,MAAM;YACR,OAAO,UAAU,CACf,4BAA4B,IAAI,CAAC,KAAK,YAAY,MAAM,EAAE,CAC3D,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,WAAW;QACb,OAAO,UAAU,CACf,0BAA0B,IAAI,CAAC,KAAK,YAAY,WAAW,EAAE,CAC9D,CAAC;IAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC;IAE5B,IAAI,OAAO;QACT,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,OAAO;YACP,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IAEJ,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CACzC,CAAC,MAAM,CAAC;IACT,IAAI,cAAc,GAAG,CAAC,IAAI,iBAAiB,KAAK,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE,CAAC,cAAc,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,mBAAmB,EAAE,KAAK;SAC3B,CAAC;IAEJ,OAAO,UAAU,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,mBAAmB,EAAE,KAAK;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,MAAmB,EACnB,UAAmB,EACnB,SAAkB;IAElB,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,8BAA8B,CAAC;IACpE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,oBAAoB,CAAC;IACnD,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,kCAAkC,CAAC;IACrE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IACxD,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,6BAA6B,CAAC;IAClE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,kCAAkC,CAAC;IAC1D,IAAI,SAAS;QAAE,OAAO,0BAA0B,CAAC;IACjD,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAClD,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@unorouter/verify-core",
+  "version": "0.1.0",
+  "description": "Authenticity and capability checks for AI API relays: is this endpoint really the Claude / GPT / Gemini model it claims?",
+  "license": "AGPL-3.0-only",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/unorouter/verify-core.git"
+  },
+  "keywords": [
+    "llm",
+    "relay",
+    "proxy",
+    "authenticity",
+    "anthropic",
+    "openai",
+    "gemini"
+  ],
+  "sideEffects": false,
+  "files": ["dist"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./providers/*": {
+      "types": "./dist/providers/*.d.ts",
+      "default": "./dist/providers/*.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3"
+  }
+}