ai-model-verifier 1.0.0

package/README.md

@@ -0,0 +1,40 @@
+# ai-model-verifier
+
+**Is that API endpoint really serving the model it claims?**
+
+Resellers and relay stations sell "Claude Opus" or "GPT-5" and quietly serve
+something cheaper. Given a `base_url`, `api_key` and `model`, this library
+probes the endpoint and reports what it actually found: a substituted model, a
+downgraded Claude tier, a stripped thinking signature, inflated token billing,
+or a translation layer sitting in front of the real vendor.
+
+Extracted from [unorouter](https://unorouter.com)'s model tester so the same
+engine runs in the browser, on a server, and inside our sync pipeline.
+
+## Design
+
+- **Isomorphic.** Web-standard APIs only (`fetch`, `TextEncoder`,
+  `AbortSignal`); no `node:` imports. The HTTP call itself is injected as a
+  `TransportFn`, so a browser can route around CORS and a server can route
+  through an SSRF-safe fetch.
+- **Opt-in.** Providers and detectors have their own entry points, so a consumer
+  that only checks Anthropic never bundles the Gemini config.
+- **Zero required dependencies.**
+
+## Use
+
+```ts
+import { runVerification } from "ai-model-verifier";
+import { anthropicConfig } from "ai-model-verifier/providers/anthropic";
+```
+
+## What it detects
+
+`coding-tool` refusals (Kiro/Amazon Q wearing a Claude badge), scam pages,
+CJK language leaks from a substituted Chinese model, response-mixing proxies,
+foreign vendor identity, Claude tier substitution (opus billed, sonnet served),
+and envelope-level model substitution.
+
+## License
+
+AGPL-3.0-only.

package/dist/detectors/response-metadata.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Passive response metadata: what the envelope reveals about who really
+ * answered, read from responses the run already made.
+ *
+ * Costs nothing (no extra requests) and asserts nothing. Everything here is
+ * reported as observation, because each signal has an honest explanation as
+ * well as a dishonest one:
+ *
+ *  - a `chatcmpl-` id inside an Anthropic-shaped reply means a translation
+ *    layer, which is what our own gateway is;
+ *  - OpenAI-style `usage` keys in a Messages reply mean the same;
+ *  - a missing id means a sloppy relay, not a fake model.
+ *
+ * The value is in the aggregate: over many lanes, "which of my Claude lanes
+ * answer with a chatcmpl id" is a question worth being able to ask.
+ */
+/** Vendor whose response shape the envelope actually looks like. */
+export type EnvelopeShape = "anthropic" | "openai" | "gemini" | "unknown";
+export type ResponseMetadata = {
+    /** Shape the payload matches, regardless of which API was called. */
+    shape: EnvelopeShape;
+    /** Shape the endpoint was asked to speak. */
+    expected: EnvelopeShape;
+    /** True when a translating hop sits between us and the model. */
+    translated: boolean;
+    /** e.g. "msg_", "chatcmpl-", "resp_"; null when the id is absent or odd. */
+    idPrefix: string | null;
+    /** Usage field names present, sorted. A cross-vendor mix is the tell. */
+    usageKeys: string[];
+    /** Foreign-vendor residue in the usage object, e.g. claude_* under OpenAI. */
+    foreignUsageKeys: string[];
+    /** Facts worth surfacing, in plain words. No verdict attached. */
+    notes: string[];
+};
+export declare function readResponseMetadata(data: unknown, expected: EnvelopeShape): ResponseMetadata;
+//# sourceMappingURL=response-metadata.d.ts.map

package/dist/detectors/response-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-metadata.d.ts","sourceRoot":"","sources":["../../src/detectors/response-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qEAAqE;IACrE,KAAK,EAAE,aAAa,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,EAAE,aAAa,CAAC;IACxB,iEAAiE;IACjE,UAAU,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,kEAAkE;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAuCF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,aAAa,GACtB,gBAAgB,CAyClB"}

package/dist/detectors/response-metadata.js

@@ -0,0 +1,91 @@
+/**
+ * Passive response metadata: what the envelope reveals about who really
+ * answered, read from responses the run already made.
+ *
+ * Costs nothing (no extra requests) and asserts nothing. Everything here is
+ * reported as observation, because each signal has an honest explanation as
+ * well as a dishonest one:
+ *
+ *  - a `chatcmpl-` id inside an Anthropic-shaped reply means a translation
+ *    layer, which is what our own gateway is;
+ *  - OpenAI-style `usage` keys in a Messages reply mean the same;
+ *  - a missing id means a sloppy relay, not a fake model.
+ *
+ * The value is in the aggregate: over many lanes, "which of my Claude lanes
+ * answer with a chatcmpl id" is a question worth being able to ask.
+ */
+const ANTHROPIC_USAGE = new Set([
+    "input_tokens",
+    "output_tokens",
+    "cache_read_input_tokens",
+    "cache_creation_input_tokens",
+]);
+const OPENAI_USAGE = new Set([
+    "prompt_tokens",
+    "completion_tokens",
+    "total_tokens",
+]);
+const GEMINI_USAGE = new Set([
+    "promptTokenCount",
+    "candidatesTokenCount",
+    "totalTokenCount",
+    "thoughtsTokenCount",
+]);
+function idPrefixOf(id) {
+    if (typeof id !== "string" || id.length === 0)
+        return null;
+    for (const p of ["msg_", "chatcmpl-", "resp_", "call_", "toolu_"])
+        if (id.startsWith(p))
+            return p;
+    // An unrecognised shape (a bare UUID, say) is itself worth reporting.
+    const cut = id.search(/[-_]/);
+    return cut > 0 ? id.slice(0, cut + 1) : "(none)";
+}
+function shapeOf(data, usageKeys) {
+    if (data["candidates"] !== undefined || usageKeys.some((k) => GEMINI_USAGE.has(k)))
+        return "gemini";
+    if (data["choices"] !== undefined || usageKeys.some((k) => OPENAI_USAGE.has(k)))
+        return "openai";
+    if (data["content"] !== undefined || usageKeys.some((k) => ANTHROPIC_USAGE.has(k)))
+        return "anthropic";
+    return "unknown";
+}
+export function readResponseMetadata(data, expected) {
+    const obj = (data ?? {});
+    const usage = (obj["usage"] ?? {});
+    const usageKeys = Object.keys(usage).sort();
+    const shape = shapeOf(obj, usageKeys);
+    const idPrefix = idPrefixOf(obj["id"]);
+    const notes = [];
+    // Usage keys belonging to a vendor other than the shape we are reading.
+    const foreignUsageKeys = usageKeys.filter((k) => {
+        if (k.startsWith("claude_"))
+            return shape !== "anthropic";
+        if (k.startsWith("gemini_"))
+            return shape !== "gemini";
+        if (ANTHROPIC_USAGE.has(k))
+            return shape !== "anthropic";
+        if (OPENAI_USAGE.has(k))
+            return shape !== "openai";
+        if (GEMINI_USAGE.has(k))
+            return shape !== "gemini";
+        return false;
+    });
+    const translated = shape !== "unknown" && shape !== expected;
+    if (translated)
+        notes.push(`answered in ${shape} shape though ${expected} was requested: a translating hop sits in front`);
+    if (expected === "anthropic" && idPrefix && idPrefix !== "msg_")
+        notes.push(`id starts "${idPrefix}" where Anthropic uses "msg_": the id was minted by something else`);
+    if (foreignUsageKeys.length > 0)
+        notes.push(`usage carries ${foreignUsageKeys.join(", ")}, which belong to another vendor's API`);
+    return {
+        shape,
+        expected,
+        translated,
+        idPrefix,
+        usageKeys,
+        foreignUsageKeys,
+        notes,
+    };
+}
+//# sourceMappingURL=response-metadata.js.map

package/dist/detectors/response-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-metadata.js","sourceRoot":"","sources":["../../src/detectors/response-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAsBH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,eAAe;IACf,yBAAyB;IACzB,6BAA6B;CAC9B,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,eAAe;IACf,mBAAmB;IACnB,cAAc;CACf,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,sBAAsB;IACtB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,EAAW;IAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC/D,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACjC,sEAAsE;IACtE,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,IAA6B,EAAE,SAAmB;IACjE,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,QAAiB,CAAC;IAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAiB,CAAC;IAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,WAAoB,CAAC;IAC9B,OAAO,SAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,QAAuB;IAEvB,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,wEAAwE;IACxE,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,KAAK,WAAW,CAAC;QAC1D,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvD,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,KAAK,WAAW,CAAC;QACzD,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnD,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,CAAC;IAC7D,IAAI,UAAU;QACZ,KAAK,CAAC,IAAI,CACR,eAAe,KAAK,iBAAiB,QAAQ,iDAAiD,CAC/F,CAAC;IACJ,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAC7D,KAAK,CAAC,IAAI,CACR,cAAc,QAAQ,oEAAoE,CAC3F,CAAC;IACJ,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,iBAAiB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACrF,CAAC;IAEJ,OAAO;QACL,KAAK;QACL,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/detectors/thinking-signature.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Anthropic thinking-signature check.
+ *
+ * Claude attaches a server-generated `signature` to every thinking block. A
+ * relay serving some other model cannot produce one, so this is the only
+ * evidence here that does not rest on asking the model who it is: identity and
+ * behaviour probes can be coached with a system prompt, a signature cannot.
+ *
+ * What it does NOT prove: which tier answered. Sonnet returns a perfectly valid
+ * signature when sold as Opus, so a pass here still needs the tier checks.
+ *
+ * Ported from veridrop (AGPL-3.0), whose detector stops at "a signature-shaped
+ * string is present".
+ *
+ * Their DESIGN.md also specifies a replay step (hand the thinking block back so
+ * Anthropic re-validates the signature, rejecting a forgery with 400/422) which
+ * they never implemented. We built and measured it: **it does not work through a
+ * relay**. Tested against two live upstreams (a6 merchant 3542 and pol) by
+ * replaying a genuine block and then the same block with 308 bytes of random
+ * base64 in place of the signature. Both upstreams returned 200 for both. A
+ * relay re-issues the turn to its own backend rather than passing our thinking
+ * block through, so nothing ever validates it.
+ *
+ * `strict` therefore stays off by default and is documented as proving only
+ * that the endpoint accepts the block, not that the signature is real. Do not
+ * present it as cryptographic proof.
+ */
+import type { TransportFn } from "../transport";
+export type SignatureState = 
+/** Signed thinking block: a genuine Anthropic path answered. */
+"signed"
+/**
+ * Thought, but no signature. Expected when the lane crosses an
+ * OpenAI-shaped hop, which has no field to carry one, so this is
+ * unprovable rather than fake. Never a hard fail on its own.
+ */
+ | "unsigned"
+/** Thinking was requested and no block came back at all. */
+ | "no-thinking"
+/** Model or endpoint cannot be asked; carries no evidence either way. */
+ | "skipped";
+export type SignatureResult = {
+    state: SignatureState;
+    signatureLength: number;
+    /** First 32 chars, for the report; never the whole signature. */
+    signaturePrefix: string | null;
+    thinkingChars: number;
+    /** Only set when the replay check actually ran. */
+    replayVerified?: boolean;
+    reason?: string;
+};
+export declare function thinkingModeFor(model: string): {
+    kind: "adaptive" | "extended";
+} | null;
+export declare function checkThinkingSignature(opts: {
+    transport: TransportFn;
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    timeoutMs: number;
+    /**
+     * Replay the thinking block to the same endpoint. Measured as NOT proving
+     * authenticity through a relay (see the module docstring): both a genuine and
+     * a forged signature come back 200, because the relay re-issues the turn
+     * upstream instead of forwarding our block. Off by default; it only tells you
+     * the endpoint accepts a thinking block in the request.
+     */
+    strict?: boolean;
+}): Promise<SignatureResult>;
+//# sourceMappingURL=thinking-signature.d.ts.map

package/dist/detectors/thinking-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thinking-signature.d.ts","sourceRoot":"","sources":["../../src/detectors/thinking-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAqBhD,MAAM,MAAM,cAAc;AACxB,gEAAgE;AAC9D,QAAQ;AACV;;;;GAIG;GACD,UAAU;AACZ,4DAA4D;GAC1D,aAAa;AACf,yEAAyE;GACvE,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAkBF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GACZ;IAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAAA;CAAE,GAAG,IAAI,CAK1C;AA4BD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,SAAS,EAAE,WAAW,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CA0E3B"}

package/dist/detectors/thinking-signature.js

@@ -0,0 +1,177 @@
+/**
+ * Anthropic thinking-signature check.
+ *
+ * Claude attaches a server-generated `signature` to every thinking block. A
+ * relay serving some other model cannot produce one, so this is the only
+ * evidence here that does not rest on asking the model who it is: identity and
+ * behaviour probes can be coached with a system prompt, a signature cannot.
+ *
+ * What it does NOT prove: which tier answered. Sonnet returns a perfectly valid
+ * signature when sold as Opus, so a pass here still needs the tier checks.
+ *
+ * Ported from veridrop (AGPL-3.0), whose detector stops at "a signature-shaped
+ * string is present".
+ *
+ * Their DESIGN.md also specifies a replay step (hand the thinking block back so
+ * Anthropic re-validates the signature, rejecting a forgery with 400/422) which
+ * they never implemented. We built and measured it: **it does not work through a
+ * relay**. Tested against two live upstreams (a6 merchant 3542 and pol) by
+ * replaying a genuine block and then the same block with 308 bytes of random
+ * base64 in place of the signature. Both upstreams returned 200 for both. A
+ * relay re-issues the turn to its own backend rather than passing our thinking
+ * block through, so nothing ever validates it.
+ *
+ * `strict` therefore stays off by default and is documented as proving only
+ * that the endpoint accepts the block, not that the signature is real. Do not
+ * present it as cryptographic proof.
+ */
+/**
+ * Multi-step GCD: hard enough that adaptive models decide to think, and
+ * deliberately not the 1071/462 pair from Anthropic's own docs, which a relay
+ * could special-case.
+ */
+const PROBE_PROMPT = "Find the greatest common divisor of 2378 and 1547 using the Euclidean algorithm.";
+const THINKING_BUDGET_TOKENS = 2000;
+/**
+ * Covers thinking + answer together. Too small and an adaptive model skips
+ * thinking entirely to fit, which reads as a fake when it is our own fault.
+ */
+const MAX_TOKENS = 16000;
+/** Real signatures run to hundreds of chars; this only rejects a stub. */
+const SIGNATURE_MIN_LEN = 50;
+/** Adaptive-thinking models take `effort` at the top level, not inside `thinking`. */
+const ADAPTIVE_MODELS = ["claude-opus-4-7", "claude-opus-4-8"];
+/** Extended-thinking models take a token budget instead. */
+const EXTENDED_MODELS = [
+    "claude-opus-4-6",
+    "claude-opus-4-5",
+    "claude-opus-4-1",
+    "claude-sonnet-4-6",
+    "claude-sonnet-4-5",
+    "claude-haiku-4-5",
+];
+const normalize = (model) => model.toLowerCase().replace(/[._]/g, "-").split("/").pop() ?? "";
+export function thinkingModeFor(model) {
+    const m = normalize(model);
+    if (ADAPTIVE_MODELS.some((p) => m.startsWith(p)))
+        return { kind: "adaptive" };
+    if (EXTENDED_MODELS.some((p) => m.startsWith(p)))
+        return { kind: "extended" };
+    return null;
+}
+function readThinking(data) {
+    const content = data?.content;
+    if (!Array.isArray(content))
+        return { block: null, signature: "", chars: 0 };
+    for (const raw of content) {
+        if (!raw || typeof raw !== "object")
+            continue;
+        const b = raw;
+        if (b.type !== "thinking" && b.type !== "redacted_thinking")
+            continue;
+        return {
+            block: b,
+            signature: typeof b.signature === "string" ? b.signature : "",
+            chars: typeof b.thinking === "string" ? b.thinking.length : 0,
+        };
+    }
+    return { block: null, signature: "", chars: 0 };
+}
+export async function checkThinkingSignature(opts) {
+    const mode = thinkingModeFor(opts.model);
+    const empty = { signatureLength: 0, signaturePrefix: null, thinkingChars: 0 };
+    if (!mode)
+        return { state: "skipped", ...empty, reason: "model-has-no-thinking-mode" };
+    const url = `${opts.baseUrl.replace(/\/+$/, "")}/v1/messages`;
+    const headers = {
+        "Content-Type": "application/json",
+        "x-api-key": opts.apiKey,
+        "anthropic-version": "2023-06-01",
+    };
+    const messages = [{ role: "user", content: PROBE_PROMPT }];
+    // Non-streaming on purpose: streaming an adaptive model silently drops the
+    // thinking block, so a real Claude would look unsigned.
+    const body = {
+        model: opts.model,
+        max_tokens: MAX_TOKENS,
+        messages,
+        thinking: mode.kind === "extended"
+            ? { type: "enabled", budget_tokens: THINKING_BUDGET_TOKENS }
+            : { type: "adaptive", display: "summarized" },
+    };
+    // Sibling of `thinking`, never nested inside it: nesting is a 400.
+    if (mode.kind === "adaptive")
+        body["output_config"] = { effort: "xhigh" };
+    const res = await opts.transport({
+        mode: "direct",
+        url,
+        headers,
+        reqBody: body,
+        timeoutMs: opts.timeoutMs,
+    });
+    if (res.status === null || res.status >= 400)
+        return {
+            state: "skipped",
+            ...empty,
+            reason: `probe-failed:${res.status ?? "network"}`,
+        };
+    const found = readThinking(res.data);
+    if (!found.block)
+        return { state: "no-thinking", ...empty, reason: "no-thinking-block" };
+    const sig = found.signature;
+    const base = {
+        signatureLength: sig.length,
+        signaturePrefix: sig ? sig.slice(0, 32) : null,
+        thinkingChars: found.chars,
+    };
+    if (!sig)
+        return { state: "unsigned", ...base, reason: "no-signature-field" };
+    if (sig.length < SIGNATURE_MIN_LEN)
+        return { state: "unsigned", ...base, reason: "signature-too-short" };
+    if (!opts.strict)
+        return { state: "signed", ...base };
+    const replayVerified = await verifySignature({
+        transport: opts.transport,
+        url,
+        headers,
+        model: opts.model,
+        block: found.block,
+        timeoutMs: opts.timeoutMs,
+    });
+    // A rejection is real evidence (the endpoint checked and refused); an
+    // acceptance is not, so it never upgrades or downgrades the state on its own.
+    return {
+        state: replayVerified ? "signed" : "unsigned",
+        ...base,
+        replayVerified,
+        ...(replayVerified ? {} : { reason: "signature-rejected-on-replay" }),
+    };
+}
+/**
+ * Hand the thinking block back to the endpoint. Against api.anthropic.com this
+ * would re-validate the signature; against a relay it does not (measured: a
+ * forged 308-byte signature returned 200 on both upstreams tested), so the
+ * result is reported as `replayVerified` evidence rather than a verdict.
+ */
+async function verifySignature(opts) {
+    const res = await opts.transport({
+        mode: "direct",
+        url: opts.url,
+        headers: opts.headers,
+        reqBody: {
+            model: opts.model,
+            max_tokens: 1,
+            messages: [
+                { role: "user", content: PROBE_PROMPT },
+                { role: "assistant", content: [opts.block] },
+            ],
+        },
+        timeoutMs: opts.timeoutMs,
+    });
+    // A network failure proves nothing, so treat only an explicit rejection as
+    // a forged signature.
+    if (res.status === null)
+        return true;
+    return res.status < 400;
+}
+//# sourceMappingURL=thinking-signature.js.map

package/dist/detectors/thinking-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thinking-signature.js","sourceRoot":"","sources":["../../src/detectors/thinking-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;GAIG;AACH,MAAM,YAAY,GAChB,kFAAkF,CAAC;AAErF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA2B7B,sFAAsF;AACtF,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;AAE/D,4DAA4D;AAC5D,MAAM,eAAe,GAAG;IACtB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AAEnE,MAAM,UAAU,eAAe,CAC7B,KAAa;IAEb,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9E,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,SAAS,YAAY,CAAC,IAAa;IAKjC,MAAM,OAAO,GAAI,IAA8B,EAAE,OAAO,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC7E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,CAAC,GAAG,GAAoB,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAS;QACtE,OAAO;YACL,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YAC7D,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAc5C;IACC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,IAAI;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;IAC9D,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,mBAAmB,EAAE,YAAY;KAClC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,IAAI,GAA4B;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,UAAU;QACtB,QAAQ;QACR,QAAQ,EACN,IAAI,CAAC,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE;YAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE;KAClD,CAAC;IACF,mEAAmE;IACnE,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAC1C,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,GAAG,KAAK;YACR,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE;SAClD,CAAC;IAEJ,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,KAAK;QACd,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,GAAG,CAAC,MAAM;QAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9C,aAAa,EAAE,KAAK,CAAC,KAAK;KAC3B,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB;QAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvE,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAEtD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG;QACH,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;QAC7C,GAAG,IAAI;QACP,cAAc;QACd,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAAC,IAO9B;IACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;gBACvC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;aAC7C;SACF;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,2EAA2E;IAC3E,sBAAsB;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;AAC1B,CAAC"}

package/dist/detectors/throughput.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Throughput metadata: tokens per second, derived from data the run already
+ * collected.
+ *
+ * Motivation: bigger models are slower per token, so a lane billed as Opus but
+ * served by Sonnet tends to run fast. That makes throughput the one tier signal
+ * that survives a relay refusing to name its model.
+ *
+ * It is metadata, not a verdict, and deliberately has no thresholds. Rate
+ * varies with load, batching, quantisation and time of day, so a single
+ * measurement cannot separate "cheaper model" from "quiet hour". The useful
+ * comparison is across lanes serving the SAME model, which only the caller can
+ * assemble: `compareThroughput` does that part and still only describes what it
+ * sees.
+ */
+export type ThroughputSample = {
+    /** Identifies the lane in the caller's own terms. */
+    lane: string;
+    model: string;
+    outputTokens: number;
+    elapsedMs: number;
+    tokensPerSecond: number;
+};
+export declare function sampleThroughput(args: {
+    lane: string;
+    model: string;
+    outputTokens: number | null | undefined;
+    elapsedMs: number;
+}): ThroughputSample | null;
+export type ThroughputComparison = {
+    model: string;
+    sampleCount: number;
+    medianTps: number;
+    /** Lanes running far from the median for this model, fastest first. */
+    outliers: {
+        lane: string;
+        tokensPerSecond: number;
+        ratioToMedian: number;
+        direction: "faster" | "slower";
+    }[];
+    note: string;
+};
+/**
+ * Describe how lanes serving one model compare. `outlierRatio` is how far from
+ * the median a lane must sit to be worth mentioning; the default of 2 is a
+ * starting point for eyeballing, not a calibrated threshold.
+ */
+export declare function compareThroughput(samples: ThroughputSample[], opts?: {
+    outlierRatio?: number;
+}): ThroughputComparison[];
+//# sourceMappingURL=throughput.d.ts.map

package/dist/detectors/throughput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"throughput.d.ts","sourceRoot":"","sources":["../../src/detectors/throughput.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,gBAAgB,GAAG,IAAI,CAa1B;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;KAChC,EAAE,CAAC;IACJ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,oBAAoB,EAAE,CA8CxB"}

package/dist/detectors/throughput.js

@@ -0,0 +1,83 @@
+/**
+ * Throughput metadata: tokens per second, derived from data the run already
+ * collected.
+ *
+ * Motivation: bigger models are slower per token, so a lane billed as Opus but
+ * served by Sonnet tends to run fast. That makes throughput the one tier signal
+ * that survives a relay refusing to name its model.
+ *
+ * It is metadata, not a verdict, and deliberately has no thresholds. Rate
+ * varies with load, batching, quantisation and time of day, so a single
+ * measurement cannot separate "cheaper model" from "quiet hour". The useful
+ * comparison is across lanes serving the SAME model, which only the caller can
+ * assemble: `compareThroughput` does that part and still only describes what it
+ * sees.
+ */
+export function sampleThroughput(args) {
+    const tokens = args.outputTokens;
+    // A handful of tokens over a noisy connection says nothing; the rate is
+    // dominated by connection setup rather than generation.
+    if (typeof tokens !== "number" || tokens < 20)
+        return null;
+    if (!Number.isFinite(args.elapsedMs) || args.elapsedMs <= 0)
+        return null;
+    return {
+        lane: args.lane,
+        model: args.model,
+        outputTokens: tokens,
+        elapsedMs: args.elapsedMs,
+        tokensPerSecond: +(tokens / (args.elapsedMs / 1000)).toFixed(1),
+    };
+}
+const median = (xs) => {
+    const s = [...xs].sort((a, b) => a - b);
+    const mid = Math.floor(s.length / 2);
+    return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+};
+/**
+ * Describe how lanes serving one model compare. `outlierRatio` is how far from
+ * the median a lane must sit to be worth mentioning; the default of 2 is a
+ * starting point for eyeballing, not a calibrated threshold.
+ */
+export function compareThroughput(samples, opts) {
+    const ratio = opts?.outlierRatio ?? 2;
+    const byModel = new Map();
+    for (const s of samples) {
+        const list = byModel.get(s.model);
+        if (list)
+            list.push(s);
+        else
+            byModel.set(s.model, [s]);
+    }
+    const out = [];
+    for (const [model, group] of byModel) {
+        // Below three lanes there is no distribution to speak of, so report the
+        // median and no outliers rather than inventing a comparison.
+        const med = median(group.map((s) => s.tokensPerSecond));
+        const outliers = group.length >= 3
+            ? group
+                .filter((s) => s.tokensPerSecond >= med * ratio ||
+                s.tokensPerSecond <= med / ratio)
+                .map((s) => ({
+                lane: s.lane,
+                tokensPerSecond: s.tokensPerSecond,
+                ratioToMedian: +(s.tokensPerSecond / med).toFixed(2),
+                direction: s.tokensPerSecond > med ? "faster" : "slower",
+            }))
+                .sort((a, b) => b.tokensPerSecond - a.tokensPerSecond)
+            : [];
+        out.push({
+            model,
+            sampleCount: group.length,
+            medianTps: +med.toFixed(1),
+            outliers,
+            note: group.length < 3
+                ? "too few lanes to compare"
+                : outliers.length === 0
+                    ? "all lanes within range of each other"
+                    : `${outliers.length} lane(s) far from the median; a much faster lane can mean a smaller model, but load and quantisation move this too`,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=throughput.js.map

package/dist/detectors/throughput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throughput.js","sourceRoot":"","sources":["../../src/detectors/throughput.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACjC,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAgBD,MAAM,MAAM,GAAG,CAAC,EAAY,EAAE,EAAE;IAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA2B,EAC3B,IAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACxD,MAAM,QAAQ,GACZ,KAAK,CAAC,MAAM,IAAI,CAAC;YACf,CAAC,CAAC,KAAK;iBACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,eAAe,IAAI,GAAG,GAAG,KAAK;gBAChC,CAAC,CAAC,eAAe,IAAI,GAAG,GAAG,KAAK,CACnC;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpD,SAAS,EACP,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,QAAkB;aACtE,CAAC,CAAC;iBACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,GAAG,CAAC,IAAI,CAAC;YACP,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1B,QAAQ;YACR,IAAI,EACF,KAAK,CAAC,MAAM,GAAG,CAAC;gBACd,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACrB,CAAC,CAAC,sCAAsC;oBACxC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,oHAAoH;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/detectors/token-truth.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Token-accounting checks for Anthropic endpoints.
+ *
+ * The signature check answers "is this really Claude". These answer a different
+ * question the signature cannot: "are the numbers you are billing me true".
+ * A relay can forward genuine Claude and still inflate `input_tokens` on every
+ * call, and nothing in an identity probe would notice.
+ *
+ * Ported from veridrop (AGPL-3.0) `token_usage.py` / `integrity.py`, whose
+ * tolerances were calibrated against the official API. Do not tighten them
+ * without re-measuring: the loose-looking bounds exist because real Anthropic
+ * responses sat near them.
+ */
+import type { TransportFn } from "../transport";
+export type TokenTruthCheck = {
+    id: "usage-present" | "input-delta" | "output-bounded" | "count-tokens";
+    pass: boolean;
+    detail: string;
+};
+export type TokenTruthResult = {
+    /** null when nothing could be measured (endpoint refused every probe). */
+    ok: boolean | null;
+    checks: TokenTruthCheck[];
+    shortInputTokens: number | null;
+    longInputTokens: number | null;
+    countTokens: number | null;
+    reason?: string;
+};
+export declare function expectedInputDelta(model: string): {
+    min: number;
+    max: number;
+};
+export declare function checkTokenTruth(opts: {
+    transport: TransportFn;
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    timeoutMs: number;
+}): Promise<TokenTruthResult>;
+//# sourceMappingURL=token-truth.d.ts.map

package/dist/detectors/token-truth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-truth.d.ts","sourceRoot":"","sources":["../../src/detectors/token-truth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAsBhD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,eAAe,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IACxE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0EAA0E;IAC1E,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAKF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAK9E;AAcD,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,SAAS,EAAE,WAAW,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2G5B"}