@lanefoundry/gatelane-engine 0.0.0-stage → 0.1.0

package/dist/scan.js

@@ -0,0 +1,260 @@
+/**
+ * Security scan: attack report + patch-verify cycle.
+ * Built on top of the gate's replay + judge + compare primitives.
+ */
+import { parseProviderModel } from './llm.js';
+import { LLMJudge } from './judge.js';
+import { replay } from './replay.js';
+import { compare } from './compare.js';
+import { evaluate } from './evaluate.js';
+import { signReport } from './sign.js';
+import { shaOfCandidateRef } from '@lanefoundry/gatelane-sdk';
+import { injectionMetaOf } from './attack.js';
+/**
+ * Enrich raw JudgeVerdicts with attack taxonomy (category + ASI).
+ * Uses INJECTION_META from attack.ts to look up by item_id.
+ */
+export function enrichVerdicts(verdicts, _dataset) {
+    return verdicts.map((v) => {
+        const meta = injectionMetaOf(v.item_id);
+        return {
+            ...v,
+            category: meta?.category ?? 'prompt_injection', // default
+            mapped_asi: meta?.mapped_asi ?? 'ASI01',
+        };
+    });
+}
+/**
+ * Build an AttackReport from enriched verdicts and the dataset.
+ */
+export function buildAttackReport(args) {
+    const { verdicts, dataset, candidate_refs, judges } = args;
+    // Group verdicts by candidate
+    const byCandidate = new Map();
+    for (const v of verdicts) {
+        const arr = byCandidate.get(v.candidate_ref) ?? [];
+        arr.push(v);
+        byCandidate.set(v.candidate_ref, arr);
+    }
+    // Build per-candidate summaries
+    const candidates = candidate_refs.map((ref) => {
+        const vlist = byCandidate.get(ref) ?? [];
+        const survived = vlist.filter((v) => v.outcome === 'pass').length;
+        const failed = vlist.filter((v) => v.outcome === 'fail').length;
+        const total = vlist.length;
+        // By category
+        const by_category = {
+            prompt_injection: { survived: 0, failed: 0, total: 0 },
+            privilege_escalation: { survived: 0, failed: 0, total: 0 },
+            code_injection: { survived: 0, failed: 0, total: 0 },
+            tool_misuse: { survived: 0, failed: 0, total: 0 },
+        };
+        for (const v of vlist) {
+            const bucket = by_category[v.category];
+            bucket.total += 1;
+            if (v.outcome === 'pass')
+                bucket.survived += 1;
+            else
+                bucket.failed += 1;
+        }
+        return {
+            candidate_ref: ref,
+            total,
+            survived,
+            failed,
+            survival_rate: total === 0 ? 1 : survived / total,
+            by_category,
+            vulnerabilities: vlist.filter((v) => v.outcome === 'fail'),
+        };
+    });
+    // Per-ASI gaps across all candidates
+    const asiCounts = new Map();
+    for (const v of verdicts) {
+        const key = v.mapped_asi;
+        const cur = asiCounts.get(key) ?? { total: 0, failed: 0 };
+        cur.total += 1;
+        if (v.outcome === 'fail')
+            cur.failed += 1;
+        asiCounts.set(key, cur);
+    }
+    const by_asi = Array.from(asiCounts.entries())
+        .map(([asi, { total, failed }]) => ({
+        asi,
+        total,
+        failed,
+        fail_rate: total === 0 ? 0 : failed / total,
+    }))
+        .sort((a, b) => b.fail_rate - a.fail_rate); // highest-impact gaps first
+    return {
+        dataset_content_hash: dataset.content_hash,
+        dataset_version: dataset.version,
+        generated_at: new Date().toISOString(),
+        candidates,
+        by_asi,
+        candidate_refs: [...candidate_refs],
+        judges: [...judges],
+    };
+}
+/**
+ * Collect judge verdicts for a replay result.
+ * Extracted from runner logic so both runner and scan path share it.
+ */
+export async function collectVerdicts(args) {
+    const { replayResult, dataset, candidates, judges, caller, judge_callers } = args;
+    const verdicts = [];
+    for (const cand of candidates) {
+        for (const judgeRef of judges) {
+            const judgeCaller = judge_callers?.[judgeRef] ?? caller;
+            const { model: judgeModel } = parseProviderModel(judgeRef, 'mock');
+            const judge = new LLMJudge({ name: judgeRef, model: judgeModel, caller: judgeCaller });
+            const candRows = replayResult.rows.filter((r) => r.candidate_ref === cand.ref);
+            for (const row of candRows) {
+                const itemId = row.item_id;
+                const itemInput = dataset.items?.find((it) => (it.id ?? '<anonymous>') === itemId)?.input;
+                const v = await judge.judge({
+                    candidate_ref: cand.ref,
+                    item_id: itemId,
+                    item_input: itemInput ?? null,
+                    candidate_output: row.response.content,
+                });
+                verdicts.push(v);
+            }
+        }
+    }
+    return verdicts;
+}
+/**
+ * Resolve candidate refs to { ref, model } objects for replay.
+ * Mirrors runner logic: 'model:foo' → model 'foo', others → full ref.
+ */
+export function resolveCandidates(refs) {
+    return refs.map((ref) => ({
+        ref,
+        model: ref.startsWith('model:') ? ref.slice('model:'.length) : ref,
+    }));
+}
+/**
+ * Run a full security scan: replay + judge + compare + sign + evaluate + attack report.
+ * Returns both the attack report and the gate decision.
+ */
+export async function runScanGate(args) {
+    const { dataset, candidates, judges, caller, judge_callers, seed, policy, baseline, approver, signing_key, } = args;
+    // 1. Replay
+    const candidateObjs = resolveCandidates(candidates);
+    const replayArgs = {
+        dataset,
+        candidates: candidateObjs,
+        caller,
+        ...(seed !== undefined ? { seed } : {}),
+    };
+    const replayResult = await replay(replayArgs);
+    // 2. Judge (collect verdicts)
+    const verdicts = await collectVerdicts({
+        replayResult,
+        dataset,
+        candidates: candidateObjs,
+        judges,
+        caller,
+        judge_callers,
+    });
+    // 3. Enrich verdicts with attack taxonomy
+    const enriched = enrichVerdicts(verdicts, dataset);
+    // 4. Build attack report
+    const attackReport = buildAttackReport({
+        verdicts: enriched,
+        dataset,
+        candidate_refs: candidates,
+        judges,
+    });
+    // 5. Compare + evaluate (gate decision)
+    const { perCandidate, judgeMatrix } = compare({
+        replay: replayResult,
+        verdicts,
+        ...(baseline !== undefined ? { baseline_ref: baseline } : {}),
+    });
+    const candidate_shas = {};
+    for (const ref of candidates)
+        candidate_shas[ref] = await shaOfCandidateRef(ref);
+    const judge_shas = {};
+    for (const j of judges)
+        judge_shas[j] = await shaOfCandidateRef(j);
+    const scorerCodeSha = await shaOfCandidateRef('gatelane-engine:scan:v0.0.1-dev');
+    const candidate_metrics = {};
+    for (const [ref, m] of Object.entries(perCandidate)) {
+        candidate_metrics[ref] = {
+            aggregate_delta: m.aggregate_delta,
+            cost_delta: m.cost_delta,
+            latency_delta: m.latency_delta,
+        };
+    }
+    const baseline_metrics = {};
+    if (baseline !== undefined) {
+        const b = perCandidate[baseline];
+        if (b !== undefined) {
+            baseline_metrics.primary_score = b.mean_score;
+            baseline_metrics.cost = b.total_cost_usd;
+            baseline_metrics.latency = b.mean_latency_ms;
+        }
+    }
+    const runId = crypto.randomUUID();
+    const reportId = crypto.randomUUID();
+    const baseReport = {
+        id: reportId,
+        gate_run_id: runId,
+        dataset_content_hash: dataset.content_hash,
+        dataset_version: dataset.version,
+        candidate_shas,
+        judge_shas,
+        scorer_code_sha: scorerCodeSha,
+        baseline_metrics,
+        candidate_metrics,
+        judge_matrix: judgeMatrix,
+        policy: policy ?? (await import('@lanefoundry/gatelane-sdk')).DEFAULT_POLICY,
+        ...(approver !== undefined ? { approver } : {}),
+        timestamp: new Date().toISOString(),
+        signature: 'pending',
+    };
+    let gateResult = null;
+    if (signing_key) {
+        const signature = await signReport(baseReport, signing_key);
+        const signed = { ...baseReport, signature };
+        const { decision, rule_results } = evaluate({
+            candidates,
+            perCandidate,
+            judgeMatrix,
+            policy: baseReport.policy,
+            ...(approver !== undefined ? { approver } : {}),
+        });
+        gateResult = { report: signed, decision, evaluate: { decision, rule_results } };
+    }
+    return { attackReport, gateResult };
+}
+/**
+ * Verify that a patch holds against the same scan dataset.
+ * Compares baseline candidate failures vs patched candidate outcomes.
+ */
+export function verifyPatchHolds(args) {
+    const { before, after, baselineCandidate, patchedCandidate } = args;
+    const beforeSummary = before.candidates.find((c) => c.candidate_ref === baselineCandidate);
+    const afterSummary = after.candidates.find((c) => c.candidate_ref === patchedCandidate);
+    if (!beforeSummary || !afterSummary) {
+        throw new Error(`Candidate not found in reports: baseline=${baselineCandidate}, patched=${patchedCandidate}`);
+    }
+    const beforeFails = new Set(beforeSummary.vulnerabilities.map((v) => v.item_id));
+    const afterFails = new Set(afterSummary.vulnerabilities.map((v) => v.item_id));
+    const resolved = Array.from(beforeFails).filter((id) => !afterFails.has(id));
+    const regressed = Array.from(afterFails).filter((id) => !beforeFails.has(id));
+    const stillVulnerable = Array.from(beforeFails).filter((id) => afterFails.has(id));
+    const holds = stillVulnerable.length === 0 && regressed.length === 0;
+    return {
+        holds,
+        resolved,
+        regressed,
+        stillVulnerable,
+        baselineCandidate,
+        patchedCandidate,
+        before,
+        after,
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,kBAAkB,EAAkB,MAAM,UAAU,CAAC;AAG9D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAuB,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiH9C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,QAAuB;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU;YAC1D,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,OAAO;SACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE3D,8BAA8B;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAGD,gCAAgC;IAChC,MAAM,UAAU,GAA6B,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAE3B,cAAc;QACd,MAAM,WAAW,GAAmF;YAClG,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YACtD,oBAAoB,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC1D,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YACpD,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;SAClD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;gBAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;;gBAC1C,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO;YACL,aAAa,EAAE,GAAG;YAClB,KAAK;YACL,QAAQ;YACR,MAAM;YACN,aAAa,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,KAAK;YACjD,WAAW;YACX,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;YAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAoB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG;QACH,KAAK;QACL,MAAM;QACN,SAAS,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK;KAC5C,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B;IAE1E,OAAO;QACL,oBAAoB,EAAE,OAAO,CAAC,YAAY;QAC1C,eAAe,EAAE,OAAO,CAAC,OAAO;QAChC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,UAAU;QACV,MAAM;QACN,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAOrC;IACC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAClF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;YACxD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,aAAa,CAAC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;gBAC1F,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;oBAC1B,aAAa,EAAE,IAAI,CAAC,GAAG;oBACvB,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,SAAS,IAAI,IAAI;oBAC7B,gBAAgB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;iBACvC,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG;QACH,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG;KACnE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAiB;IACjD,MAAM,EACJ,OAAO,EACP,UAAU,EACV,MAAM,EACN,MAAM,EACN,aAAa,EACb,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,WAAW,GACZ,GAAG,IAAI,CAAC;IAET,YAAY;IACZ,MAAM,aAAa,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAe;QAC7B,OAAO;QACP,UAAU,EAAE,aAAa;QACzB,MAAM;QACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAE9C,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QACrC,YAAY;QACZ,OAAO;QACP,UAAU,EAAE,aAAa;QACzB,MAAM;QACN,MAAM;QACN,aAAa;KACd,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEnD,yBAAyB;IACzB,MAAM,YAAY,GAAG,iBAAiB,CAAC;QACrC,QAAQ,EAAE,QAAQ;QAClB,OAAO;QACP,cAAc,EAAE,UAAU;QAC1B,MAAM;KACP,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,YAAY;QACpB,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;IAEjF,MAAM,iBAAiB,GAA2F,EAAE,CAAC;IACrH,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,iBAAiB,CAAC,GAAG,CAAC,GAAG;YACvB,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,gBAAgB,CAAC,aAAa,GAAG,CAAC,CAAC,UAAU,CAAC;YAC9C,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC;YACzC,gBAAgB,CAAC,OAAO,GAAG,CAAC,CAAC,eAAe,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACrC,MAAM,UAAU,GAAoB;QAClC,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,KAAK;QAClB,oBAAoB,EAAE,OAAO,CAAC,YAAY;QAC1C,eAAe,EAAE,OAAO,CAAC,OAAO;QAChC,cAAc;QACd,UAAU;QACV,eAAe,EAAE,aAAa;QAC9B,gBAAgB;QAChB,iBAAiB;QACjB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,cAAc;QAC5E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,SAAS;KACrB,CAAC;IAEF,IAAI,UAAU,GAAgC,IAAI,CAAC;IACnD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAoB,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAC;QAC7D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;YAC1C,UAAU;YACV,YAAY;YACZ,WAAW;YACX,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAEpE,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,iBAAiB,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,gBAAgB,CAAC,CAAC;IAExF,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,iBAAiB,aAAa,gBAAgB,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAErE,OAAO;QACL,KAAK;QACL,QAAQ;QACR,SAAS;QACT,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,MAAM;QACN,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/sign.d.ts

@@ -0,0 +1,20 @@
+/**
+ * HMAC-SHA256 signing for GateReport.
+ *
+ * The signing key comes from the `GATELANE_REPORT_SIGNING_KEY` env var (32+ random
+ * bytes recommended). The signed payload is the canonical JSON of the report
+ * (without the `signature` field); the signature is base64url-encoded HMAC.
+ *
+ * The same key reproduces the same signature, so auditors can verify
+ * "did this report actually get signed at decision time?" by recomputing.
+ *
+ * @see docs/prd.md §5.1 — The gate
+ */
+import type { GateReport } from '@lanefoundry/gatelane-sdk';
+/** Stable JSON for signing (excludes `signature`; recursively sorts keys). */
+export declare function canonicalizeReport(report: GateReport): string;
+/** Sign a GateReport with the given key. Returns the new signature string. */
+export declare function signReport(report: GateReport, key: string): Promise<string>;
+/** Verify a GateReport's signature. Returns true if signature matches. */
+export declare function verifyReport(report: GateReport, key: string): Promise<boolean>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAI7D;AAkBD,8EAA8E;AAC9E,wBAAsB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAejF;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpF"}

package/dist/sign.js

@@ -0,0 +1,64 @@
+/**
+ * HMAC-SHA256 signing for GateReport.
+ *
+ * The signing key comes from the `GATELANE_REPORT_SIGNING_KEY` env var (32+ random
+ * bytes recommended). The signed payload is the canonical JSON of the report
+ * (without the `signature` field); the signature is base64url-encoded HMAC.
+ *
+ * The same key reproduces the same signature, so auditors can verify
+ * "did this report actually get signed at decision time?" by recomputing.
+ *
+ * @see docs/prd.md §5.1 — The gate
+ */
+/** Stable JSON for signing (excludes `signature`; recursively sorts keys). */
+export function canonicalizeReport(report) {
+    const { signature: _sig, ...rest } = report;
+    void _sig; // excluded from canonical JSON; keep destructure for clarity
+    return JSON.stringify(sortKeysDeep(rest));
+}
+/** Recursively sort object keys for canonical JSON. Arrays preserve order. */
+function sortKeysDeep(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeysDeep);
+    if (value && typeof value === 'object') {
+        const obj = value;
+        const out = {};
+        for (const key of Object.keys(obj).sort()) {
+            out[key] = sortKeysDeep(obj[key]);
+        }
+        return out;
+    }
+    return value;
+}
+const encoder = new TextEncoder();
+/** Sign a GateReport with the given key. Returns the new signature string. */
+export async function signReport(report, key) {
+    if (key.length < 16) {
+        throw new Error('signing key must be ≥ 16 chars; got ' + key.length);
+    }
+    const keyBytes = encoder.encode(key);
+    const payloadBytes = encoder.encode(canonicalizeReport(report));
+    const cryptoKey = await crypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', cryptoKey, payloadBytes);
+    return base64url(new Uint8Array(sig));
+}
+/** Verify a GateReport's signature. Returns true if signature matches. */
+export async function verifyReport(report, key) {
+    const expected = await signReport(report, key);
+    return constantTimeEqual(expected, report.signature);
+}
+function base64url(bytes) {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=sign.js.map

package/dist/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC5C,KAAK,IAAI,CAAC,CAAC,6DAA6D;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAEA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,GAAW;IAC9D,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,QAAwB,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,YAA4B,CAAC,CAAC;IACtF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,GAAW;IAChE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/tracing.d.ts

@@ -0,0 +1,20 @@
+/**
+ * OpenTelemetry tracing utilities for the gate engine.
+ *
+ * Provides a simple span wrapper that emits spans for each gate stage.
+ * Uses console exporter in development, Cloudflare Logpush in production.
+ *
+ * @see docs/prd.md §5.1 — The gate
+ */
+import { trace, Span } from '@opentelemetry/api';
+import type { SpanExporter } from '@opentelemetry/sdk-trace-base';
+export declare function initTracing(serviceName?: string, exporter?: SpanExporter): void;
+/** Get a tracer for the gate engine. */
+export declare function getTracer(): ReturnType<typeof trace.getTracer>;
+/** Gate stage names for span naming. */
+export type GateStage = 'replay' | 'judge' | 'compare' | 'sign' | 'evaluate';
+/** Run a function within a named span for a gate stage. */
+export declare function withGateSpan<T>(stage: GateStage, gateRunId: string, fn: (span: Span) => Promise<T>): Promise<T>;
+/** Shutdown the tracer provider (for clean shutdown). */
+export declare function shutdownTracing(): Promise<void>;
+//# sourceMappingURL=tracing.d.ts.map

package/dist/tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAA4B,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAMlE,wBAAgB,WAAW,CAAC,WAAW,SAAoB,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,IAAI,CAgB1F;AAED,wCAAwC;AACxC,wBAAgB,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC,CAE9D;AAED,wCAAwC;AACxC,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;AAE7E,2DAA2D;AAC3D,wBAAsB,YAAY,CAAC,CAAC,EAClC,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,yDAAyD;AACzD,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/tracing.js

@@ -0,0 +1,65 @@
+/**
+ * OpenTelemetry tracing utilities for the gate engine.
+ *
+ * Provides a simple span wrapper that emits spans for each gate stage.
+ * Uses console exporter in development, Cloudflare Logpush in production.
+ *
+ * @see docs/prd.md §5.1 — The gate
+ */
+import { trace, SpanStatusCode, SpanKind } from '@opentelemetry/api';
+import { NodeTracerProvider, ConsoleSpanExporter, SimpleSpanProcessor } from '@opentelemetry/sdk-trace-node';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+let tracerProvider = null;
+let initialized = false;
+export function initTracing(serviceName = 'gatelane-engine', exporter) {
+    if (initialized)
+        return;
+    const spanProcessor = exporter
+        ? new SimpleSpanProcessor(exporter)
+        : new SimpleSpanProcessor(new ConsoleSpanExporter());
+    tracerProvider = new NodeTracerProvider({
+        resource: resourceFromAttributes({
+            'service.name': serviceName,
+        }),
+        spanProcessors: [spanProcessor],
+    });
+    tracerProvider.register();
+    initialized = true;
+}
+/** Get a tracer for the gate engine. */
+export function getTracer() {
+    return trace.getTracer('gatelane-engine');
+}
+/** Run a function within a named span for a gate stage. */
+export async function withGateSpan(stage, gateRunId, fn) {
+    const tracer = getTracer();
+    return tracer.startActiveSpan(`gate.${stage}`, { kind: SpanKind.INTERNAL }, async (span) => {
+        try {
+            span.setAttribute('gate.run_id', gateRunId);
+            span.setAttribute('gate.stage', stage);
+            const result = await fn(span);
+            span.setStatus({ code: SpanStatusCode.OK });
+            return result;
+        }
+        catch (error) {
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: error instanceof Error ? error.message : String(error),
+            });
+            span.recordException(error instanceof Error ? error : new Error(String(error)));
+            throw error;
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+/** Shutdown the tracer provider (for clean shutdown). */
+export async function shutdownTracing() {
+    if (tracerProvider) {
+        await tracerProvider.shutdown();
+        initialized = false;
+        tracerProvider = null;
+    }
+}
+//# sourceMappingURL=tracing.js.map

package/dist/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAQ,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAE7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,cAAc,GAA8B,IAAI,CAAC;AACrD,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,WAAW,CAAC,WAAW,GAAG,iBAAiB,EAAE,QAAuB;IAClF,IAAI,WAAW;QAAE,OAAO;IAExB,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC;QACnC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAEvD,cAAc,GAAG,IAAI,kBAAkB,CAAC;QACtC,QAAQ,EAAE,sBAAsB,CAAC;YAC/B,cAAc,EAAE,WAAW;SAC5B,CAAC;QACF,cAAc,EAAE,CAAC,aAAa,CAAC;KAChC,CAAC,CAAC;IAEH,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAKD,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,SAAiB,EACjB,EAA8B;IAE9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC,eAAe,CAAC,QAAQ,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,cAAc,CAAC,KAAK;gBAC1B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC;QAChC,WAAW,GAAG,KAAK,CAAC;QACpB,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,91 @@
 {
   "name": "@lanefoundry/gatelane-engine",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Gate engine — replay, compare, judge, sign. Runs in the Worker.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lanefoundry/gatelane.git",
+    "directory": "packages/gatelane-engine"
+  },
+  "homepage": "https://github.com/lanefoundry/gatelane/tree/main/packages/gatelane-engine",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./attack": {
+      "types": "./dist/attack.d.ts",
+      "import": "./dist/attack.js"
+    },
+    "./scan": {
+      "types": "./dist/scan.d.ts",
+      "import": "./dist/scan.js"
+    },
+    "./llm": {
+      "types": "./dist/llm.d.ts",
+      "import": "./dist/llm.js"
+    },
+    "./replay": {
+      "types": "./dist/replay.d.ts",
+      "import": "./dist/replay.js"
+    },
+    "./judge": {
+      "types": "./dist/judge.d.ts",
+      "import": "./dist/judge.js"
+    },
+    "./compare": {
+      "types": "./dist/compare.d.ts",
+      "import": "./dist/compare.js"
+    },
+    "./sign": {
+      "types": "./dist/sign.d.ts",
+      "import": "./dist/sign.js"
+    },
+    "./evaluate": {
+      "types": "./dist/evaluate.d.ts",
+      "import": "./dist/evaluate.js"
+    },
+    "./runner": {
+      "types": "./dist/runner.d.ts",
+      "import": "./dist/runner.js"
+    },
+    "./audit": {
+      "types": "./dist/audit.d.ts",
+      "import": "./dist/audit.js"
+    },
+    "./tracing": {
+      "types": "./dist/tracing.d.ts",
+      "import": "./dist/tracing.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@lanefoundry/gatelane-sdk": "0.1.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-collector-grpc": "^0.25.0",
+    "@opentelemetry/exporter-trace-otlp-grpc": "^0.221.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.222.0",
+    "@opentelemetry/resources": "^2.10.0",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
+    "@opentelemetry/sdk-trace-node": "^2.10.0",
+    "@opentelemetry/semantic-conventions": "^1.43.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.