@kya-os/checkpoint-express 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # @kya-os/checkpoint-express
 
+## 1.1.0 — 2026-05-17
+
+Closes [SDK-Envelope-Plumbing-1 (#2594)](https://github.com/Know-That-Ai/agent-shield/issues/2594)
+for Express. Coordinated release with `@kya-os/checkpoint-nextjs@1.1.0` —
+identical config surface across both SDKs.
+
+### New config (additive — no breaking changes)
+
+- `CheckpointConfig.legacyEnvelopeFallback?: boolean` (default `false`) — accept
+  envelopes via the legacy `KYA-Delegation` HTTP header alongside the canonical
+  body form. Use for agents that pre-date Envelope-1 (#2537). Forwarded to
+  the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+
+### What's NOT in this release (and why)
+
+Express's `translate.ts` already forwards `req.body` (as parsed by `body-parser`)
+to the orchestrator, so the canonical `_meta.proof.jws` body transport has worked
+since 1.0.0. No `drainJsonBody` config is needed — express consumers configure
+body parsing via `express.json()` upstream of the middleware.
+
+Express has a single middleware factory (`createCheckpointMiddleware` from
+`./create-middleware`) which already calls `verifyRequest` through the
+orchestrator — no factory-clarity migration needed (Next.js had a pattern-only
+twin that competed with `withCheckpoint`; Express does not).
+
+### Migration
+
+No code changes required for existing 1.0.x consumers — `legacyEnvelopeFallback`
+is optional and defaults to `false`. Consumers wanting to accept legacy header
+envelopes:
+
+```diff
+  app.use(withCheckpoint({
+    tenantHost: 'acme.checkpoint.example',
++   legacyEnvelopeFallback: true,
+  }));
+```
+
+---
+
 ## 1.0.0 — 2026-05-16 (Phase E)
 
 ### Breaking

package/dist/index.d.mts

@@ -83,6 +83,23 @@ interface CheckpointConfig {
      * response.
      */
     onResult?: (result: VerifyResult, req: Request) => void | Promise<void>;
+    /**
+     * Accept legacy `KYA-Delegation`-header envelope form alongside the
+     * canonical `_meta.proof.jws` body form. Default `false`.
+     *
+     * **When to enable** — customers whose agents pre-date Envelope-1
+     * (#2537) and ship MCP-I proofs as `{protected,payload,signature}`
+     * JSON in a `KYA-Delegation` HTTP header. Post-Envelope-1 agents
+     * ship compact JWS in the request body's `_meta.proof.jws` field;
+     * those don't need this flag (Express's body-parser pre-populates
+     * `req.body` which `translate.ts` already forwards to the
+     * orchestrator).
+     *
+     * Forwarded to the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+     *
+     * SDK-Envelope-Plumbing-1 (#2594). Added in `@kya-os/checkpoint-express@1.1.0`.
+     */
+    legacyEnvelopeFallback?: boolean;
 }
 /**
  * Build the Checkpoint middleware. Returns an Express `RequestHandler`

package/dist/index.d.ts

@@ -83,6 +83,23 @@ interface CheckpointConfig {
      * response.
      */
     onResult?: (result: VerifyResult, req: Request) => void | Promise<void>;
+    /**
+     * Accept legacy `KYA-Delegation`-header envelope form alongside the
+     * canonical `_meta.proof.jws` body form. Default `false`.
+     *
+     * **When to enable** — customers whose agents pre-date Envelope-1
+     * (#2537) and ship MCP-I proofs as `{protected,payload,signature}`
+     * JSON in a `KYA-Delegation` HTTP header. Post-Envelope-1 agents
+     * ship compact JWS in the request body's `_meta.proof.jws` field;
+     * those don't need this flag (Express's body-parser pre-populates
+     * `req.body` which `translate.ts` already forwards to the
+     * orchestrator).
+     *
+     * Forwarded to the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+     *
+     * SDK-Envelope-Plumbing-1 (#2594). Added in `@kya-os/checkpoint-express@1.1.0`.
+     */
+    legacyEnvelopeFallback?: boolean;
 }
 /**
  * Build the Checkpoint middleware. Returns an Express `RequestHandler`

package/dist/index.js

@@ -7075,7 +7075,8 @@ function buildVerifyOpts(config) {
     tenantHost: config.tenantHost,
     enforcementMode: config.enforcementMode ?? "enforce",
     reputationBaseline: config.reputationBaseline,
-    argusUrl: config.argusUrl
+    argusUrl: config.argusUrl,
+    legacyEnvelopeFallback: config.legacyEnvelopeFallback ?? false
   };
 }
 async function dispatchOnResult(config, result, req) {
@@ -7516,5 +7517,3 @@ exports.sendBlockedResponse = sendBlockedResponse;
 exports.sendRedirectResponse = sendRedirectResponse;
 exports.withCheckpoint = withCheckpoint;
 exports.withSessionTracking = withSessionTracking;
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map

package/dist/index.mjs

@@ -7070,7 +7070,8 @@ function buildVerifyOpts(config) {
     tenantHost: config.tenantHost,
     enforcementMode: config.enforcementMode ?? "enforce",
     reputationBaseline: config.reputationBaseline,
-    argusUrl: config.argusUrl
+    argusUrl: config.argusUrl,
+    legacyEnvelopeFallback: config.legacyEnvelopeFallback ?? false
   };
 }
 async function dispatchOnResult(config, result, req) {
@@ -7479,5 +7480,3 @@ var VERSION2 = "1.0.0";
  */
 
 export { ExpressSessionTracker, MemoryStorageAdapter, RedisStorageAdapter, VERSION2 as VERSION, agentShield, applyPolicy, createAgentShieldMiddleware, createContextFromDetection, createEnhancedAgentShieldMiddleware, createStorageAdapter, evaluatePolicyForDetection, getPolicy, handlePolicyDecision, sendBlockedResponse, sendRedirectResponse, withCheckpoint, withSessionTracking };
-//# sourceMappingURL=index.mjs.map
-//# sourceMappingURL=index.mjs.map

package/dist/policy.js

@@ -70,5 +70,3 @@ exports.handlePolicyDecision = handlePolicyDecision;
 exports.sendBlockedResponse = sendBlockedResponse;
 exports.sendChallengeResponse = sendChallengeResponse;
 exports.sendRedirectResponse = sendRedirectResponse;
-//# sourceMappingURL=policy.js.map
-//# sourceMappingURL=policy.js.map

package/dist/policy.mjs

@@ -45,5 +45,3 @@ async function applyPolicy(_req, _res, _detection, _config) {
 }
 
 export { applyPolicy, createContextFromDetection, evaluatePolicyForDetection, getPolicy, handlePolicyDecision, sendBlockedResponse, sendChallengeResponse, sendRedirectResponse };
-//# sourceMappingURL=policy.mjs.map
-//# sourceMappingURL=policy.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/checkpoint-express",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Express.js middleware for Checkpoint — engine-backed AI agent detection and MCP-I verification",
   "keywords": [
     "express",
@@ -68,8 +68,8 @@
   },
   "sideEffects": false,
   "dependencies": {
-    "@kya-os/checkpoint-shared": "1.0.0",
-    "@kya-os/checkpoint": "1.0.0"
+    "@kya-os/checkpoint": "1.0.0",
+    "@kya-os/checkpoint-shared": "1.0.0"
   },
   "optionalDependencies": {
     "@upstash/redis": "^1.35.0",