@kya-os/checkpoint-express 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @kya-os/checkpoint-express
 
+## 1.1.1 — 2026-05-17
+
+Companion patch to `@kya-os/checkpoint-wasm-runtime@1.1.0`. Express
+consumers can already use `withCheckpoint` (Next.js Turbopack was the
+trigger, not Express's bundler-less Node import flow), but this bump
+keeps the wasm-runtime dep range consistent across all checkpoint-\*
+packages.
+
+### Internal change
+
+- `@kya-os/checkpoint-wasm-runtime` optional-dep changed from exact
+  `1.0.0` pin to `^1.1.0` range (via `workspace:^`).
+
+---
+
+## 1.1.0 — 2026-05-17
+
+Closes [SDK-Envelope-Plumbing-1 (#2594)](https://github.com/Know-That-Ai/agent-shield/issues/2594)
+for Express. Coordinated release with `@kya-os/checkpoint-nextjs@1.1.0` —
+identical config surface across both SDKs.
+
+### New config (additive — no breaking changes)
+
+- `CheckpointConfig.legacyEnvelopeFallback?: boolean` (default `false`) — accept
+  envelopes via the legacy `KYA-Delegation` HTTP header alongside the canonical
+  body form. Use for agents that pre-date Envelope-1 (#2537). Forwarded to
+  the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+
+### What's NOT in this release (and why)
+
+Express's `translate.ts` already forwards `req.body` (as parsed by `body-parser`)
+to the orchestrator, so the canonical `_meta.proof.jws` body transport has worked
+since 1.0.0. No `drainJsonBody` config is needed — express consumers configure
+body parsing via `express.json()` upstream of the middleware.
+
+Express has a single middleware factory (`createCheckpointMiddleware` from
+`./create-middleware`) which already calls `verifyRequest` through the
+orchestrator — no factory-clarity migration needed (Next.js had a pattern-only
+twin that competed with `withCheckpoint`; Express does not).
+
+### Migration
+
+No code changes required for existing 1.0.x consumers — `legacyEnvelopeFallback`
+is optional and defaults to `false`. Consumers wanting to accept legacy header
+envelopes:
+
+```diff
+  app.use(withCheckpoint({
+    tenantHost: 'acme.checkpoint.example',
++   legacyEnvelopeFallback: true,
+  }));
+```
+
+---
+
 ## 1.0.0 — 2026-05-16 (Phase E)
 
 ### Breaking

package/dist/index.d.mts

@@ -83,6 +83,23 @@ interface CheckpointConfig {
      * response.
      */
     onResult?: (result: VerifyResult, req: Request) => void | Promise<void>;
+    /**
+     * Accept legacy `KYA-Delegation`-header envelope form alongside the
+     * canonical `_meta.proof.jws` body form. Default `false`.
+     *
+     * **When to enable** — customers whose agents pre-date Envelope-1
+     * (#2537) and ship MCP-I proofs as `{protected,payload,signature}`
+     * JSON in a `KYA-Delegation` HTTP header. Post-Envelope-1 agents
+     * ship compact JWS in the request body's `_meta.proof.jws` field;
+     * those don't need this flag (Express's body-parser pre-populates
+     * `req.body` which `translate.ts` already forwards to the
+     * orchestrator).
+     *
+     * Forwarded to the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+     *
+     * SDK-Envelope-Plumbing-1 (#2594). Added in `@kya-os/checkpoint-express@1.1.0`.
+     */
+    legacyEnvelopeFallback?: boolean;
 }
 /**
  * Build the Checkpoint middleware. Returns an Express `RequestHandler`

package/dist/index.d.ts

@@ -83,6 +83,23 @@ interface CheckpointConfig {
      * response.
      */
     onResult?: (result: VerifyResult, req: Request) => void | Promise<void>;
+    /**
+     * Accept legacy `KYA-Delegation`-header envelope form alongside the
+     * canonical `_meta.proof.jws` body form. Default `false`.
+     *
+     * **When to enable** — customers whose agents pre-date Envelope-1
+     * (#2537) and ship MCP-I proofs as `{protected,payload,signature}`
+     * JSON in a `KYA-Delegation` HTTP header. Post-Envelope-1 agents
+     * ship compact JWS in the request body's `_meta.proof.jws` field;
+     * those don't need this flag (Express's body-parser pre-populates
+     * `req.body` which `translate.ts` already forwards to the
+     * orchestrator).
+     *
+     * Forwarded to the orchestrator's `VerifyRequestOpts.legacyEnvelopeFallback`.
+     *
+     * SDK-Envelope-Plumbing-1 (#2594). Added in `@kya-os/checkpoint-express@1.1.0`.
+     */
+    legacyEnvelopeFallback?: boolean;
 }
 /**
  * Build the Checkpoint middleware. Returns an Express `RequestHandler`

package/dist/index.js

@@ -658,18 +658,18 @@ function createAutoPipelineProxy(_redis, namespace = "root") {
     }
   });
 }
-var __defProp3, __export3, error_exports, UpstashError, UrlError, UpstashJSONParseError, MAX_BUFFER_SIZE, HttpClient, defaultSerializer, Command, ExecCommand, FIELD_TYPES, SearchIndex, HRandFieldCommand, AppendCommand, BitCountCommand, BitFieldCommand, BitOpCommand, BitPosCommand, ClientSetInfoCommand, CopyCommand, DBSizeCommand, DecrCommand, DecrByCommand, DelCommand, EchoCommand, EvalROCommand, EvalCommand, EvalshaROCommand, EvalshaCommand, ExistsCommand, ExpireCommand, ExpireAtCommand, FCallCommand, FCallRoCommand, FlushAllCommand, FlushDBCommand, FunctionDeleteCommand, FunctionFlushCommand, FunctionListCommand, FunctionLoadCommand, FunctionStatsCommand, GeoAddCommand, GeoDistCommand, GeoHashCommand, GeoPosCommand, GeoSearchCommand, GeoSearchStoreCommand, GetCommand, GetBitCommand, GetDelCommand, GetExCommand, GetRangeCommand, GetSetCommand, HDelCommand, HExistsCommand, HExpireCommand, HExpireAtCommand, HExpireTimeCommand, HPersistCommand, HPExpireCommand, HPExpireAtCommand, HPExpireTimeCommand, HPTtlCommand, HGetCommand, HGetAllCommand, HMGetCommand, HGetDelCommand, HGetExCommand, HIncrByCommand, HIncrByFloatCommand, HKeysCommand, HLenCommand, HMSetCommand, HScanCommand, HSetCommand, HSetExCommand, HSetNXCommand, HStrLenCommand, HTtlCommand, HValsCommand, IncrCommand, IncrByCommand, IncrByFloatCommand, JsonArrAppendCommand, JsonArrIndexCommand, JsonArrInsertCommand, JsonArrLenCommand, JsonArrPopCommand, JsonArrTrimCommand, JsonClearCommand, JsonDelCommand, JsonForgetCommand, JsonGetCommand, JsonMergeCommand, JsonMGetCommand, JsonMSetCommand, JsonNumIncrByCommand, JsonNumMultByCommand, JsonObjKeysCommand, JsonObjLenCommand, JsonRespCommand, JsonSetCommand, JsonStrAppendCommand, JsonStrLenCommand, JsonToggleCommand, JsonTypeCommand, KeysCommand, LIndexCommand, LInsertCommand, LLenCommand, LMoveCommand, LmPopCommand, LPopCommand, LPosCommand, LPushCommand, LPushXCommand, LRangeCommand, LRemCommand, LSetCommand, LTrimCommand, MGetCommand, MSetCommand, MSetNXCommand, PersistCommand, PExpireCommand, PExpireAtCommand, PfAddCommand, PfCountCommand, PfMergeCommand, PingCommand, PSetEXCommand, PTtlCommand, PublishCommand, RandomKeyCommand, RenameCommand, RenameNXCommand, RPopCommand, RPushCommand, RPushXCommand, SAddCommand, ScanCommand, SCardCommand, ScriptExistsCommand, ScriptFlushCommand, ScriptLoadCommand, SDiffCommand, SDiffStoreCommand, SetCommand, SetBitCommand, SetExCommand, SetNxCommand, SetRangeCommand, SInterCommand, SInterCardCommand, SInterStoreCommand, SIsMemberCommand, SMembersCommand, SMIsMemberCommand, SMoveCommand, SPopCommand, SRandMemberCommand, SRemCommand, SScanCommand, StrLenCommand, SUnionCommand, SUnionStoreCommand, TimeCommand, TouchCommand, TtlCommand, TypeCommand, UnlinkCommand, XAckCommand, XAckDelCommand, XAddCommand, XAutoClaim, XClaimCommand, XDelCommand, XDelExCommand, XGroupCommand, XInfoCommand, XLenCommand, XPendingCommand, XRangeCommand, UNBALANCED_XREAD_ERR, XReadCommand, UNBALANCED_XREADGROUP_ERR, XReadGroupCommand, XRevRangeCommand, XTrimCommand, ZAddCommand, ZCardCommand, ZCountCommand, ZIncrByCommand, ZInterStoreCommand, ZLexCountCommand, ZPopMaxCommand, ZPopMinCommand, ZRangeCommand, ZRankCommand, ZRemCommand, ZRemRangeByLexCommand, ZRemRangeByRankCommand, ZRemRangeByScoreCommand, ZRevRankCommand, ZScanCommand, ZScoreCommand, ZUnionCommand, ZUnionStoreCommand, ZDiffStoreCommand, ZMScoreCommand, Pipeline, EXCLUDE_COMMANDS, AutoPipelineExecutor, PSubscribeCommand, Subscriber, SubscribeCommand, parseWithTryCatch, Script, ScriptRO, Redis, VERSION;
+var __defProp2, __export2, error_exports, UpstashError, UrlError, UpstashJSONParseError, MAX_BUFFER_SIZE, HttpClient, defaultSerializer, Command, ExecCommand, FIELD_TYPES, SearchIndex, HRandFieldCommand, AppendCommand, BitCountCommand, BitFieldCommand, BitOpCommand, BitPosCommand, ClientSetInfoCommand, CopyCommand, DBSizeCommand, DecrCommand, DecrByCommand, DelCommand, EchoCommand, EvalROCommand, EvalCommand, EvalshaROCommand, EvalshaCommand, ExistsCommand, ExpireCommand, ExpireAtCommand, FCallCommand, FCallRoCommand, FlushAllCommand, FlushDBCommand, FunctionDeleteCommand, FunctionFlushCommand, FunctionListCommand, FunctionLoadCommand, FunctionStatsCommand, GeoAddCommand, GeoDistCommand, GeoHashCommand, GeoPosCommand, GeoSearchCommand, GeoSearchStoreCommand, GetCommand, GetBitCommand, GetDelCommand, GetExCommand, GetRangeCommand, GetSetCommand, HDelCommand, HExistsCommand, HExpireCommand, HExpireAtCommand, HExpireTimeCommand, HPersistCommand, HPExpireCommand, HPExpireAtCommand, HPExpireTimeCommand, HPTtlCommand, HGetCommand, HGetAllCommand, HMGetCommand, HGetDelCommand, HGetExCommand, HIncrByCommand, HIncrByFloatCommand, HKeysCommand, HLenCommand, HMSetCommand, HScanCommand, HSetCommand, HSetExCommand, HSetNXCommand, HStrLenCommand, HTtlCommand, HValsCommand, IncrCommand, IncrByCommand, IncrByFloatCommand, JsonArrAppendCommand, JsonArrIndexCommand, JsonArrInsertCommand, JsonArrLenCommand, JsonArrPopCommand, JsonArrTrimCommand, JsonClearCommand, JsonDelCommand, JsonForgetCommand, JsonGetCommand, JsonMergeCommand, JsonMGetCommand, JsonMSetCommand, JsonNumIncrByCommand, JsonNumMultByCommand, JsonObjKeysCommand, JsonObjLenCommand, JsonRespCommand, JsonSetCommand, JsonStrAppendCommand, JsonStrLenCommand, JsonToggleCommand, JsonTypeCommand, KeysCommand, LIndexCommand, LInsertCommand, LLenCommand, LMoveCommand, LmPopCommand, LPopCommand, LPosCommand, LPushCommand, LPushXCommand, LRangeCommand, LRemCommand, LSetCommand, LTrimCommand, MGetCommand, MSetCommand, MSetNXCommand, PersistCommand, PExpireCommand, PExpireAtCommand, PfAddCommand, PfCountCommand, PfMergeCommand, PingCommand, PSetEXCommand, PTtlCommand, PublishCommand, RandomKeyCommand, RenameCommand, RenameNXCommand, RPopCommand, RPushCommand, RPushXCommand, SAddCommand, ScanCommand, SCardCommand, ScriptExistsCommand, ScriptFlushCommand, ScriptLoadCommand, SDiffCommand, SDiffStoreCommand, SetCommand, SetBitCommand, SetExCommand, SetNxCommand, SetRangeCommand, SInterCommand, SInterCardCommand, SInterStoreCommand, SIsMemberCommand, SMembersCommand, SMIsMemberCommand, SMoveCommand, SPopCommand, SRandMemberCommand, SRemCommand, SScanCommand, StrLenCommand, SUnionCommand, SUnionStoreCommand, TimeCommand, TouchCommand, TtlCommand, TypeCommand, UnlinkCommand, XAckCommand, XAckDelCommand, XAddCommand, XAutoClaim, XClaimCommand, XDelCommand, XDelExCommand, XGroupCommand, XInfoCommand, XLenCommand, XPendingCommand, XRangeCommand, UNBALANCED_XREAD_ERR, XReadCommand, UNBALANCED_XREADGROUP_ERR, XReadGroupCommand, XRevRangeCommand, XTrimCommand, ZAddCommand, ZCardCommand, ZCountCommand, ZIncrByCommand, ZInterStoreCommand, ZLexCountCommand, ZPopMaxCommand, ZPopMinCommand, ZRangeCommand, ZRankCommand, ZRemCommand, ZRemRangeByLexCommand, ZRemRangeByRankCommand, ZRemRangeByScoreCommand, ZRevRankCommand, ZScanCommand, ZScoreCommand, ZUnionCommand, ZUnionStoreCommand, ZDiffStoreCommand, ZMScoreCommand, Pipeline, EXCLUDE_COMMANDS, AutoPipelineExecutor, PSubscribeCommand, Subscriber, SubscribeCommand, parseWithTryCatch, Script, ScriptRO, Redis, VERSION;
 var init_chunk_IH7W44G6 = __esm({
   "../../node_modules/.pnpm/@upstash+redis@1.37.0/node_modules/@upstash/redis/chunk-IH7W44G6.mjs"() {
     init_crypto_node();
     init_crypto_node();
-    __defProp3 = Object.defineProperty;
-    __export3 = (target, all) => {
+    __defProp2 = Object.defineProperty;
+    __export2 = (target, all) => {
       for (var name in all)
-        __defProp3(target, name, { get: all[name], enumerable: true });
+        __defProp2(target, name, { get: all[name], enumerable: true });
     };
     error_exports = {};
-    __export3(error_exports, {
+    __export2(error_exports, {
       UpstashError: () => UpstashError,
       UpstashJSONParseError: () => UpstashJSONParseError,
       UrlError: () => UrlError
@@ -5197,443 +5197,7 @@ var init_nodejs = __esm({
   }
 });
 
-// ../checkpoint-wasm-runtime/dist/orchestrator.mjs
-var __defProp2 = Object.defineProperty;
-var __export2 = (target, all) => {
-  for (var name in all)
-    __defProp2(target, name, { get: all[name], enumerable: true });
-};
-var kya_os_engine_exports = {};
-__export2(kya_os_engine_exports, {
-  default: () => kya_os_engine_default,
-  initSync: () => initSync,
-  verify: () => verify
-});
-function getUint8ArrayMemory0() {
-  if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
-    cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
-  }
-  return cachedUint8ArrayMemory0;
-}
-function decodeText(ptr, len) {
-  numBytesDecoded += len;
-  if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
-    cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
-    cachedTextDecoder.decode();
-    numBytesDecoded = len;
-  }
-  return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
-}
-function getStringFromWasm0(ptr, len) {
-  ptr = ptr >>> 0;
-  return decodeText(ptr, len);
-}
-function addHeapObject(obj) {
-  if (heap_next === heap.length) heap.push(heap.length + 1);
-  const idx = heap_next;
-  heap_next = heap[idx];
-  heap[idx] = obj;
-  return idx;
-}
-function getObject(idx) {
-  return heap[idx];
-}
-function passStringToWasm0(arg, malloc, realloc) {
-  if (realloc === void 0) {
-    const buf = cachedTextEncoder.encode(arg);
-    const ptr2 = malloc(buf.length, 1) >>> 0;
-    getUint8ArrayMemory0().subarray(ptr2, ptr2 + buf.length).set(buf);
-    WASM_VECTOR_LEN = buf.length;
-    return ptr2;
-  }
-  let len = arg.length;
-  let ptr = malloc(len, 1) >>> 0;
-  const mem = getUint8ArrayMemory0();
-  let offset = 0;
-  for (; offset < len; offset++) {
-    const code = arg.charCodeAt(offset);
-    if (code > 127) break;
-    mem[ptr + offset] = code;
-  }
-  if (offset !== len) {
-    if (offset !== 0) {
-      arg = arg.slice(offset);
-    }
-    ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
-    const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
-    const ret = cachedTextEncoder.encodeInto(arg, view);
-    offset += ret.written;
-    ptr = realloc(ptr, len, offset, 1) >>> 0;
-  }
-  WASM_VECTOR_LEN = offset;
-  return ptr;
-}
-function getDataViewMemory0() {
-  if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || cachedDataViewMemory0.buffer.detached === void 0 && cachedDataViewMemory0.buffer !== wasm.memory.buffer) {
-    cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
-  }
-  return cachedDataViewMemory0;
-}
-function isLikeNone(x) {
-  return x === void 0 || x === null;
-}
-function debugString(val) {
-  const type = typeof val;
-  if (type == "number" || type == "boolean" || val == null) {
-    return `${val}`;
-  }
-  if (type == "string") {
-    return `"${val}"`;
-  }
-  if (type == "symbol") {
-    const description = val.description;
-    if (description == null) {
-      return "Symbol";
-    } else {
-      return `Symbol(${description})`;
-    }
-  }
-  if (type == "function") {
-    const name = val.name;
-    if (typeof name == "string" && name.length > 0) {
-      return `Function(${name})`;
-    } else {
-      return "Function";
-    }
-  }
-  if (Array.isArray(val)) {
-    const length = val.length;
-    let debug = "[";
-    if (length > 0) {
-      debug += debugString(val[0]);
-    }
-    for (let i = 1; i < length; i++) {
-      debug += ", " + debugString(val[i]);
-    }
-    debug += "]";
-    return debug;
-  }
-  const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
-  let className;
-  if (builtInMatches && builtInMatches.length > 1) {
-    className = builtInMatches[1];
-  } else {
-    return toString.call(val);
-  }
-  if (className == "Object") {
-    try {
-      return "Object(" + JSON.stringify(val) + ")";
-    } catch (_) {
-      return "Object";
-    }
-  }
-  if (val instanceof Error) {
-    return `${val.name}: ${val.message}
-${val.stack}`;
-  }
-  return className;
-}
-function handleError(f, args) {
-  try {
-    return f.apply(this, args);
-  } catch (e) {
-    wasm.__wbindgen_export3(addHeapObject(e));
-  }
-}
-function getArrayU8FromWasm0(ptr, len) {
-  ptr = ptr >>> 0;
-  return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
-}
-function dropObject(idx) {
-  if (idx < 132) return;
-  heap[idx] = heap_next;
-  heap_next = idx;
-}
-function takeObject(idx) {
-  const ret = getObject(idx);
-  dropObject(idx);
-  return ret;
-}
-function verify(input_js, ctx_js) {
-  try {
-    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    wasm.verify(retptr, addHeapObject(input_js), addHeapObject(ctx_js));
-    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-    if (r2) {
-      throw takeObject(r1);
-    }
-    return takeObject(r0);
-  } finally {
-    wasm.__wbindgen_add_to_stack_pointer(16);
-  }
-}
-function __wbg_get_imports() {
-  const imports = {};
-  imports.wbg = {};
-  imports.wbg.__wbg_Error_e83987f665cf5504 = function(arg0, arg1) {
-    const ret = Error(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_Number_bb48ca12f395cd08 = function(arg0) {
-    const ret = Number(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_String_8f0eb39a4a4c2f66 = function(arg0, arg1) {
-    const ret = String(getObject(arg1));
-    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_bigint_get_as_i64_f3ebc5a755000afd = function(arg0, arg1) {
-    const v = getObject(arg1);
-    const ret = typeof v === "bigint" ? v : void 0;
-    getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
-  };
-  imports.wbg.__wbg___wbindgen_boolean_get_6d5a1ee65bab5f68 = function(arg0) {
-    const v = getObject(arg0);
-    const ret = typeof v === "boolean" ? v : void 0;
-    return isLikeNone(ret) ? 16777215 : ret ? 1 : 0;
-  };
-  imports.wbg.__wbg___wbindgen_debug_string_df47ffb5e35e6763 = function(arg0, arg1) {
-    const ret = debugString(getObject(arg1));
-    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_in_bb933bd9e1b3bc0f = function(arg0, arg1) {
-    const ret = getObject(arg0) in getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_bigint_cb320707dcd35f0b = function(arg0) {
-    const ret = typeof getObject(arg0) === "bigint";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_function_ee8a6c5833c90377 = function(arg0) {
-    const ret = typeof getObject(arg0) === "function";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_object_c818261d21f283a4 = function(arg0) {
-    const val = getObject(arg0);
-    const ret = typeof val === "object" && val !== null;
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_string_fbb76cb2940daafd = function(arg0) {
-    const ret = typeof getObject(arg0) === "string";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_undefined_2d472862bd29a478 = function(arg0) {
-    const ret = getObject(arg0) === void 0;
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_jsval_eq_6b13ab83478b1c50 = function(arg0, arg1) {
-    const ret = getObject(arg0) === getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_jsval_loose_eq_b664b38a2f582147 = function(arg0, arg1) {
-    const ret = getObject(arg0) == getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_number_get_a20bf9b85341449d = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof obj === "number" ? obj : void 0;
-    getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
-  };
-  imports.wbg.__wbg___wbindgen_string_get_e4f06c90489ad01b = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof obj === "string" ? obj : void 0;
-    var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    var len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_throw_b855445ff6a94295 = function(arg0, arg1) {
-    throw new Error(getStringFromWasm0(arg0, arg1));
-  };
-  imports.wbg.__wbg_call_e762c39fa8ea36bf = function() {
-    return handleError(function(arg0, arg1) {
-      const ret = getObject(arg0).call(getObject(arg1));
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_done_2042aa2670fb1db1 = function(arg0) {
-    const ret = getObject(arg0).done;
-    return ret;
-  };
-  imports.wbg.__wbg_entries_e171b586f8f6bdbf = function(arg0) {
-    const ret = Object.entries(getObject(arg0));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_get_7bed016f185add81 = function(arg0, arg1) {
-    const ret = getObject(arg0)[arg1 >>> 0];
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_get_efcb449f58ec27c2 = function() {
-    return handleError(function(arg0, arg1) {
-      const ret = Reflect.get(getObject(arg0), getObject(arg1));
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_get_with_ref_key_1dc361bd10053bfe = function(arg0, arg1) {
-    const ret = getObject(arg0)[getObject(arg1)];
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_instanceof_ArrayBuffer_70beb1189ca63b38 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof ArrayBuffer;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_instanceof_Map_8579b5e2ab5437c7 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof Map;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_instanceof_Uint8Array_20c8e73002f7af98 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof Uint8Array;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_isArray_96e0af9891d0945d = function(arg0) {
-    const ret = Array.isArray(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_isSafeInteger_d216eda7911dde36 = function(arg0) {
-    const ret = Number.isSafeInteger(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_iterator_e5822695327a3c39 = function() {
-    const ret = Symbol.iterator;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_length_69bca3cb64fc8748 = function(arg0) {
-    const ret = getObject(arg0).length;
-    return ret;
-  };
-  imports.wbg.__wbg_length_cdd215e10d9dd507 = function(arg0) {
-    const ret = getObject(arg0).length;
-    return ret;
-  };
-  imports.wbg.__wbg_new_1acc0b6eea89d040 = function() {
-    const ret = new Object();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_5a79be3ab53b8aa5 = function(arg0) {
-    const ret = new Uint8Array(getObject(arg0));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_68651c719dcda04e = function() {
-    const ret = /* @__PURE__ */ new Map();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_e17d9f43105b08be = function() {
-    const ret = new Array();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_next_020810e0ae8ebcb0 = function() {
-    return handleError(function(arg0) {
-      const ret = getObject(arg0).next();
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_next_2c826fe5dfec6b6a = function(arg0) {
-    const ret = getObject(arg0).next;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_prototypesetcall_2a6620b6922694b2 = function(arg0, arg1, arg2) {
-    Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
-  };
-  imports.wbg.__wbg_set_3f1d0b984ed272ed = function(arg0, arg1, arg2) {
-    getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
-  };
-  imports.wbg.__wbg_set_907fb406c34a251d = function(arg0, arg1, arg2) {
-    const ret = getObject(arg0).set(getObject(arg1), getObject(arg2));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_set_c213c871859d6500 = function(arg0, arg1, arg2) {
-    getObject(arg0)[arg1 >>> 0] = takeObject(arg2);
-  };
-  imports.wbg.__wbg_value_692627309814bb8c = function(arg0) {
-    const ret = getObject(arg0).value;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
-    const ret = getStringFromWasm0(arg0, arg1);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_4625c577ab2ec9ee = function(arg0) {
-    const ret = BigInt.asUintN(64, arg0);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_9ae0607507abb057 = function(arg0) {
-    const ret = arg0;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
-    const ret = arg0;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_object_clone_ref = function(arg0) {
-    const ret = getObject(arg0);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_object_drop_ref = function(arg0) {
-    takeObject(arg0);
-  };
-  return imports;
-}
-function __wbg_finalize_init(instance, module) {
-  wasm = instance.exports;
-  cachedDataViewMemory0 = null;
-  cachedUint8ArrayMemory0 = null;
-  return wasm;
-}
-function initSync(module) {
-  if (wasm !== void 0) return wasm;
-  if (typeof module !== "undefined") {
-    if (Object.getPrototypeOf(module) === Object.prototype) {
-      ({ module } = module);
-    } else {
-      console.warn("using deprecated parameters for `initSync()`; pass a single object instead");
-    }
-  }
-  const imports = __wbg_get_imports();
-  if (!(module instanceof WebAssembly.Module)) {
-    module = new WebAssembly.Module(module);
-  }
-  const instance = new WebAssembly.Instance(module, imports);
-  return __wbg_finalize_init(instance);
-}
-var wasm;
-var cachedUint8ArrayMemory0;
-var cachedTextDecoder;
-var MAX_SAFARI_DECODE_BYTES;
-var numBytesDecoded;
-var heap;
-var heap_next;
-var WASM_VECTOR_LEN;
-var cachedTextEncoder;
-var cachedDataViewMemory0;
-var kya_os_engine_default;
+// ../checkpoint-wasm-runtime/dist/orchestrator-node.mjs
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata", "metadata.google.internal"]);
 var UnsafeOutboundUrl = class extends Error {
   kind = "UnsafeOutboundUrl";
@@ -7075,7 +6639,8 @@ function buildVerifyOpts(config) {
     tenantHost: config.tenantHost,
     enforcementMode: config.enforcementMode ?? "enforce",
     reputationBaseline: config.reputationBaseline,
-    argusUrl: config.argusUrl
+    argusUrl: config.argusUrl,
+    legacyEnvelopeFallback: config.legacyEnvelopeFallback ?? false
   };
 }
 async function dispatchOnResult(config, result, req) {
@@ -7516,5 +7081,3 @@ exports.sendBlockedResponse = sendBlockedResponse;
 exports.sendRedirectResponse = sendRedirectResponse;
 exports.withCheckpoint = withCheckpoint;
 exports.withSessionTracking = withSessionTracking;
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map