@kya-os/checkpoint-express 1.1.1 → 1.1.3

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # @kya-os/checkpoint-express
 
+## 1.1.3 — 2026-05-18
+
+Companion patch for `@kya-os/checkpoint-wasm-runtime@1.2.0`.
+
+### Changed
+
+- Session persistence and enforcement compatibility logic now consume
+  `VerifyResult.decision` plus `VerifyResult.detectionDetail`.
+
+---
+
+## 1.1.2 — 2026-05-17
+
+**Critical rebuild.** 1.1.1 shipped with `engineVerify` bundled inline
+from wasm-runtime@1.0.0 — which had the `(void 0) is not a function`
+tree-shake bug that was later fixed in wasm-runtime@1.1.1 (#2611). Even
+after that wasm-runtime fix, Express consumers were still hitting the
+bug because the broken code was baked into Express's published bundle
+rather than imported transitively at install time.
+
+### Fix
+
+tsup `external` now lists `@kya-os/checkpoint-wasm-runtime` (and its
+subpath exports) so the wasm-runtime is loaded via Node's runtime
+resolution rather than inlined at bundle time. Fresh installs of
+checkpoint-express@1.1.2 transitively pull whatever wasm-runtime
+version their dep range resolves — currently 1.1.2 (with all the
+SDK-WASM-Bundler-Loader fixes from 1.1.0 → 1.1.2).
+
+Bundle proof:
+
+```
+$ grep -c "function engineVerify" dist/index.mjs
+0   # ✓ no longer inlined
+
+$ grep "from '@kya-os/checkpoint-wasm-runtime" dist/index.mjs
+import { verifyRequest, renderDecisionAsResponse } from '@kya-os/checkpoint-wasm-runtime/orchestrator';
+import { makeSystemClock, ... } from '@kya-os/checkpoint-wasm-runtime/adapters';
+```
+
+### Surfaced by
+
+Bench-Before-After-1 §3.8 pivot — when the Next.js bench-new path
+proved unstable (see [#2618 SDK-Next.js-Integration-Audit-1](https://github.com/Know-That-Ai/agent-shield/issues/2618)),
+the architect pivoted to Express. Local smoke against the freshly-
+cloned `sites/express-bench-new` immediately hit `(void 0) is not a
+function` in the bundled engineVerify — exposed Express's stale-bundle
+issue that the Next.js path had hidden behind its own bundling layers.
+
+### Followup
+
+SDK-Next.js-Integration-Audit-1 (#2618) Option B (wasm-bindgen `--target
+bundler`) will eventually let all consumers either bundle or externalize
+wasm-runtime without the (void 0) class of bug. Until then, externalizing
+at the consumer-package level is the right defense.
+
+---
+
 ## 1.1.1 — 2026-05-17
 
 Companion patch to `@kya-os/checkpoint-wasm-runtime@1.1.0`. Express

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { Request, RequestHandler, Response, NextFunction } from 'express';
 import { DidResolverAdapter, StatusListCacheAdapter, ReputationOracleAdapter, PolicyEvaluatorAdapter } from '@kya-os/checkpoint-wasm-runtime/adapters';
 import { EnforcementMode, VerifyResult } from '@kya-os/checkpoint-wasm-runtime/engine';
-import { DetectionResult, AgentShieldConfig } from '@kya-os/checkpoint-shared';
+import { DetectionResult, AgentShieldConfig, DetectionDetail } from '@kya-os/checkpoint-shared';
 export { DEFAULT_POLICY, ENFORCEMENT_ACTIONS, PolicyConfig, PolicyEvaluationContext, PolicyEvaluationResult, createEvaluationContext, evaluatePolicy } from '@kya-os/checkpoint-shared';
 export { PolicyMiddlewareConfig, applyPolicy, createContextFromDetection, evaluatePolicyForDetection, getPolicy, handlePolicyDecision, sendBlockedResponse, sendRedirectResponse } from './policy.mjs';
 
@@ -230,7 +230,7 @@ declare class ExpressSessionTracker {
     /**
      * Track a new session in Express response
      */
-    track(res: Response, result: DetectionResult): void;
+    track(res: Response, result: DetectionDetail): void;
     /**
      * Generate a simple ID without crypto dependency
      */

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Request, RequestHandler, Response, NextFunction } from 'express';
 import { DidResolverAdapter, StatusListCacheAdapter, ReputationOracleAdapter, PolicyEvaluatorAdapter } from '@kya-os/checkpoint-wasm-runtime/adapters';
 import { EnforcementMode, VerifyResult } from '@kya-os/checkpoint-wasm-runtime/engine';
-import { DetectionResult, AgentShieldConfig } from '@kya-os/checkpoint-shared';
+import { DetectionResult, AgentShieldConfig, DetectionDetail } from '@kya-os/checkpoint-shared';
 export { DEFAULT_POLICY, ENFORCEMENT_ACTIONS, PolicyConfig, PolicyEvaluationContext, PolicyEvaluationResult, createEvaluationContext, evaluatePolicy } from '@kya-os/checkpoint-shared';
 export { PolicyMiddlewareConfig, applyPolicy, createContextFromDetection, evaluatePolicyForDetection, getPolicy, handlePolicyDecision, sendBlockedResponse, sendRedirectResponse } from './policy.js';
 
@@ -230,7 +230,7 @@ declare class ExpressSessionTracker {
     /**
      * Track a new session in Express response
      */
-    track(res: Response, result: DetectionResult): void;
+    track(res: Response, result: DetectionDetail): void;
     /**
      * Generate a simple ID without crypto dependency
      */