@kya-os/checkpoint-nextjs 1.1.1 → 1.2.0

package/dist/wasm-middleware.js

@@ -2,10 +2,38 @@
 
 var server = require('next/server');
 var checkpoint = require('@kya-os/checkpoint');
-var checkpointShared = require('@kya-os/checkpoint-shared');
 
 // src/wasm-middleware.ts
+
+// src/local-detection-gate.ts
+function isDetectedAgentForLocalGate(result) {
+  return result.isAgent === true;
+}
+function evaluateLocalDetectionGate(result, config) {
+  if (!isDetectedAgentForLocalGate(result)) {
+    return { action: "allow", shouldNotify: false };
+  }
+  if ((result.confidence ?? 0) >= config.confidenceThreshold) {
+    return { action: config.defaultAction, shouldNotify: true };
+  }
+  return { action: "allow", shouldNotify: false };
+}
+
+// src/wasm-middleware.ts
+var _createWasmAgentShieldWarned = false;
+function warnCreateWasmAgentShieldDeprecated() {
+  if (_createWasmAgentShieldWarned) return;
+  _createWasmAgentShieldWarned = true;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
+  console.warn(
+    "[Checkpoint] createWasmAgentShieldMiddleware is deprecated and will be removed in the next minor. It wraps the legacy AgentDetector class; Stage 1 detection now lives in the Rust kya-os-engine (PDM-1). Migrate to `withCheckpoint` from @kya-os/checkpoint-nextjs \u2014 engine-backed and runs envelope verification. See packages/checkpoint-nextjs/CHANGELOG.md for the recipe."
+  );
+}
+function __resetCreateWasmAgentShieldWarningForTests() {
+  _createWasmAgentShieldWarned = false;
+}
 function createWasmAgentShieldMiddleware(config) {
+  warnCreateWasmAgentShieldDeprecated();
   const {
     onAgentDetected,
     blockOnHighConfidence = false,
@@ -45,11 +73,11 @@ function createWasmAgentShieldMiddleware(config) {
         // Updated to 0-100 scale (was 0.7)
         timestamp: result.timestamp instanceof Date ? result.timestamp.toISOString() : new Date(result.timestamp).toISOString()
       };
-      const decision = checkpointShared.evaluateEnforcement(enhancedResult, {
+      const decision = evaluateLocalDetectionGate(enhancedResult, {
         confidenceThreshold,
         defaultAction: blockOnHighConfidence ? "block" : "allow"
       });
-      if (onAgentDetected && checkpointShared.shouldEnforce(enhancedResult)) {
+      if (onAgentDetected && isDetectedAgentForLocalGate(enhancedResult)) {
         await onAgentDetected(enhancedResult);
       }
       if (decision.action === "block") {
@@ -92,5 +120,6 @@ async function instantiateWasm(wasmModule) {
   }
 }
 
+exports.__resetCreateWasmAgentShieldWarningForTests = __resetCreateWasmAgentShieldWarningForTests;
 exports.createWasmAgentShieldMiddleware = createWasmAgentShieldMiddleware;
 exports.instantiateWasm = instantiateWasm;

package/dist/wasm-middleware.mjs

@@ -1,9 +1,37 @@
 import { NextResponse } from 'next/server';
 import { AgentDetector } from '@kya-os/checkpoint';
-import { evaluateEnforcement, shouldEnforce } from '@kya-os/checkpoint-shared';
 
 // src/wasm-middleware.ts
+
+// src/local-detection-gate.ts
+function isDetectedAgentForLocalGate(result) {
+  return result.isAgent === true;
+}
+function evaluateLocalDetectionGate(result, config) {
+  if (!isDetectedAgentForLocalGate(result)) {
+    return { action: "allow", shouldNotify: false };
+  }
+  if ((result.confidence ?? 0) >= config.confidenceThreshold) {
+    return { action: config.defaultAction, shouldNotify: true };
+  }
+  return { action: "allow", shouldNotify: false };
+}
+
+// src/wasm-middleware.ts
+var _createWasmAgentShieldWarned = false;
+function warnCreateWasmAgentShieldDeprecated() {
+  if (_createWasmAgentShieldWarned) return;
+  _createWasmAgentShieldWarned = true;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
+  console.warn(
+    "[Checkpoint] createWasmAgentShieldMiddleware is deprecated and will be removed in the next minor. It wraps the legacy AgentDetector class; Stage 1 detection now lives in the Rust kya-os-engine (PDM-1). Migrate to `withCheckpoint` from @kya-os/checkpoint-nextjs \u2014 engine-backed and runs envelope verification. See packages/checkpoint-nextjs/CHANGELOG.md for the recipe."
+  );
+}
+function __resetCreateWasmAgentShieldWarningForTests() {
+  _createWasmAgentShieldWarned = false;
+}
 function createWasmAgentShieldMiddleware(config) {
+  warnCreateWasmAgentShieldDeprecated();
   const {
     onAgentDetected,
     blockOnHighConfidence = false,
@@ -43,11 +71,11 @@ function createWasmAgentShieldMiddleware(config) {
         // Updated to 0-100 scale (was 0.7)
         timestamp: result.timestamp instanceof Date ? result.timestamp.toISOString() : new Date(result.timestamp).toISOString()
       };
-      const decision = evaluateEnforcement(enhancedResult, {
+      const decision = evaluateLocalDetectionGate(enhancedResult, {
         confidenceThreshold,
         defaultAction: blockOnHighConfidence ? "block" : "allow"
       });
-      if (onAgentDetected && shouldEnforce(enhancedResult)) {
+      if (onAgentDetected && isDetectedAgentForLocalGate(enhancedResult)) {
         await onAgentDetected(enhancedResult);
       }
       if (decision.action === "block") {
@@ -90,4 +118,4 @@ async function instantiateWasm(wasmModule) {
   }
 }
 
-export { createWasmAgentShieldMiddleware, instantiateWasm };
+export { __resetCreateWasmAgentShieldWarningForTests, createWasmAgentShieldMiddleware, instantiateWasm };

package/dist/wasm-setup.js

@@ -1,14 +1,5 @@
 'use strict';
 
-var fs = require('fs');
-var path = require('path');
-var checkpoint = require('@kya-os/checkpoint');
-
-function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
-
-var fs__default = /*#__PURE__*/_interopDefault(fs);
-var path__default = /*#__PURE__*/_interopDefault(path);
-
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -28,94 +19,51 @@ var __export = (target, all) => {
 // src/nodejs-wasm-loader.ts
 var nodejs_wasm_loader_exports = {};
 __export(nodejs_wasm_loader_exports, {
+  __resetNodejsWasmWarningForTests: () => __resetNodejsWasmWarningForTests,
   getWasmModule: () => getWasmModule,
   isNodejsRuntime: () => isNodejsRuntime,
   isWasmInitialized: () => isWasmInitialized,
   loadWasmNodejs: () => loadWasmNodejs
 });
+function warnNodejsWasmDeprecated() {
+  if (_nodejsWasmWarned) return;
+  _nodejsWasmWarned = true;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
+  console.warn(`[Checkpoint] ${MIGRATION_ERROR}`);
+}
+function __resetNodejsWasmWarningForTests() {
+  _nodejsWasmWarned = false;
+}
 async function loadWasmNodejs() {
-  if (wasmInitialized) {
-    return true;
-  }
-  try {
-    const possiblePaths = [
-      // In node_modules (most likely)
-      path__default.default.join(
-        process.cwd(),
-        "node_modules",
-        "@kya-os",
-        "agentshield",
-        "dist",
-        "wasm",
-        "agentshield_wasm_bg.wasm"
-      ),
-      // In project root (if user copied it)
-      path__default.default.join(process.cwd(), "agentshield_wasm_bg.wasm"),
-      // Relative to current file
-      path__default.default.join(
-        __dirname,
-        "..",
-        "..",
-        "..",
-        "agentshield",
-        "dist",
-        "wasm",
-        "agentshield_wasm_bg.wasm"
-      )
-    ];
-    let wasmBuffer = null;
-    let loadedPath = null;
-    for (const wasmPath of possiblePaths) {
-      try {
-        if (fs__default.default.existsSync(wasmPath)) {
-          wasmBuffer = fs__default.default.readFileSync(wasmPath);
-          loadedPath = wasmPath;
-          break;
-        }
-      } catch (e) {
-        continue;
-      }
-    }
-    if (!wasmBuffer) {
-      console.warn("AgentShield: WASM file not found in any expected location");
-      return false;
-    }
-    const bytes = new Uint8Array(wasmBuffer);
-    wasmModule = await WebAssembly.compile(bytes);
-    checkpoint.setWasmModule(wasmModule);
-    wasmInitialized = true;
-    console.log(`\u2705 AgentShield: WASM loaded successfully from ${loadedPath} (Node.js runtime)`);
-    console.log("\u{1F510} Cryptographic verification enabled (95-100% confidence)");
-    return true;
-  } catch (error) {
-    console.warn("\u26A0\uFE0F AgentShield: Failed to load WASM in Node.js runtime:", error);
-    console.log("\u{1F4CA} Falling back to pattern detection (85% confidence)");
-    return false;
-  }
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function isNodejsRuntime() {
-  return typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node !== "undefined" && typeof __require !== "undefined";
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function getWasmModule() {
-  return wasmModule;
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function isWasmInitialized() {
-  return wasmInitialized;
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
-var wasmInitialized, wasmModule;
+var MIGRATION_ERROR, _nodejsWasmWarned;
 var init_nodejs_wasm_loader = __esm({
   "src/nodejs-wasm-loader.ts"() {
-    wasmInitialized = false;
-    wasmModule = null;
+    MIGRATION_ERROR = "`@kya-os/checkpoint-nextjs`'s `loadWasmNodejs` / `isNodejsRuntime` / `getWasmModule` / `isWasmInitialized` were deprecated in Phase-D.9a (legacy `agentshield-wasm` Rust crate retirement). The legacy `AgentDetector` class they fed is slated for deletion in AgentDetector-Deletion-2 (next minor). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs` \u2014 engine-backed via the Rust `kya-os-engine` crate, with automatic WASM loading via `@kya-os/checkpoint-wasm-runtime`. See packages/checkpoint-nextjs/README.md for the canonical recipe.";
+    _nodejsWasmWarned = false;
   }
 });
 
 // src/wasm-setup.ts
-var wasmInitialized2 = false;
+var wasmInitialized = false;
 var initPromise = null;
 var initAttempted = false;
 async function setupWasm() {
-  if (wasmInitialized2) {
+  if (wasmInitialized) {
     return;
   }
   if (initPromise) {
@@ -131,7 +79,7 @@ async function doSetupWasm() {
   initAttempted = true;
   try {
     if (typeof process !== "undefined" && process.env.NODE_ENV === "test") {
-      wasmInitialized2 = true;
+      wasmInitialized = true;
       return;
     }
     const isNodejs = typeof process !== "undefined" && typeof __require !== "undefined" && process.env.NEXT_RUNTIME === "nodejs";
@@ -139,7 +87,7 @@ async function doSetupWasm() {
       try {
         const { loadWasmNodejs: loadWasmNodejs2 } = await Promise.resolve().then(() => (init_nodejs_wasm_loader(), nodejs_wasm_loader_exports));
         const loaded = await loadWasmNodejs2();
-        wasmInitialized2 = true;
+        wasmInitialized = true;
         if (loaded) {
           console.log("\u{1F680} AgentShield: Running with full WASM support (Node.js runtime)");
         } else {
@@ -150,7 +98,7 @@ async function doSetupWasm() {
         console.warn("\u26A0\uFE0F AgentShield: Node.js WASM loader failed:", error);
       }
     }
-    wasmInitialized2 = true;
+    wasmInitialized = true;
     if (process.env.NEXT_RUNTIME === "edge") {
       console.log(
         "\u26A1 AgentShield: Edge Runtime detected - using pattern detection (85% confidence)"
@@ -158,14 +106,14 @@ async function doSetupWasm() {
       console.log("\u2705 AgentShield: Ready for AI agent detection");
     }
   } catch (error) {
-    wasmInitialized2 = true;
+    wasmInitialized = true;
   }
 }
 function isWasmInitialized2() {
-  return wasmInitialized2;
+  return wasmInitialized;
 }
 function resetWasmState() {
-  wasmInitialized2 = false;
+  wasmInitialized = false;
   initPromise = null;
 }
 

package/dist/wasm-setup.mjs

@@ -1,7 +1,3 @@
-import fs from 'fs';
-import path from 'path';
-import { setWasmModule } from '@kya-os/checkpoint';
-
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -21,94 +17,51 @@ var __export = (target, all) => {
 // src/nodejs-wasm-loader.ts
 var nodejs_wasm_loader_exports = {};
 __export(nodejs_wasm_loader_exports, {
+  __resetNodejsWasmWarningForTests: () => __resetNodejsWasmWarningForTests,
   getWasmModule: () => getWasmModule,
   isNodejsRuntime: () => isNodejsRuntime,
   isWasmInitialized: () => isWasmInitialized,
   loadWasmNodejs: () => loadWasmNodejs
 });
+function warnNodejsWasmDeprecated() {
+  if (_nodejsWasmWarned) return;
+  _nodejsWasmWarned = true;
+  if (typeof process !== "undefined" && process.env?.NODE_ENV === "production") return;
+  console.warn(`[Checkpoint] ${MIGRATION_ERROR}`);
+}
+function __resetNodejsWasmWarningForTests() {
+  _nodejsWasmWarned = false;
+}
 async function loadWasmNodejs() {
-  if (wasmInitialized) {
-    return true;
-  }
-  try {
-    const possiblePaths = [
-      // In node_modules (most likely)
-      path.join(
-        process.cwd(),
-        "node_modules",
-        "@kya-os",
-        "agentshield",
-        "dist",
-        "wasm",
-        "agentshield_wasm_bg.wasm"
-      ),
-      // In project root (if user copied it)
-      path.join(process.cwd(), "agentshield_wasm_bg.wasm"),
-      // Relative to current file
-      path.join(
-        __dirname,
-        "..",
-        "..",
-        "..",
-        "agentshield",
-        "dist",
-        "wasm",
-        "agentshield_wasm_bg.wasm"
-      )
-    ];
-    let wasmBuffer = null;
-    let loadedPath = null;
-    for (const wasmPath of possiblePaths) {
-      try {
-        if (fs.existsSync(wasmPath)) {
-          wasmBuffer = fs.readFileSync(wasmPath);
-          loadedPath = wasmPath;
-          break;
-        }
-      } catch (e) {
-        continue;
-      }
-    }
-    if (!wasmBuffer) {
-      console.warn("AgentShield: WASM file not found in any expected location");
-      return false;
-    }
-    const bytes = new Uint8Array(wasmBuffer);
-    wasmModule = await WebAssembly.compile(bytes);
-    setWasmModule(wasmModule);
-    wasmInitialized = true;
-    console.log(`\u2705 AgentShield: WASM loaded successfully from ${loadedPath} (Node.js runtime)`);
-    console.log("\u{1F510} Cryptographic verification enabled (95-100% confidence)");
-    return true;
-  } catch (error) {
-    console.warn("\u26A0\uFE0F AgentShield: Failed to load WASM in Node.js runtime:", error);
-    console.log("\u{1F4CA} Falling back to pattern detection (85% confidence)");
-    return false;
-  }
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function isNodejsRuntime() {
-  return typeof process !== "undefined" && typeof process.versions !== "undefined" && typeof process.versions.node !== "undefined" && typeof __require !== "undefined";
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function getWasmModule() {
-  return wasmModule;
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
 function isWasmInitialized() {
-  return wasmInitialized;
+  warnNodejsWasmDeprecated();
+  throw new Error(MIGRATION_ERROR);
 }
-var wasmInitialized, wasmModule;
+var MIGRATION_ERROR, _nodejsWasmWarned;
 var init_nodejs_wasm_loader = __esm({
   "src/nodejs-wasm-loader.ts"() {
-    wasmInitialized = false;
-    wasmModule = null;
+    MIGRATION_ERROR = "`@kya-os/checkpoint-nextjs`'s `loadWasmNodejs` / `isNodejsRuntime` / `getWasmModule` / `isWasmInitialized` were deprecated in Phase-D.9a (legacy `agentshield-wasm` Rust crate retirement). The legacy `AgentDetector` class they fed is slated for deletion in AgentDetector-Deletion-2 (next minor). Migrate to `withCheckpoint` from `@kya-os/checkpoint-nextjs` \u2014 engine-backed via the Rust `kya-os-engine` crate, with automatic WASM loading via `@kya-os/checkpoint-wasm-runtime`. See packages/checkpoint-nextjs/README.md for the canonical recipe.";
+    _nodejsWasmWarned = false;
   }
 });
 
 // src/wasm-setup.ts
-var wasmInitialized2 = false;
+var wasmInitialized = false;
 var initPromise = null;
 var initAttempted = false;
 async function setupWasm() {
-  if (wasmInitialized2) {
+  if (wasmInitialized) {
     return;
   }
   if (initPromise) {
@@ -124,7 +77,7 @@ async function doSetupWasm() {
   initAttempted = true;
   try {
     if (typeof process !== "undefined" && process.env.NODE_ENV === "test") {
-      wasmInitialized2 = true;
+      wasmInitialized = true;
       return;
     }
     const isNodejs = typeof process !== "undefined" && typeof __require !== "undefined" && process.env.NEXT_RUNTIME === "nodejs";
@@ -132,7 +85,7 @@ async function doSetupWasm() {
       try {
         const { loadWasmNodejs: loadWasmNodejs2 } = await Promise.resolve().then(() => (init_nodejs_wasm_loader(), nodejs_wasm_loader_exports));
         const loaded = await loadWasmNodejs2();
-        wasmInitialized2 = true;
+        wasmInitialized = true;
         if (loaded) {
           console.log("\u{1F680} AgentShield: Running with full WASM support (Node.js runtime)");
         } else {
@@ -143,7 +96,7 @@ async function doSetupWasm() {
         console.warn("\u26A0\uFE0F AgentShield: Node.js WASM loader failed:", error);
       }
     }
-    wasmInitialized2 = true;
+    wasmInitialized = true;
     if (process.env.NEXT_RUNTIME === "edge") {
       console.log(
         "\u26A1 AgentShield: Edge Runtime detected - using pattern detection (85% confidence)"
@@ -151,14 +104,14 @@ async function doSetupWasm() {
       console.log("\u2705 AgentShield: Ready for AI agent detection");
     }
   } catch (error) {
-    wasmInitialized2 = true;
+    wasmInitialized = true;
   }
 }
 function isWasmInitialized2() {
-  return wasmInitialized2;
+  return wasmInitialized;
 }
 function resetWasmState() {
-  wasmInitialized2 = false;
+  wasmInitialized = false;
   initPromise = null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/checkpoint-nextjs",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Checkpoint Next.js middleware for AI agent detection (formerly @kya-os/agentshield-nextjs)",
   "keywords": [
     "nextjs",
@@ -115,12 +115,14 @@
     "rimraf": "^5.0.5",
     "tsup": "^8.0.2",
     "typescript": "^5.4.2",
+    "vite-plugin-top-level-await": "^1.6.0",
+    "vite-plugin-wasm": "^3.6.0",
     "vitest": "^1.3.1"
   },
   "peerDependencies": {
+    "@upstash/redis": ">=1.0.0",
     "next": ">=13.0.0",
-    "react": ">=18.0.0",
-    "@upstash/redis": ">=1.0.0"
+    "react": ">=18.0.0"
   },
   "peerDependenciesMeta": {
     "@upstash/redis": {
@@ -134,9 +136,9 @@
   "dependencies": {
     "@noble/ed25519": "^2.2.3",
     "@noble/hashes": "^2.0.1",
-    "@kya-os/checkpoint": "1.0.0",
-    "@kya-os/checkpoint-shared": "1.0.0",
-    "@kya-os/checkpoint-wasm-runtime": "^1.1.0"
+    "@kya-os/checkpoint": "1.0.1",
+    "@kya-os/checkpoint-shared": "1.1.0",
+    "@kya-os/checkpoint-wasm-runtime": "^1.4.0"
   },
   "scripts": {
     "build": "tsup",

package/templates/middleware-wasm-100.ts

@@ -1,8 +1,16 @@
 /**
- * AgentShield Middleware Template with WASM (95-100% Confidence)
+ * Checkpoint Middleware Template — Legacy WASM Factory
  *
- * This template provides full cryptographic verification for AI agents
- * following Next.js official documentation for WebAssembly in Edge Runtime.
+ * ⚠️ **DEPRECATED TEMPLATE (AgentDetector-Deletion-1):** this template
+ * uses `createWasmAgentShieldMiddleware`, which is deprecated and
+ * will be removed in the next minor. For new projects, use
+ * `withCheckpoint` instead — it's engine-backed (PDM-1 #2560), runs
+ * MCP-I envelope verification, and is the canonical Phase-D
+ * replacement. See the `withCheckpoint` recipe in
+ * `packages/checkpoint-nextjs/README.md`.
+ *
+ * This template stays in-tree for one release as a migration reference;
+ * the deprecated factory still works (with a dev-only console.warn).
  *
  * Installation:
  * 1. Copy this file to your project root as `middleware.ts`