@kya-os/checkpoint-wasm-runtime 1.0.0 → 1.1.1

package/dist/orchestrator.mjs

@@ -1,19 +1,460 @@
+var __create = Object.create;
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// wasm/kya-os-engine/kya_os_engine.js
+var require_kya_os_engine = __commonJS({
+  "wasm/kya-os-engine/kya_os_engine.js"(exports$1, module) {
+    var imports = {};
+    imports["__wbindgen_placeholder__"] = module.exports;
+    var cachedUint8ArrayMemory02 = null;
+    function getUint8ArrayMemory02() {
+      if (cachedUint8ArrayMemory02 === null || cachedUint8ArrayMemory02.byteLength === 0) {
+        cachedUint8ArrayMemory02 = new Uint8Array(wasm2.memory.buffer);
+      }
+      return cachedUint8ArrayMemory02;
+    }
+    var cachedTextDecoder2 = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
+    cachedTextDecoder2.decode();
+    function decodeText2(ptr, len) {
+      return cachedTextDecoder2.decode(getUint8ArrayMemory02().subarray(ptr, ptr + len));
+    }
+    function getStringFromWasm02(ptr, len) {
+      ptr = ptr >>> 0;
+      return decodeText2(ptr, len);
+    }
+    var heap2 = new Array(128).fill(void 0);
+    heap2.push(void 0, null, true, false);
+    var heap_next2 = heap2.length;
+    function addHeapObject2(obj) {
+      if (heap_next2 === heap2.length) heap2.push(heap2.length + 1);
+      const idx = heap_next2;
+      heap_next2 = heap2[idx];
+      heap2[idx] = obj;
+      return idx;
+    }
+    function getObject2(idx) {
+      return heap2[idx];
+    }
+    var WASM_VECTOR_LEN2 = 0;
+    var cachedTextEncoder2 = new TextEncoder();
+    if (!("encodeInto" in cachedTextEncoder2)) {
+      cachedTextEncoder2.encodeInto = function(arg, view) {
+        const buf = cachedTextEncoder2.encode(arg);
+        view.set(buf);
+        return {
+          read: arg.length,
+          written: buf.length
+        };
+      };
+    }
+    function passStringToWasm02(arg, malloc, realloc) {
+      if (realloc === void 0) {
+        const buf = cachedTextEncoder2.encode(arg);
+        const ptr2 = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory02().subarray(ptr2, ptr2 + buf.length).set(buf);
+        WASM_VECTOR_LEN2 = buf.length;
+        return ptr2;
+      }
+      let len = arg.length;
+      let ptr = malloc(len, 1) >>> 0;
+      const mem = getUint8ArrayMemory02();
+      let offset = 0;
+      for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 127) break;
+        mem[ptr + offset] = code;
+      }
+      if (offset !== len) {
+        if (offset !== 0) {
+          arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory02().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder2.encodeInto(arg, view);
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+      }
+      WASM_VECTOR_LEN2 = offset;
+      return ptr;
+    }
+    var cachedDataViewMemory02 = null;
+    function getDataViewMemory02() {
+      if (cachedDataViewMemory02 === null || cachedDataViewMemory02.buffer.detached === true || cachedDataViewMemory02.buffer.detached === void 0 && cachedDataViewMemory02.buffer !== wasm2.memory.buffer) {
+        cachedDataViewMemory02 = new DataView(wasm2.memory.buffer);
+      }
+      return cachedDataViewMemory02;
+    }
+    function isLikeNone2(x) {
+      return x === void 0 || x === null;
+    }
+    function debugString2(val) {
+      const type = typeof val;
+      if (type == "number" || type == "boolean" || val == null) {
+        return `${val}`;
+      }
+      if (type == "string") {
+        return `"${val}"`;
+      }
+      if (type == "symbol") {
+        const description = val.description;
+        if (description == null) {
+          return "Symbol";
+        } else {
+          return `Symbol(${description})`;
+        }
+      }
+      if (type == "function") {
+        const name = val.name;
+        if (typeof name == "string" && name.length > 0) {
+          return `Function(${name})`;
+        } else {
+          return "Function";
+        }
+      }
+      if (Array.isArray(val)) {
+        const length = val.length;
+        let debug = "[";
+        if (length > 0) {
+          debug += debugString2(val[0]);
+        }
+        for (let i = 1; i < length; i++) {
+          debug += ", " + debugString2(val[i]);
+        }
+        debug += "]";
+        return debug;
+      }
+      const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+      let className;
+      if (builtInMatches && builtInMatches.length > 1) {
+        className = builtInMatches[1];
+      } else {
+        return toString.call(val);
+      }
+      if (className == "Object") {
+        try {
+          return "Object(" + JSON.stringify(val) + ")";
+        } catch (_) {
+          return "Object";
+        }
+      }
+      if (val instanceof Error) {
+        return `${val.name}: ${val.message}
+${val.stack}`;
+      }
+      return className;
+    }
+    function handleError2(f, args) {
+      try {
+        return f.apply(this, args);
+      } catch (e) {
+        wasm2.__wbindgen_export3(addHeapObject2(e));
+      }
+    }
+    function getArrayU8FromWasm02(ptr, len) {
+      ptr = ptr >>> 0;
+      return getUint8ArrayMemory02().subarray(ptr / 1, ptr / 1 + len);
+    }
+    function dropObject2(idx) {
+      if (idx < 132) return;
+      heap2[idx] = heap_next2;
+      heap_next2 = idx;
+    }
+    function takeObject2(idx) {
+      const ret = getObject2(idx);
+      dropObject2(idx);
+      return ret;
+    }
+    exports$1.verify = function(input_js, ctx_js) {
+      try {
+        const retptr = wasm2.__wbindgen_add_to_stack_pointer(-16);
+        wasm2.verify(retptr, addHeapObject2(input_js), addHeapObject2(ctx_js));
+        var r0 = getDataViewMemory02().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory02().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory02().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+          throw takeObject2(r1);
+        }
+        return takeObject2(r0);
+      } finally {
+        wasm2.__wbindgen_add_to_stack_pointer(16);
+      }
+    };
+    exports$1.__wbg_Error_e83987f665cf5504 = function(arg0, arg1) {
+      const ret = Error(getStringFromWasm02(arg0, arg1));
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_Number_bb48ca12f395cd08 = function(arg0) {
+      const ret = Number(getObject2(arg0));
+      return ret;
+    };
+    exports$1.__wbg_String_8f0eb39a4a4c2f66 = function(arg0, arg1) {
+      const ret = String(getObject2(arg1));
+      const ptr1 = passStringToWasm02(ret, wasm2.__wbindgen_export, wasm2.__wbindgen_export2);
+      const len1 = WASM_VECTOR_LEN2;
+      getDataViewMemory02().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory02().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_bigint_get_as_i64_f3ebc5a755000afd = function(arg0, arg1) {
+      const v = getObject2(arg1);
+      const ret = typeof v === "bigint" ? v : void 0;
+      getDataViewMemory02().setBigInt64(arg0 + 8 * 1, isLikeNone2(ret) ? BigInt(0) : ret, true);
+      getDataViewMemory02().setInt32(arg0 + 4 * 0, !isLikeNone2(ret), true);
+    };
+    exports$1.__wbg___wbindgen_boolean_get_6d5a1ee65bab5f68 = function(arg0) {
+      const v = getObject2(arg0);
+      const ret = typeof v === "boolean" ? v : void 0;
+      return isLikeNone2(ret) ? 16777215 : ret ? 1 : 0;
+    };
+    exports$1.__wbg___wbindgen_debug_string_df47ffb5e35e6763 = function(arg0, arg1) {
+      const ret = debugString2(getObject2(arg1));
+      const ptr1 = passStringToWasm02(ret, wasm2.__wbindgen_export, wasm2.__wbindgen_export2);
+      const len1 = WASM_VECTOR_LEN2;
+      getDataViewMemory02().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory02().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_in_bb933bd9e1b3bc0f = function(arg0, arg1) {
+      const ret = getObject2(arg0) in getObject2(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_bigint_cb320707dcd35f0b = function(arg0) {
+      const ret = typeof getObject2(arg0) === "bigint";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_function_ee8a6c5833c90377 = function(arg0) {
+      const ret = typeof getObject2(arg0) === "function";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_object_c818261d21f283a4 = function(arg0) {
+      const val = getObject2(arg0);
+      const ret = typeof val === "object" && val !== null;
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_string_fbb76cb2940daafd = function(arg0) {
+      const ret = typeof getObject2(arg0) === "string";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_undefined_2d472862bd29a478 = function(arg0) {
+      const ret = getObject2(arg0) === void 0;
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_jsval_eq_6b13ab83478b1c50 = function(arg0, arg1) {
+      const ret = getObject2(arg0) === getObject2(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_jsval_loose_eq_b664b38a2f582147 = function(arg0, arg1) {
+      const ret = getObject2(arg0) == getObject2(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_number_get_a20bf9b85341449d = function(arg0, arg1) {
+      const obj = getObject2(arg1);
+      const ret = typeof obj === "number" ? obj : void 0;
+      getDataViewMemory02().setFloat64(arg0 + 8 * 1, isLikeNone2(ret) ? 0 : ret, true);
+      getDataViewMemory02().setInt32(arg0 + 4 * 0, !isLikeNone2(ret), true);
+    };
+    exports$1.__wbg___wbindgen_string_get_e4f06c90489ad01b = function(arg0, arg1) {
+      const obj = getObject2(arg1);
+      const ret = typeof obj === "string" ? obj : void 0;
+      var ptr1 = isLikeNone2(ret) ? 0 : passStringToWasm02(ret, wasm2.__wbindgen_export, wasm2.__wbindgen_export2);
+      var len1 = WASM_VECTOR_LEN2;
+      getDataViewMemory02().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory02().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_throw_b855445ff6a94295 = function(arg0, arg1) {
+      throw new Error(getStringFromWasm02(arg0, arg1));
+    };
+    exports$1.__wbg_call_e762c39fa8ea36bf = function() {
+      return handleError2(function(arg0, arg1) {
+        const ret = getObject2(arg0).call(getObject2(arg1));
+        return addHeapObject2(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_done_2042aa2670fb1db1 = function(arg0) {
+      const ret = getObject2(arg0).done;
+      return ret;
+    };
+    exports$1.__wbg_entries_e171b586f8f6bdbf = function(arg0) {
+      const ret = Object.entries(getObject2(arg0));
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_get_7bed016f185add81 = function(arg0, arg1) {
+      const ret = getObject2(arg0)[arg1 >>> 0];
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_get_efcb449f58ec27c2 = function() {
+      return handleError2(function(arg0, arg1) {
+        const ret = Reflect.get(getObject2(arg0), getObject2(arg1));
+        return addHeapObject2(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_get_with_ref_key_1dc361bd10053bfe = function(arg0, arg1) {
+      const ret = getObject2(arg0)[getObject2(arg1)];
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_instanceof_ArrayBuffer_70beb1189ca63b38 = function(arg0) {
+      let result;
+      try {
+        result = getObject2(arg0) instanceof ArrayBuffer;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_instanceof_Map_8579b5e2ab5437c7 = function(arg0) {
+      let result;
+      try {
+        result = getObject2(arg0) instanceof Map;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_instanceof_Uint8Array_20c8e73002f7af98 = function(arg0) {
+      let result;
+      try {
+        result = getObject2(arg0) instanceof Uint8Array;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_isArray_96e0af9891d0945d = function(arg0) {
+      const ret = Array.isArray(getObject2(arg0));
+      return ret;
+    };
+    exports$1.__wbg_isSafeInteger_d216eda7911dde36 = function(arg0) {
+      const ret = Number.isSafeInteger(getObject2(arg0));
+      return ret;
+    };
+    exports$1.__wbg_iterator_e5822695327a3c39 = function() {
+      const ret = Symbol.iterator;
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_length_69bca3cb64fc8748 = function(arg0) {
+      const ret = getObject2(arg0).length;
+      return ret;
+    };
+    exports$1.__wbg_length_cdd215e10d9dd507 = function(arg0) {
+      const ret = getObject2(arg0).length;
+      return ret;
+    };
+    exports$1.__wbg_new_1acc0b6eea89d040 = function() {
+      const ret = new Object();
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_new_5a79be3ab53b8aa5 = function(arg0) {
+      const ret = new Uint8Array(getObject2(arg0));
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_new_68651c719dcda04e = function() {
+      const ret = /* @__PURE__ */ new Map();
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_new_e17d9f43105b08be = function() {
+      const ret = new Array();
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_next_020810e0ae8ebcb0 = function() {
+      return handleError2(function(arg0) {
+        const ret = getObject2(arg0).next();
+        return addHeapObject2(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_next_2c826fe5dfec6b6a = function(arg0) {
+      const ret = getObject2(arg0).next;
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_prototypesetcall_2a6620b6922694b2 = function(arg0, arg1, arg2) {
+      Uint8Array.prototype.set.call(getArrayU8FromWasm02(arg0, arg1), getObject2(arg2));
+    };
+    exports$1.__wbg_set_3f1d0b984ed272ed = function(arg0, arg1, arg2) {
+      getObject2(arg0)[takeObject2(arg1)] = takeObject2(arg2);
+    };
+    exports$1.__wbg_set_907fb406c34a251d = function(arg0, arg1, arg2) {
+      const ret = getObject2(arg0).set(getObject2(arg1), getObject2(arg2));
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbg_set_c213c871859d6500 = function(arg0, arg1, arg2) {
+      getObject2(arg0)[arg1 >>> 0] = takeObject2(arg2);
+    };
+    exports$1.__wbg_value_692627309814bb8c = function(arg0) {
+      const ret = getObject2(arg0).value;
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
+      const ret = getStringFromWasm02(arg0, arg1);
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_cast_4625c577ab2ec9ee = function(arg0) {
+      const ret = BigInt.asUintN(64, arg0);
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_cast_9ae0607507abb057 = function(arg0) {
+      const ret = arg0;
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
+      const ret = arg0;
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_object_clone_ref = function(arg0) {
+      const ret = getObject2(arg0);
+      return addHeapObject2(ret);
+    };
+    exports$1.__wbindgen_object_drop_ref = function(arg0) {
+      takeObject2(arg0);
+    };
+    var wasmPath = `${__dirname}/kya_os_engine_bg.wasm`;
+    var wasmBytes = __require("fs").readFileSync(wasmPath);
+    var wasmModule2 = new WebAssembly.Module(wasmBytes);
+    var wasm2 = exports$1.__wasm = new WebAssembly.Instance(wasmModule2, imports).exports;
+  }
+});
 
 // wasm/kya-os-engine-web/kya_os_engine.js
 var kya_os_engine_exports = {};
 __export(kya_os_engine_exports, {
   default: () => kya_os_engine_default,
   initSync: () => initSync,
-  verify: () => verify
+  verify: () => verify2
 });
 function getUint8ArrayMemory0() {
   if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
@@ -160,7 +601,7 @@ function takeObject(idx) {
   dropObject(idx);
   return ret;
 }
-function verify(input_js, ctx_js) {
+function verify2(input_js, ctx_js) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     wasm.verify(retptr, addHeapObject(input_js), addHeapObject(ctx_js));
@@ -579,9 +1020,10 @@ function isBlockedIpv6(hostname) {
 }
 
 // src/engine/index.ts
+var wasmModule = __toESM(require_kya_os_engine());
 function engineVerify(input, ctx) {
-  const result = (void 0)(input, ctx);
-  return result;
+  const verify3 = wasmModule.verify;
+  return verify3(input, ctx);
 }
 
 // src/engine/adapters/util.ts
@@ -899,8 +1341,8 @@ function ensureReady(moduleOrPath) {
   return initialised;
 }
 async function engineVerifyEdge(input, ctx) {
-  const verify2 = await ensureReady();
-  return verify2(input, ctx);
+  const verify3 = await ensureReady();
+  return verify3(input, ctx);
 }
 
 // src/engine/orchestrator/render-decision.ts
@@ -1168,5 +1610,3 @@ function defaultLogger2(msg) {
 }
 
 export { buildAgentRequest, extractAgentDid, extractCredentialStatusUrl, extractIssuer, hasMalformedJwsBody, initEngineEdge, makeVerifyRequest, makeVerifyRequestEdge, renderDecisionAsResponse, verifyRequest, verifyRequestEdge };
-//# sourceMappingURL=orchestrator.mjs.map
-//# sourceMappingURL=orchestrator.mjs.map

package/dist/render-decision-C1a-iuiW.d.mts

@@ -0,0 +1,200 @@
+import { E as EnforcementMode, A as AgentRequest, V as VerifyResult } from './types-D0j85fF0.mjs';
+import { DidResolverAdapter, StatusListCacheAdapter, ReputationOracleAdapter, PolicyEvaluatorAdapter, ClockAdapter } from './adapters.mjs';
+
+/**
+ * Orchestrator-layer types — Phase C, host-side only.
+ *
+ * Nothing here crosses the WASM boundary. The engine ABI types live
+ * in `../types.ts`; the adapter interfaces live in
+ * `../adapters/index.ts`. This file is the host-wrapper-facing
+ * surface — what Phase D (Next.js) and Phase E (Express) import.
+ */
+
+/**
+ * Framework-agnostic HTTP request shape.
+ *
+ * Next.js / Express / Cloudflare Workers / Hono adapters marshal
+ * their native request type into this shape before calling
+ * `verifyRequest`. The shape is intentionally minimal — only what
+ * the engine needs to make a verdict.
+ */
+interface IncomingHttpLike {
+    method: string;
+    /** Path + query string (no scheme + host). */
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    /**
+     * Parsed body if the framework has already parsed it (Next.js
+     * with `await req.json()`, Express with `body-parser`). Falsy if
+     * the caller hasn't materialised the body — the orchestrator
+     * treats that as "no MCP-I envelope present" and routes to
+     * PlainHttp.
+     */
+    body?: Buffer | string | object | null;
+    /** Client IP if the framework surfaces one (Express `req.ip`). */
+    remoteAddress?: string;
+}
+/**
+ * Options the host wrapper passes per-`verifyRequest`-construction.
+ * The five adapters + clock + tenant identifier + enforcement mode.
+ */
+interface VerifyRequestOpts {
+    didResolver: DidResolverAdapter;
+    statusListCache: StatusListCacheAdapter;
+    reputationOracle: ReputationOracleAdapter;
+    policyEvaluator: PolicyEvaluatorAdapter;
+    clock: ClockAdapter;
+    /** Tenant identifier — the host customer this request targets. */
+    tenantHost: string;
+    enforcementMode: EnforcementMode;
+    /** Returned to the PolicyEvaluator when the request has no agent DID. Default 1.0. */
+    reputationBaseline?: number;
+    /**
+     * **Envelope-1 (#2537) coordination flag.** Pre-Envelope-1 the TS
+     * bouncer ships MCP-I proofs as `{protected,payload,signature}` JSON
+     * in a `KYA-Delegation` header. Post-Envelope-1 they ship compact
+     * JWS in `_meta.proof.jws` of the body. When this flag is true the
+     * orchestrator also accepts the legacy header form. **Default off.**
+     * Delete this flag once Envelope-1 ships end-to-end.
+     */
+    legacyEnvelopeFallback?: boolean;
+    /**
+     * Argus URL — passed only so the orchestrator can detect "Argus
+     * not configured" at construction time and log the one-shot
+     * warning. The actual reputation fetch goes through `reputationOracle`.
+     */
+    argusUrl?: string;
+    /** Injectable for the once-only Argus configuration warning. */
+    logger?: (msg: string) => void;
+}
+/**
+ * Transport-agnostic response shape `renderDecisionAsResponse`
+ * produces. Host wrappers adapt this to their framework's response
+ * type (NextResponse / Express `res` / Cloudflare Response).
+ *
+ * `status === null` means "pass through" — the request continues to
+ * the next handler. Happens in two cases:
+ *   1. `Decision::Permit` (no block in Enforce mode).
+ *   2. **Any verdict in Observe mode** — Observe never blocks, but
+ *      the response headers still carry the would-have-been verdict.
+ */
+interface RenderedResponse {
+    status: number | null;
+    headers: Record<string, string>;
+    body?: string | object;
+}
+
+/**
+ * HTTP-to-`AgentRequest` translator — Phase C.1.
+ *
+ * Detects which engine protocol the request belongs to and builds
+ * the typed `AgentRequest` the WASM consumes. Conservative
+ * detection: never escalates an ambiguous request into a higher
+ * verification tier. Anonymous PlainHttp is the default.
+ *
+ * **What this layer parses and what it doesn't.** It parses *only
+ * what's needed to drive conditional pre-fetch* — header presence,
+ * the MCP-I envelope's payload segment (to extract `iss` + `sub` +
+ * optional credentialStatus URL). It does **not** verify
+ * signatures, decode VC chains for revocation bits, or evaluate
+ * scope. Those live in the engine (H-1's parser + Stages 2-5).
+ *
+ * **Buffer-portability note.** This module uses `Buffer.from(...)` and
+ * `Buffer.isBuffer(...)` at multiple call sites (the JWS preflight
+ * `hasMalformedJwsBody`, both `tryBuildMcpIFromBody` variants, the
+ * legacy-header reconstitution path, and `bodyAsBytes`). All of these
+ * assume the Node `Buffer` global is available — provided natively by
+ * the Node runtime, polyfilled on Vercel Edge, and gated behind
+ * `nodejs_compat` on Cloudflare Workers. Bare-Edge and pure-browser
+ * embedders would need a `Buffer` polyfill or a refactor to
+ * `TextEncoder` / `Uint8Array.from`. Tracked as a follow-up since
+ * Phase D's Vercel Node + Vercel Edge targets are both covered today.
+ */
+
+interface BuildAgentRequestOpts {
+    /** See `VerifyRequestOpts.legacyEnvelopeFallback`. */
+    legacyEnvelopeFallback?: boolean;
+}
+/**
+ * Translate an HTTP-like request into the engine's `AgentRequest`.
+ *
+ * Detection order (conservative — never escalate ambiguous input):
+ *   1. MCP-I L2 detached proof in `_meta.proof.jws` (spec form).
+ *   2. (Legacy, opt-in) MCP-I in `KYA-Delegation` header
+ *      (Envelope-1 #2537 transition window only).
+ *   3. RFC 9421 HTTP Message Signatures (`Signature-Input` header).
+ *   4. PlainHttp (default — anonymous traffic).
+ */
+declare function buildAgentRequest(req: IncomingHttpLike, opts?: BuildAgentRequestOpts): AgentRequest;
+/**
+ * Preflight check — does the request body carry a `_meta.proof.jws`
+ * string that `parseJwsPayloadStruct` cannot project into a typed
+ * `McpIPayload`?
+ *
+ * The caller declared intent (an MCP-I envelope) by including the
+ * JWS field; structural failure to extract the payload means the
+ * envelope is malformed, not absent. Without this preflight, the
+ * orchestrator would silently fall through to PlainHttp — pre-#2560
+ * that happened to also Block (engine returned `Block(ParseError)`
+ * for every PlainHttp), so the regression was invisible; post-#2560
+ * the engine's Stage 1 + stub policy returns `Permit` for anonymous
+ * PlainHttp and tampered envelopes would be silently accepted.
+ *
+ * Returns `true` when the orchestrator should synthesize
+ * `Block(ParseError)` BEFORE calling `buildAgentRequest`.
+ */
+declare function hasMalformedJwsBody(req: IncomingHttpLike): boolean;
+/**
+ * Issuer DID — Stage 1 (identity resolution) targets this. `null`
+ * for PlainHttp (anonymous → no DID to resolve).
+ */
+declare function extractIssuer(request: AgentRequest): string | null;
+/**
+ * Agent DID — used by ReputationOracle. Defaults to `payload.sub`
+ * for MCP-I (subject = the agent the proof is *about*).
+ */
+declare function extractAgentDid(request: AgentRequest): string | null;
+/**
+ * Status-list URL for revocation pre-fetch. Pulled from the JWS
+ * payload's `vc.credentialStatus.id` (W3C VC Data Model 1.1).
+ * `null` when the envelope is L1 (no VC chain) — Stage 3 will skip.
+ */
+declare function extractCredentialStatusUrl(request: AgentRequest): string | null;
+
+/**
+ * Transport-agnostic `Decision` → HTTP renderer — Phase C.3.
+ *
+ * Translates a `VerifyResult` into a framework-neutral
+ * `{ status, headers, body }` shape. Phase D (Next.js) adapts this
+ * to `NextResponse`; Phase E (Express) adapts it to `res.status().set().send()`.
+ * One source of truth for the verdict→HTTP mapping.
+ *
+ * Mapping table (§ 4.5 of Phase C kickoff):
+ *
+ * | Decision                          | HTTP | Notes                                   |
+ * |-----------------------------------|------|-----------------------------------------|
+ * | Permit                            | null | Pass through to next handler            |
+ * | Block(Unauthenticated)            | 401  | WWW-Authenticate header                 |
+ * | Block(InvalidSignature)           | 403  |                                          |
+ * | Block(Revoked)                    | 403  |                                          |
+ * | Block(Expired)                    | 401  | Refresh-the-credential semantics        |
+ * | Block(OutOfScope)                 | 403  | Body carries requested + granted        |
+ * | Block(LowReputation)              | 403  | Body carries score + threshold          |
+ * | Block(PolicyDenied)               | 403  | Body carries detail                     |
+ * | Block(ParseError)                 | 400  | Body carries detail                     |
+ * | Challenge                         | 401  | Body carries ChallengeParams            |
+ * | Redirect                          | 302  | Location header                         |
+ * | Instruct                          | 422  | application/problem+json body           |
+ *
+ * Observe mode overrides: every verdict renders as `status: null`
+ * (pass through) with an `X-Checkpoint-Would-Have-Been` header
+ * carrying the verdict kind, plus the standard attribution headers.
+ *
+ * Every response carries the Phase 0.1 attribution headers:
+ * `X-Checkpoint-Engine`, `X-Checkpoint-Engine-Version`, and
+ * (when present) `X-Checkpoint-Ruleset-Hash`.
+ */
+
+declare function renderDecisionAsResponse(result: VerifyResult): RenderedResponse;
+
+export { type BuildAgentRequestOpts as B, type IncomingHttpLike as I, type RenderedResponse as R, type VerifyRequestOpts as V, extractCredentialStatusUrl as a, buildAgentRequest as b, extractIssuer as c, extractAgentDid as e, hasMalformedJwsBody as h, renderDecisionAsResponse as r };