@kya-os/checkpoint-wasm-runtime 1.1.0 → 1.1.2

package/dist/orchestrator-node.mjs

@@ -1,4 +1,470 @@
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var getFilename, getDirname, __dirname$1;
+var init_esm_shims = __esm({
+  "../../node_modules/.pnpm/tsup@8.5.0_@swc+core@1.15.32_jiti@2.6.1_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/esm_shims.js"() {
+    getFilename = () => fileURLToPath(import.meta.url);
+    getDirname = () => path.dirname(getFilename());
+    __dirname$1 = /* @__PURE__ */ getDirname();
+  }
+});
+
+// wasm/kya-os-engine/kya_os_engine.js
+var require_kya_os_engine = __commonJS({
+  "wasm/kya-os-engine/kya_os_engine.js"(exports$1, module) {
+    init_esm_shims();
+    var imports = {};
+    imports["__wbindgen_placeholder__"] = module.exports;
+    var cachedUint8ArrayMemory0 = null;
+    function getUint8ArrayMemory0() {
+      if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+      }
+      return cachedUint8ArrayMemory0;
+    }
+    var cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
+    cachedTextDecoder.decode();
+    function decodeText(ptr, len) {
+      return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+    }
+    function getStringFromWasm0(ptr, len) {
+      ptr = ptr >>> 0;
+      return decodeText(ptr, len);
+    }
+    var heap = new Array(128).fill(void 0);
+    heap.push(void 0, null, true, false);
+    var heap_next = heap.length;
+    function addHeapObject(obj) {
+      if (heap_next === heap.length) heap.push(heap.length + 1);
+      const idx = heap_next;
+      heap_next = heap[idx];
+      heap[idx] = obj;
+      return idx;
+    }
+    function getObject(idx) {
+      return heap[idx];
+    }
+    var WASM_VECTOR_LEN = 0;
+    var cachedTextEncoder = new TextEncoder();
+    if (!("encodeInto" in cachedTextEncoder)) {
+      cachedTextEncoder.encodeInto = function(arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+          read: arg.length,
+          written: buf.length
+        };
+      };
+    }
+    function passStringToWasm0(arg, malloc, realloc) {
+      if (realloc === void 0) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr2 = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr2, ptr2 + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr2;
+      }
+      let len = arg.length;
+      let ptr = malloc(len, 1) >>> 0;
+      const mem = getUint8ArrayMemory0();
+      let offset = 0;
+      for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 127) break;
+        mem[ptr + offset] = code;
+      }
+      if (offset !== len) {
+        if (offset !== 0) {
+          arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+      }
+      WASM_VECTOR_LEN = offset;
+      return ptr;
+    }
+    var cachedDataViewMemory0 = null;
+    function getDataViewMemory0() {
+      if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || cachedDataViewMemory0.buffer.detached === void 0 && cachedDataViewMemory0.buffer !== wasm.memory.buffer) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+      }
+      return cachedDataViewMemory0;
+    }
+    function isLikeNone(x) {
+      return x === void 0 || x === null;
+    }
+    function debugString(val) {
+      const type = typeof val;
+      if (type == "number" || type == "boolean" || val == null) {
+        return `${val}`;
+      }
+      if (type == "string") {
+        return `"${val}"`;
+      }
+      if (type == "symbol") {
+        const description = val.description;
+        if (description == null) {
+          return "Symbol";
+        } else {
+          return `Symbol(${description})`;
+        }
+      }
+      if (type == "function") {
+        const name = val.name;
+        if (typeof name == "string" && name.length > 0) {
+          return `Function(${name})`;
+        } else {
+          return "Function";
+        }
+      }
+      if (Array.isArray(val)) {
+        const length = val.length;
+        let debug = "[";
+        if (length > 0) {
+          debug += debugString(val[0]);
+        }
+        for (let i = 1; i < length; i++) {
+          debug += ", " + debugString(val[i]);
+        }
+        debug += "]";
+        return debug;
+      }
+      const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
+      let className;
+      if (builtInMatches && builtInMatches.length > 1) {
+        className = builtInMatches[1];
+      } else {
+        return toString.call(val);
+      }
+      if (className == "Object") {
+        try {
+          return "Object(" + JSON.stringify(val) + ")";
+        } catch (_) {
+          return "Object";
+        }
+      }
+      if (val instanceof Error) {
+        return `${val.name}: ${val.message}
+${val.stack}`;
+      }
+      return className;
+    }
+    function handleError(f, args) {
+      try {
+        return f.apply(this, args);
+      } catch (e) {
+        wasm.__wbindgen_export3(addHeapObject(e));
+      }
+    }
+    function getArrayU8FromWasm0(ptr, len) {
+      ptr = ptr >>> 0;
+      return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+    }
+    function dropObject(idx) {
+      if (idx < 132) return;
+      heap[idx] = heap_next;
+      heap_next = idx;
+    }
+    function takeObject(idx) {
+      const ret = getObject(idx);
+      dropObject(idx);
+      return ret;
+    }
+    exports$1.verify = function(input_js, ctx_js) {
+      try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        wasm.verify(retptr, addHeapObject(input_js), addHeapObject(ctx_js));
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+          throw takeObject(r1);
+        }
+        return takeObject(r0);
+      } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+      }
+    };
+    exports$1.__wbg_Error_e83987f665cf5504 = function(arg0, arg1) {
+      const ret = Error(getStringFromWasm0(arg0, arg1));
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_Number_bb48ca12f395cd08 = function(arg0) {
+      const ret = Number(getObject(arg0));
+      return ret;
+    };
+    exports$1.__wbg_String_8f0eb39a4a4c2f66 = function(arg0, arg1) {
+      const ret = String(getObject(arg1));
+      const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+      const len1 = WASM_VECTOR_LEN;
+      getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_bigint_get_as_i64_f3ebc5a755000afd = function(arg0, arg1) {
+      const v = getObject(arg1);
+      const ret = typeof v === "bigint" ? v : void 0;
+      getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
+      getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+    };
+    exports$1.__wbg___wbindgen_boolean_get_6d5a1ee65bab5f68 = function(arg0) {
+      const v = getObject(arg0);
+      const ret = typeof v === "boolean" ? v : void 0;
+      return isLikeNone(ret) ? 16777215 : ret ? 1 : 0;
+    };
+    exports$1.__wbg___wbindgen_debug_string_df47ffb5e35e6763 = function(arg0, arg1) {
+      const ret = debugString(getObject(arg1));
+      const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+      const len1 = WASM_VECTOR_LEN;
+      getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_in_bb933bd9e1b3bc0f = function(arg0, arg1) {
+      const ret = getObject(arg0) in getObject(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_bigint_cb320707dcd35f0b = function(arg0) {
+      const ret = typeof getObject(arg0) === "bigint";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_function_ee8a6c5833c90377 = function(arg0) {
+      const ret = typeof getObject(arg0) === "function";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_object_c818261d21f283a4 = function(arg0) {
+      const val = getObject(arg0);
+      const ret = typeof val === "object" && val !== null;
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_string_fbb76cb2940daafd = function(arg0) {
+      const ret = typeof getObject(arg0) === "string";
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_is_undefined_2d472862bd29a478 = function(arg0) {
+      const ret = getObject(arg0) === void 0;
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_jsval_eq_6b13ab83478b1c50 = function(arg0, arg1) {
+      const ret = getObject(arg0) === getObject(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_jsval_loose_eq_b664b38a2f582147 = function(arg0, arg1) {
+      const ret = getObject(arg0) == getObject(arg1);
+      return ret;
+    };
+    exports$1.__wbg___wbindgen_number_get_a20bf9b85341449d = function(arg0, arg1) {
+      const obj = getObject(arg1);
+      const ret = typeof obj === "number" ? obj : void 0;
+      getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
+      getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+    };
+    exports$1.__wbg___wbindgen_string_get_e4f06c90489ad01b = function(arg0, arg1) {
+      const obj = getObject(arg1);
+      const ret = typeof obj === "string" ? obj : void 0;
+      var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+      var len1 = WASM_VECTOR_LEN;
+      getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+      getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+    };
+    exports$1.__wbg___wbindgen_throw_b855445ff6a94295 = function(arg0, arg1) {
+      throw new Error(getStringFromWasm0(arg0, arg1));
+    };
+    exports$1.__wbg_call_e762c39fa8ea36bf = function() {
+      return handleError(function(arg0, arg1) {
+        const ret = getObject(arg0).call(getObject(arg1));
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_done_2042aa2670fb1db1 = function(arg0) {
+      const ret = getObject(arg0).done;
+      return ret;
+    };
+    exports$1.__wbg_entries_e171b586f8f6bdbf = function(arg0) {
+      const ret = Object.entries(getObject(arg0));
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_get_7bed016f185add81 = function(arg0, arg1) {
+      const ret = getObject(arg0)[arg1 >>> 0];
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_get_efcb449f58ec27c2 = function() {
+      return handleError(function(arg0, arg1) {
+        const ret = Reflect.get(getObject(arg0), getObject(arg1));
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_get_with_ref_key_1dc361bd10053bfe = function(arg0, arg1) {
+      const ret = getObject(arg0)[getObject(arg1)];
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_instanceof_ArrayBuffer_70beb1189ca63b38 = function(arg0) {
+      let result;
+      try {
+        result = getObject(arg0) instanceof ArrayBuffer;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_instanceof_Map_8579b5e2ab5437c7 = function(arg0) {
+      let result;
+      try {
+        result = getObject(arg0) instanceof Map;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_instanceof_Uint8Array_20c8e73002f7af98 = function(arg0) {
+      let result;
+      try {
+        result = getObject(arg0) instanceof Uint8Array;
+      } catch (_) {
+        result = false;
+      }
+      const ret = result;
+      return ret;
+    };
+    exports$1.__wbg_isArray_96e0af9891d0945d = function(arg0) {
+      const ret = Array.isArray(getObject(arg0));
+      return ret;
+    };
+    exports$1.__wbg_isSafeInteger_d216eda7911dde36 = function(arg0) {
+      const ret = Number.isSafeInteger(getObject(arg0));
+      return ret;
+    };
+    exports$1.__wbg_iterator_e5822695327a3c39 = function() {
+      const ret = Symbol.iterator;
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_length_69bca3cb64fc8748 = function(arg0) {
+      const ret = getObject(arg0).length;
+      return ret;
+    };
+    exports$1.__wbg_length_cdd215e10d9dd507 = function(arg0) {
+      const ret = getObject(arg0).length;
+      return ret;
+    };
+    exports$1.__wbg_new_1acc0b6eea89d040 = function() {
+      const ret = new Object();
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_new_5a79be3ab53b8aa5 = function(arg0) {
+      const ret = new Uint8Array(getObject(arg0));
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_new_68651c719dcda04e = function() {
+      const ret = /* @__PURE__ */ new Map();
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_new_e17d9f43105b08be = function() {
+      const ret = new Array();
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_next_020810e0ae8ebcb0 = function() {
+      return handleError(function(arg0) {
+        const ret = getObject(arg0).next();
+        return addHeapObject(ret);
+      }, arguments);
+    };
+    exports$1.__wbg_next_2c826fe5dfec6b6a = function(arg0) {
+      const ret = getObject(arg0).next;
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_prototypesetcall_2a6620b6922694b2 = function(arg0, arg1, arg2) {
+      Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
+    };
+    exports$1.__wbg_set_3f1d0b984ed272ed = function(arg0, arg1, arg2) {
+      getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
+    };
+    exports$1.__wbg_set_907fb406c34a251d = function(arg0, arg1, arg2) {
+      const ret = getObject(arg0).set(getObject(arg1), getObject(arg2));
+      return addHeapObject(ret);
+    };
+    exports$1.__wbg_set_c213c871859d6500 = function(arg0, arg1, arg2) {
+      getObject(arg0)[arg1 >>> 0] = takeObject(arg2);
+    };
+    exports$1.__wbg_value_692627309814bb8c = function(arg0) {
+      const ret = getObject(arg0).value;
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
+      const ret = getStringFromWasm0(arg0, arg1);
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_cast_4625c577ab2ec9ee = function(arg0) {
+      const ret = BigInt.asUintN(64, arg0);
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_cast_9ae0607507abb057 = function(arg0) {
+      const ret = arg0;
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
+      const ret = arg0;
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_object_clone_ref = function(arg0) {
+      const ret = getObject(arg0);
+      return addHeapObject(ret);
+    };
+    exports$1.__wbindgen_object_drop_ref = function(arg0) {
+      takeObject(arg0);
+    };
+    var wasmPath = `${__dirname$1}/kya_os_engine_bg.wasm`;
+    var wasmBytes = __require("fs").readFileSync(wasmPath);
+    var wasmModule2 = new WebAssembly.Module(wasmBytes);
+    var wasm = exports$1.__wasm = new WebAssembly.Instance(wasmModule2, imports).exports;
+  }
+});
+
+// src/engine/orchestrator/node.ts
+init_esm_shims();
+
+// src/engine/orchestrator/verify-request.ts
+init_esm_shims();
+
 // src/engine/adapters/outbound-url-policy.ts
+init_esm_shims();
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata", "metadata.google.internal"]);
 var UnsafeOutboundUrl = class extends Error {
   kind = "UnsafeOutboundUrl";
@@ -74,12 +540,18 @@ function isBlockedIpv6(hostname) {
 }
 
 // src/engine/index.ts
+init_esm_shims();
+var wasmModule = __toESM(require_kya_os_engine());
 function engineVerify(input, ctx) {
-  const result = (void 0)(input, ctx);
-  return result;
+  const verify2 = wasmModule.verify;
+  return verify2(input, ctx);
 }
 
+// src/engine/orchestrator/build-agent-request.ts
+init_esm_shims();
+
 // src/engine/adapters/util.ts
+init_esm_shims();
 function base64UrlDecode(input) {
   const padded = input.replace(/-/g, "+").replace(/_/g, "/");
   const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
@@ -374,6 +846,7 @@ function defaultLogger(msg) {
 }
 
 // src/engine/orchestrator/render-decision.ts
+init_esm_shims();
 function renderDecisionAsResponse(result) {
   const baseHeaders = buildBaseHeaders(result);
   if (result.enforcementMode === "observe") {

package/dist/orchestrator.d.mts

@@ -1,7 +1,87 @@
-export { makeVerifyRequest, verifyRequest } from './orchestrator-node.mjs';
-export { makeVerifyRequestEdge, verifyRequestEdge } from './orchestrator-edge.mjs';
-export { B as BuildAgentRequestOpts, I as IncomingHttpLike, R as RenderedResponse, V as VerifyRequestOpts, b as buildAgentRequest, e as extractAgentDid, a as extractCredentialStatusUrl, c as extractIssuer, h as hasMalformedJwsBody, r as renderDecisionAsResponse } from './render-decision-C1a-iuiW.mjs';
-export { initEngineEdge } from './engine-edge.mjs';
-import './types-D0j85fF0.mjs';
+import { VerifyRequestOpts, IncomingHttpLike } from './orchestrator-node.mjs';
+export { BuildAgentRequestOpts, RenderedResponse, buildAgentRequest, extractAgentDid, extractCredentialStatusUrl, extractIssuer, hasMalformedJwsBody, makeVerifyRequest, renderDecisionAsResponse, verifyRequest } from './orchestrator-node.mjs';
+import { V as VerifyResult } from './types-D0j85fF0.mjs';
 import '@kya-os/checkpoint-shared';
-import './adapters.mjs';
+
+/**
+ * `kya-os-engine` WASM bridge for edge runtimes — Edge-WASM-1.
+ *
+ * The Node target (`./index.ts`) uses `fs.readFileSync` at module
+ * load and exposes a sync `engineVerify`. That's incompatible with
+ * Vercel Edge / Cloudflare Workers / browser embedding (no `fs`,
+ * no sync wasm load).
+ *
+ * This module loads the `wasm-pack --target web` artifact via the
+ * async `__wbg_init` default export, then exposes the same typed
+ * `engineVerifyEdge(input, ctx) → Promise<VerifyResult>` shape with
+ * a small lazy-init wrapper. First call awaits initialisation;
+ * subsequent calls resolve synchronously on the JS side (the
+ * underlying wasm `verify` is sync).
+ *
+ * **Why this matters for the consolidation narrative.** Phase A
+ * shipped Node-only. Without an edge build, the first Vercel-edge
+ * or Cloudflare-Workers deployment after Phase D would hit the
+ * same wasm-bindgen-on-edge wall the Sites-1 F3 workaround was
+ * created to dodge — and someone would re-introduce the
+ * inline-TS detector that Q10 ratified deleting. Shipping the
+ * edge target alongside the Node target keeps Phase D's
+ * deletion narrative durable.
+ */
+
+/**
+ * Initialise the edge wasm module. Idempotent — subsequent calls
+ * return the same in-flight or resolved promise. Host wrappers can
+ * call this at startup to eagerly load the wasm and avoid first-
+ * request latency, but it's not required: `engineVerifyEdge`
+ * lazily initialises on first call.
+ *
+ * @param moduleOrPath  Optional pre-fetched `WebAssembly.Module` or
+ *                      a URL / Request the wasm-bindgen loader will
+ *                      fetch. Defaults to the bundled artifact via
+ *                      `import.meta.url`. Cloudflare Workers / Vercel
+ *                      Edge typically pass a pre-bundled `Module`.
+ */
+declare function initEngineEdge(moduleOrPath?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
+
+/**
+ * `verifyRequestEdge` async-init orchestrator — Edge-WASM-2 (folded into
+ * Phase D's PR).
+ *
+ * Mirror of [[./verify-request.ts]] for edge runtimes. Differs in only
+ * three places:
+ *
+ *   1. Imports `engineVerifyEdge` + `initEngineEdge` from `../edge`
+ *      instead of `engineVerify` from `../index` (Node target).
+ *   2. Awaits `initEngineEdge()` before the engine call — async-init
+ *      pattern required by the `--target web` wasm-bindgen build.
+ *   3. The final engine call is `await engineVerifyEdge(...)` rather
+ *      than the synchronous `engineVerify(...)`.
+ *
+ * **The two files MUST stay in sync.** Any change to verify-request.ts
+ * (new adapter, new error-classification rule, new ContextSpec field)
+ * MUST be mirrored here. The cross-target parity test in
+ * [[__tests__/verify-request-parity.test.ts]] guards the verdict-shape
+ * invariant — both orchestrators must produce identical
+ * `VerifyResult.decision` / `engineInfo.name` on identical inputs.
+ *
+ * Cedar-1 forward-compat: same seam as the Node variant — step (5)
+ * (tenant policy eval) is the only place the PolicyEvaluator
+ * interface gets exercised. When Cedar-1 swaps implementations, this
+ * orchestrator does not change.
+ */
+
+/**
+ * Factory — constructs a `verifyRequestEdge` closure that remembers the
+ * one-shot Argus-not-configured warning state. Use this when the
+ * host wrapper wants the startup log; call `verifyRequestEdge` directly
+ * (the loose function below) if you don't.
+ */
+declare function makeVerifyRequestEdge(opts: VerifyRequestOpts): (req: IncomingHttpLike) => Promise<VerifyResult>;
+/**
+ * Single-shot async entry. Use [`makeVerifyRequestEdge`] in long-lived
+ * hosts (so the Argus warning is one-shot per process); use this
+ * loose form in tests + one-off invocations.
+ */
+declare function verifyRequestEdge(req: IncomingHttpLike, opts: VerifyRequestOpts): Promise<VerifyResult>;
+
+export { IncomingHttpLike, VerifyRequestOpts, initEngineEdge, makeVerifyRequestEdge, verifyRequestEdge };

package/dist/orchestrator.d.ts

@@ -1,7 +1,87 @@
-export { makeVerifyRequest, verifyRequest } from './orchestrator-node.js';
-export { makeVerifyRequestEdge, verifyRequestEdge } from './orchestrator-edge.js';
-export { B as BuildAgentRequestOpts, I as IncomingHttpLike, R as RenderedResponse, V as VerifyRequestOpts, b as buildAgentRequest, e as extractAgentDid, a as extractCredentialStatusUrl, c as extractIssuer, h as hasMalformedJwsBody, r as renderDecisionAsResponse } from './render-decision-Dsjwt96g.js';
-export { initEngineEdge } from './engine-edge.js';
-import './types-D0j85fF0.js';
+import { VerifyRequestOpts, IncomingHttpLike } from './orchestrator-node.js';
+export { BuildAgentRequestOpts, RenderedResponse, buildAgentRequest, extractAgentDid, extractCredentialStatusUrl, extractIssuer, hasMalformedJwsBody, makeVerifyRequest, renderDecisionAsResponse, verifyRequest } from './orchestrator-node.js';
+import { V as VerifyResult } from './types-D0j85fF0.js';
 import '@kya-os/checkpoint-shared';
-import './adapters.js';
+
+/**
+ * `kya-os-engine` WASM bridge for edge runtimes — Edge-WASM-1.
+ *
+ * The Node target (`./index.ts`) uses `fs.readFileSync` at module
+ * load and exposes a sync `engineVerify`. That's incompatible with
+ * Vercel Edge / Cloudflare Workers / browser embedding (no `fs`,
+ * no sync wasm load).
+ *
+ * This module loads the `wasm-pack --target web` artifact via the
+ * async `__wbg_init` default export, then exposes the same typed
+ * `engineVerifyEdge(input, ctx) → Promise<VerifyResult>` shape with
+ * a small lazy-init wrapper. First call awaits initialisation;
+ * subsequent calls resolve synchronously on the JS side (the
+ * underlying wasm `verify` is sync).
+ *
+ * **Why this matters for the consolidation narrative.** Phase A
+ * shipped Node-only. Without an edge build, the first Vercel-edge
+ * or Cloudflare-Workers deployment after Phase D would hit the
+ * same wasm-bindgen-on-edge wall the Sites-1 F3 workaround was
+ * created to dodge — and someone would re-introduce the
+ * inline-TS detector that Q10 ratified deleting. Shipping the
+ * edge target alongside the Node target keeps Phase D's
+ * deletion narrative durable.
+ */
+
+/**
+ * Initialise the edge wasm module. Idempotent — subsequent calls
+ * return the same in-flight or resolved promise. Host wrappers can
+ * call this at startup to eagerly load the wasm and avoid first-
+ * request latency, but it's not required: `engineVerifyEdge`
+ * lazily initialises on first call.
+ *
+ * @param moduleOrPath  Optional pre-fetched `WebAssembly.Module` or
+ *                      a URL / Request the wasm-bindgen loader will
+ *                      fetch. Defaults to the bundled artifact via
+ *                      `import.meta.url`. Cloudflare Workers / Vercel
+ *                      Edge typically pass a pre-bundled `Module`.
+ */
+declare function initEngineEdge(moduleOrPath?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
+
+/**
+ * `verifyRequestEdge` async-init orchestrator — Edge-WASM-2 (folded into
+ * Phase D's PR).
+ *
+ * Mirror of [[./verify-request.ts]] for edge runtimes. Differs in only
+ * three places:
+ *
+ *   1. Imports `engineVerifyEdge` + `initEngineEdge` from `../edge`
+ *      instead of `engineVerify` from `../index` (Node target).
+ *   2. Awaits `initEngineEdge()` before the engine call — async-init
+ *      pattern required by the `--target web` wasm-bindgen build.
+ *   3. The final engine call is `await engineVerifyEdge(...)` rather
+ *      than the synchronous `engineVerify(...)`.
+ *
+ * **The two files MUST stay in sync.** Any change to verify-request.ts
+ * (new adapter, new error-classification rule, new ContextSpec field)
+ * MUST be mirrored here. The cross-target parity test in
+ * [[__tests__/verify-request-parity.test.ts]] guards the verdict-shape
+ * invariant — both orchestrators must produce identical
+ * `VerifyResult.decision` / `engineInfo.name` on identical inputs.
+ *
+ * Cedar-1 forward-compat: same seam as the Node variant — step (5)
+ * (tenant policy eval) is the only place the PolicyEvaluator
+ * interface gets exercised. When Cedar-1 swaps implementations, this
+ * orchestrator does not change.
+ */
+
+/**
+ * Factory — constructs a `verifyRequestEdge` closure that remembers the
+ * one-shot Argus-not-configured warning state. Use this when the
+ * host wrapper wants the startup log; call `verifyRequestEdge` directly
+ * (the loose function below) if you don't.
+ */
+declare function makeVerifyRequestEdge(opts: VerifyRequestOpts): (req: IncomingHttpLike) => Promise<VerifyResult>;
+/**
+ * Single-shot async entry. Use [`makeVerifyRequestEdge`] in long-lived
+ * hosts (so the Argus warning is one-shot per process); use this
+ * loose form in tests + one-off invocations.
+ */
+declare function verifyRequestEdge(req: IncomingHttpLike, opts: VerifyRequestOpts): Promise<VerifyResult>;
+
+export { IncomingHttpLike, VerifyRequestOpts, initEngineEdge, makeVerifyRequestEdge, verifyRequestEdge };