@kya-os/checkpoint-wasm-runtime 1.1.2 → 1.1.3

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @kya-os/checkpoint-wasm-runtime
 
+## 1.1.3 — 2026-05-17
+
+**Critical runtime fix for Express on Vercel.** 1.1.2 still failed at
+deploy time on `@vercel/node`-hosted Express functions with:
+
+```
+Error: Dynamic require of "fs" is not supported
+  at .../dist/orchestrator-node.mjs:14:9
+  at wasm/kya-os-engine/kya_os_engine.js (...:454:21)
+```
+
+### Root cause
+
+The wasm-bindgen `--target nodejs` glue contains literal
+`require('fs').readFileSync(...)` to load the .wasm artifact. esbuild
+rewrites that to its `__require('fs')` helper. The helper checks
+`typeof require !== "undefined"` — in a pure ESM context (.mjs at
+runtime) there is no global `require`, so the helper falls through
+to its `throw Error('Dynamic require of "X" is not supported')`.
+
+`shims: true` injects `__dirname` / `__filename` shims but does **not**
+inject a `require` shim. The two are separate concerns in tsup.
+
+### Fix
+
+Format-aware tsup `banner` injects
+`const require = createRequire(import.meta.url);` at the top of every
+ESM (.mjs) Node-target bundle. esbuild's `__require` helper then
+finds `require` in scope and uses it for the .wasm load. CJS bundles
+are unchanged (they already have a real `require` global). Edge
+bundles are unchanged (separate tsup config, no banner — Edge runtimes
+do not support `node:module`).
+
+### Why the previous "pivot to Express" path didn't escape this
+
+The architect's earlier verdict (close [#2616](https://github.com/Know-That-Ai/agent-shield/pull/2616),
+pivot bench to Express) was made under the assumption that Express's
+direct Node import flow would bypass the bundler-interop layers that
+broke Next.js Turbopack. Empirically, `@vercel/node` compiles the
+function entry into a CJS→ESM hybrid that loads
+`dist/orchestrator-node.mjs` through `loadESMFromCJS` — which executes
+the .mjs in pure ESM context. Same require-less environment, same
+failure. Express was not an escape.
+
+### Followup
+
+[SDK-Next.js-Integration-Audit-1 (#2618)](https://github.com/Know-That-Ai/agent-shield/issues/2618)
+Option B (wasm-bindgen `--target bundler`) remains the proper long-term
+fix — it generates wasm-bindgen glue that does not require runtime CJS
+globals. Until that lands, the createRequire banner is the minimal
+defense for all Node-host runtimes.
+
+### Surfaced by
+
+Bench-Before-After-1 §3.8 — `bench-new-express` deployment on Vercel
+returned `FUNCTION_INVOCATION_FAILED` with the stack trace above. The
+stack proved the failure persists past the Express pivot, requiring
+the wasm-runtime fix to be re-opened.
+
+---
+
 ## 1.1.2 — 2026-05-17
 
 Fourth in the SDK-WASM-Bundler-Loader sequence. The 1.1.1 fix made

package/dist/edge.js

@@ -1218,7 +1218,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/edge.mjs

@@ -1,4 +1,4 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
 
 // src/types.ts
 var CONFIDENCE = {
@@ -1216,7 +1216,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/engine.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {

package/dist/index.js

@@ -1443,7 +1443,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/index.mjs

@@ -1,4 +1,7 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { createRequire } from 'module';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
+
+createRequire(import.meta.url);
 
 // src/types.ts
 var CONFIDENCE = {
@@ -1439,7 +1442,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/node.js

@@ -786,7 +786,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/node.mjs

@@ -1,4 +1,7 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { createRequire } from 'module';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
+
+createRequire(import.meta.url);
 
 // src/types.ts
 var CONFIDENCE = {
@@ -784,7 +787,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/orchestrator-node.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {

package/dist/orchestrator.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/checkpoint-wasm-runtime",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Checkpoint WASM runtime for AI agent detection across all environments (formerly @kya-os/agentshield-wasm-runtime)",
   "keywords": [
     "ai",