@kya-os/checkpoint-wasm-runtime 1.1.2 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,86 @@
 # @kya-os/checkpoint-wasm-runtime
 
+## 1.2.0 — 2026-05-18
+
+Phase-D.8b engine-surface expansion.
+
+### Added
+
+- `VerifyResult.detectionDetail`, emitted by `kya-os-engine` in the same
+  pass as `decision`. This preserves the rich detection shape (`isAgent`,
+  `detectedAgent`, `agentType`, `verificationMethod`, `riskLevel`,
+  `reasons`) without forcing consumers to reconstruct it from
+  `decision.signals`.
+- Cross-runtime parity now compares `detectionDetail` across Rust,
+  Node-WASM, and Edge-WASM fixtures.
+
+### Changed
+
+- `verifyRequest()` and `verifyRequestEdge()` now return the richer
+  `VerifyResult` shape consistently for normal results and parse-error
+  fallbacks.
+
+## 1.1.3 — 2026-05-17
+
+**Critical runtime fix for Express on Vercel.** 1.1.2 still failed at
+deploy time on `@vercel/node`-hosted Express functions with:
+
+```
+Error: Dynamic require of "fs" is not supported
+  at .../dist/orchestrator-node.mjs:14:9
+  at wasm/kya-os-engine/kya_os_engine.js (...:454:21)
+```
+
+### Root cause
+
+The wasm-bindgen `--target nodejs` glue contains literal
+`require('fs').readFileSync(...)` to load the .wasm artifact. esbuild
+rewrites that to its `__require('fs')` helper. The helper checks
+`typeof require !== "undefined"` — in a pure ESM context (.mjs at
+runtime) there is no global `require`, so the helper falls through
+to its `throw Error('Dynamic require of "X" is not supported')`.
+
+`shims: true` injects `__dirname` / `__filename` shims but does **not**
+inject a `require` shim. The two are separate concerns in tsup.
+
+### Fix
+
+Format-aware tsup `banner` injects
+`const require = createRequire(import.meta.url);` at the top of every
+ESM (.mjs) Node-target bundle. esbuild's `__require` helper then
+finds `require` in scope and uses it for the .wasm load. CJS bundles
+are unchanged (they already have a real `require` global). Edge
+bundles are unchanged (separate tsup config, no banner — Edge runtimes
+do not support `node:module`).
+
+### Why the previous "pivot to Express" path didn't escape this
+
+The architect's earlier verdict (close [#2616](https://github.com/Know-That-Ai/agent-shield/pull/2616),
+pivot bench to Express) was made under the assumption that Express's
+direct Node import flow would bypass the bundler-interop layers that
+broke Next.js Turbopack. Empirically, `@vercel/node` compiles the
+function entry into a CJS→ESM hybrid that loads
+`dist/orchestrator-node.mjs` through `loadESMFromCJS` — which executes
+the .mjs in pure ESM context. Same require-less environment, same
+failure. Express was not an escape.
+
+### Followup
+
+[SDK-Next.js-Integration-Audit-1 (#2618)](https://github.com/Know-That-Ai/agent-shield/issues/2618)
+Option B (wasm-bindgen `--target bundler`) remains the proper long-term
+fix — it generates wasm-bindgen glue that does not require runtime CJS
+globals. Until that lands, the createRequire banner is the minimal
+defense for all Node-host runtimes.
+
+### Surfaced by
+
+Bench-Before-After-1 §3.8 — `bench-new-express` deployment on Vercel
+returned `FUNCTION_INVOCATION_FAILED` with the stack trace above. The
+stack proved the failure persists past the Express pivot, requiring
+the wasm-runtime fix to be re-opened.
+
+---
+
 ## 1.1.2 — 2026-05-17
 
 Fourth in the SDK-WASM-Bundler-Loader sequence. The 1.1.1 fix made

package/dist/adapters.d.mts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision } from './types-D0j85fF0.mjs';
+import { d as DidDocument, D as Decision } from './types-ByrdPLL2.mjs';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/adapters.d.ts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision } from './types-D0j85fF0.js';
+import { d as DidDocument, D as Decision } from './types-ByrdPLL2.js';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/edge.js

@@ -1218,7 +1218,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/edge.mjs

@@ -1,4 +1,4 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
 
 // src/types.ts
 var CONFIDENCE = {
@@ -1216,7 +1216,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/engine-edge.d.mts

@@ -1,6 +1,6 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-D0j85fF0.mjs';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-D0j85fF0.mjs';
-export { McpIPayload } from '@kya-os/checkpoint-shared';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.mjs';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.mjs';
+export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**
  * `kya-os-engine` WASM bridge for edge runtimes — Edge-WASM-1.

package/dist/engine-edge.d.ts

@@ -1,6 +1,6 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-D0j85fF0.js';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-D0j85fF0.js';
-export { McpIPayload } from '@kya-os/checkpoint-shared';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.js';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.js';
+export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**
  * `kya-os-engine` WASM bridge for edge runtimes — Edge-WASM-1.

package/dist/engine.d.mts

@@ -1,6 +1,6 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-D0j85fF0.mjs';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-D0j85fF0.mjs';
-export { McpIPayload } from '@kya-os/checkpoint-shared';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.mjs';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.mjs';
+export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**
  * `kya-os-engine` WASM bridge — E-1 (#2486 follow-up).

package/dist/engine.d.ts

@@ -1,6 +1,6 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-D0j85fF0.js';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-D0j85fF0.js';
-export { McpIPayload } from '@kya-os/checkpoint-shared';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.js';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.js';
+export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**
  * `kya-os-engine` WASM bridge — E-1 (#2486 follow-up).

package/dist/engine.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {

package/dist/index.js

@@ -1443,7 +1443,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/index.mjs

@@ -1,4 +1,7 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { createRequire } from 'module';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
+
+createRequire(import.meta.url);
 
 // src/types.ts
 var CONFIDENCE = {
@@ -1439,7 +1442,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/node.js

@@ -786,7 +786,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = checkpointShared.loadRulesSync();
+      this.rules = checkpointShared.RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/node.mjs

@@ -1,4 +1,7 @@
-import { loadRulesSync } from '@kya-os/checkpoint-shared';
+import { createRequire } from 'module';
+import { RuleLoader } from '@kya-os/checkpoint-shared';
+
+createRequire(import.meta.url);
 
 // src/types.ts
 var CONFIDENCE = {
@@ -784,7 +787,7 @@ var RulesDetector = class {
       return;
     }
     try {
-      this.rules = loadRulesSync();
+      this.rules = RuleLoader.loadSync();
       this.ready = true;
     } catch (error) {
       console.warn("[RulesDetector] Failed to load rules:", error);

package/dist/orchestrator-edge.d.mts

@@ -1,5 +1,5 @@
 export { initEngineEdge } from './engine-edge.mjs';
-import { E as EnforcementMode, A as AgentRequest, V as VerifyResult } from './types-D0j85fF0.mjs';
+import { E as EnforcementMode, A as AgentRequest, V as VerifyResult } from './types-ByrdPLL2.mjs';
 import { DidResolverAdapter, StatusListCacheAdapter, ReputationOracleAdapter, PolicyEvaluatorAdapter, ClockAdapter } from './adapters.mjs';
 import '@kya-os/checkpoint-shared';
 

package/dist/orchestrator-edge.d.ts

@@ -1,5 +1,5 @@
 export { initEngineEdge } from './engine-edge.js';
-import { E as EnforcementMode, A as AgentRequest, V as VerifyResult } from './types-D0j85fF0.js';
+import { E as EnforcementMode, A as AgentRequest, V as VerifyResult } from './types-ByrdPLL2.js';
 import { DidResolverAdapter, StatusListCacheAdapter, ReputationOracleAdapter, PolicyEvaluatorAdapter, ClockAdapter } from './adapters.js';
 import '@kya-os/checkpoint-shared';
 

package/dist/orchestrator-edge.js

@@ -799,6 +799,32 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/render-decision.ts
 function renderDecisionAsResponse(result) {
   const baseHeaders = buildBaseHeaders(result);
@@ -1049,14 +1075,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {

package/dist/orchestrator-edge.mjs

@@ -796,6 +796,32 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/render-decision.ts
 function renderDecisionAsResponse(result) {
   const baseHeaders = buildBaseHeaders(result);
@@ -1046,14 +1072,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {

package/dist/orchestrator-node.d.mts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision, E as EnforcementMode, V as VerifyResult, A as AgentRequest } from './types-D0j85fF0.mjs';
+import { d as DidDocument, D as Decision, E as EnforcementMode, V as VerifyResult, A as AgentRequest } from './types-ByrdPLL2.mjs';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/orchestrator-node.d.ts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision, E as EnforcementMode, V as VerifyResult, A as AgentRequest } from './types-D0j85fF0.js';
+import { d as DidDocument, D as Decision, E as EnforcementMode, V as VerifyResult, A as AgentRequest } from './types-ByrdPLL2.js';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/orchestrator-node.js

@@ -741,6 +741,33 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+init_cjs_shims();
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/verify-request.ts
 var DEFAULT_REPUTATION_BASELINE = 1;
 function makeVerifyRequest(opts) {
@@ -828,14 +855,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {

package/dist/orchestrator-node.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {
@@ -744,6 +746,33 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+init_esm_shims();
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/verify-request.ts
 var DEFAULT_REPUTATION_BASELINE = 1;
 function makeVerifyRequest(opts) {
@@ -831,14 +860,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {

package/dist/orchestrator.d.mts

@@ -1,6 +1,6 @@
 import { VerifyRequestOpts, IncomingHttpLike } from './orchestrator-node.mjs';
 export { BuildAgentRequestOpts, RenderedResponse, buildAgentRequest, extractAgentDid, extractCredentialStatusUrl, extractIssuer, hasMalformedJwsBody, makeVerifyRequest, renderDecisionAsResponse, verifyRequest } from './orchestrator-node.mjs';
-import { V as VerifyResult } from './types-D0j85fF0.mjs';
+import { V as VerifyResult } from './types-ByrdPLL2.mjs';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/orchestrator.d.ts

@@ -1,6 +1,6 @@
 import { VerifyRequestOpts, IncomingHttpLike } from './orchestrator-node.js';
 export { BuildAgentRequestOpts, RenderedResponse, buildAgentRequest, extractAgentDid, extractCredentialStatusUrl, extractIssuer, hasMalformedJwsBody, makeVerifyRequest, renderDecisionAsResponse, verifyRequest } from './orchestrator-node.js';
-import { V as VerifyResult } from './types-D0j85fF0.js';
+import { V as VerifyResult } from './types-ByrdPLL2.js';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/orchestrator.js

@@ -1244,6 +1244,33 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+init_cjs_shims();
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/verify-request.ts
 var DEFAULT_REPUTATION_BASELINE = 1;
 function makeVerifyRequest(opts) {
@@ -1331,14 +1358,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {
@@ -1625,14 +1647,9 @@ function blockWithParseError2(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger2(msg) {

package/dist/orchestrator.mjs

@@ -1,16 +1,18 @@
+import { createRequire } from 'module';
 import path from 'path';
 import { fileURLToPath } from 'url';
 
+const require$1 = createRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+var __require = /* @__PURE__ */ ((x) => typeof require$1 !== "undefined" ? require$1 : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require$1 !== "undefined" ? require$1 : a)[b]
 }) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
+  if (typeof require$1 !== "undefined") return require$1.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {
@@ -1244,6 +1246,33 @@ function bodyAsBytes(body) {
   return [];
 }
 
+// src/engine/orchestrator/synthetic-results.ts
+init_esm_shims();
+function hostSynthesizedEngineInfo() {
+  return {
+    name: "checkpoint-engine-wasm",
+    version: "0.0.0-host-synth",
+    rulesetHash: "sha256:host-synthesized",
+    rulesetVersion: "0.0.0-host-synth",
+    extras: { synthesized: true }
+  };
+}
+function parseErrorDetectionDetail(detail) {
+  return {
+    isAgent: false,
+    confidence: 0,
+    detectionClass: { type: "IncompleteData" },
+    confidenceLevel: "low",
+    reasons: [detail],
+    signals: [],
+    verificationMethod: "error",
+    riskLevel: "high",
+    forgeabilityRisk: "high",
+    timestamp: 0,
+    engine: hostSynthesizedEngineInfo()
+  };
+}
+
 // src/engine/orchestrator/verify-request.ts
 var DEFAULT_REPUTATION_BASELINE = 1;
 function makeVerifyRequest(opts) {
@@ -1331,14 +1360,9 @@ function blockWithParseError(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger(msg) {
@@ -1625,14 +1649,9 @@ function blockWithParseError2(detail, enforcementMode) {
         detail
       }
     },
+    detectionDetail: parseErrorDetectionDetail(detail),
     enforcementMode,
-    engineInfo: {
-      name: "checkpoint-engine-wasm",
-      version: "0.0.0-host-synth",
-      rulesetHash: "sha256:host-synthesized",
-      rulesetVersion: "0.0.0-host-synth",
-      extras: { synthesized: true }
-    }
+    engineInfo: hostSynthesizedEngineInfo()
   };
 }
 function defaultLogger2(msg) {

package/dist/{types-D0j85fF0.d.mts → types-ByrdPLL2.d.mts}

@@ -1,4 +1,4 @@
-import { McpIPayload } from '@kya-os/checkpoint-shared';
+import { McpIPayload, DetectionDetail } from '@kya-os/checkpoint-shared';
 
 /**
  * TypeScript shapes for the `kya-os-engine` WASM `verify` ABI (E-1).
@@ -138,6 +138,7 @@ interface EngineInfo {
 }
 interface VerifyResult {
     decision: Decision;
+    detectionDetail: DetectionDetail;
     enforcementMode: EnforcementMode;
     engineInfo: EngineInfo;
 }

package/dist/{types-D0j85fF0.d.ts → types-ByrdPLL2.d.ts}

@@ -1,4 +1,4 @@
-import { McpIPayload } from '@kya-os/checkpoint-shared';
+import { McpIPayload, DetectionDetail } from '@kya-os/checkpoint-shared';
 
 /**
  * TypeScript shapes for the `kya-os-engine` WASM `verify` ABI (E-1).
@@ -138,6 +138,7 @@ interface EngineInfo {
 }
 interface VerifyResult {
     decision: Decision;
+    detectionDetail: DetectionDetail;
     enforcementMode: EnforcementMode;
     engineInfo: EngineInfo;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/checkpoint-wasm-runtime",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Checkpoint WASM runtime for AI agent detection across all environments (formerly @kya-os/agentshield-wasm-runtime)",
   "keywords": [
     "ai",
@@ -117,7 +117,7 @@
   },
   "dependencies": {
     "multiformats": "^13",
-    "@kya-os/checkpoint-shared": "1.0.0"
+    "@kya-os/checkpoint-shared": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.11.24",