@kya-os/checkpoint-wasm-runtime 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,6 +1,115 @@
 # @kya-os/checkpoint-wasm-runtime
 
-## 1.3.0 — 2026-05-18
+## 1.4.0 — 2026-05-18
+
+**Minor release** consolidating SDK-Next.js-Integration-Audit-1
+([#2640](https://github.com/Know-That-Ai/agent-shield/pull/2640)) and
+Engine-Tier3-Monitor-Default
+([#2653](https://github.com/Know-That-Ai/agent-shield/pull/2653)).
+
+### Behavioral defaults — Tier-3 now Monitor by default
+
+**`EngineConfig.tier3_action` defaults to `'monitor'`.** Engine emits
+Stage 1 classification signals but does NOT short-circuit known-agent
+UAs with `Block { Tier3UAMatch }` of its own — the tenant
+`PolicyEvaluator` is the arbiter. Preserves the 1.3.0 behaviour
+(tenant policy decides). Prevents the day-1 customer-onboarding
+regression a 1.3.1-style hard-coded Block would have caused.
+
+**Opt into Block via `tier3_action: 'block'`** when the host wants
+the engine-default block before the tenant policy seam (the bench
+harness + customers who've reviewed their traffic):
+
+```ts
+import { engineVerify } from '@kya-os/checkpoint-wasm-runtime/engine';
+
+const result = engineVerify(input, {
+  ...ctxSpec,
+  config: { tier3Action: 'block' },
+});
+```
+
+**No breaking change from 1.3.0.** The new `BlockReason::Tier3UAMatch`
+variant + the `EngineConfig` / `Tier3Action` API are additive. The
+1.3.1 patch shipped the Block-default behaviour; 1.4.0 replaces that
+default with Monitor + adds the explicit opt-in. **Do not use 1.3.0
+or 1.3.1; upgrade to 1.4.0.**
+
+### Added
+
+- wasm-bindgen `--target bundler` artifact at
+  `wasm/kya-os-engine-bundler/` for Turbopack / Vite / esbuild
+  consumers. Exposed via `./engine` (default) + `./orchestrator`.
+- `./engine/node` subpath — explicit nodejs-target safety net for
+  Webpack-without-`asyncWebAssembly` consumers. Companion to the
+  existing `./orchestrator/node`.
+- `EngineConfig` + `Tier3Action` TS types exported from `./engine`.
+- `wasm:rebuild` npm script that runs the canonical
+  `rust/scripts/build-engine-wasm.sh` regen flow.
+
+### Changed
+
+- `verify-request.ts` is engine-agnostic — exports
+  `createVerifyRequestApi(defaultEngine)` factory; the two entry
+  barrels (`./orchestrator/index.ts`, `./orchestrator/node.ts`)
+  inject their own engine bridges so `orchestrator-node.mjs` no
+  longer transitively imports the bundler artifact's `.wasm`.
+- WASM artifacts (nodejs + web + bundler) rebuilt from post-#2653
+  engine source.
+
+### Removed
+
+- Dead `onSuccess` wasm-copy in `tsup.config.ts`'s
+  `nodeFallbackEntries` — the nodejs glue is now an external import.
+- `dynamic-loader.ts` `eval()` runtime-detection probes — the
+  bundler-target artifact handles runtime detection natively.
+
+---
+
+## 1.3.1 — 2026-05-18
+
+**Patch release on top of 1.3.0** — do NOT use 1.3.0; it was published
+during Engine-Tier3-Ruleset-Wiring-1 review and shipped with three
+issues caught in CI:
+
+1. **Hash format pre-coordination.** 1.3.0 shipped a 2-slot
+   `sha256:<t2-data-version>:<t3-pattern-sha256>` placeholder
+   convention. Engineer A's [#2639](https://github.com/Know-That-Ai/agent-shield/pull/2639)
+   merged on main with the canonical 4-slot
+   `sha256:t1:<slot>:t2:<slot>:t3:<slot>:t4:<slot>` format. 1.3.1 is
+   rebased on that merge — drops this PR's own `TIER3_PATTERN_SHA256`
+   const + `tier3_pattern_sha_matches_file` test and consumes
+   Engineer A's `build.rs`-emitted `AIVF1_TIER3_PATTERNS_SHA256` env
+   var via `TIER3_RULESET_HASH = env!(...)`. Today's value (1.3.1):
+   `sha256:t1:unset:t2:<yaml-sha>:t3:<patterns-sha>:t4:unset`.
+
+2. **`sfv = "0.14"` leaked into `kya-os-engine`'s `[dependencies]`**
+   (literally with a "Temporary measurement dep — DO NOT COMMIT"
+   comment), carried in from an unrelated HTTP-Sig-Verifier-1 work
+   tree via a stash apply. The crate is not referenced in source, so
+   the WASM binary is unaffected, but it adds an unused transitive
+   to the dependency graph. Removed in 1.3.1.
+3. **`BlockReason::Tier3UAMatch.confidence` was `f32`**, which round-
+   trips through JS `Number` (always f64) with rounding error —
+   Rust serialized `0.95` while WASM serialized `0.949999988079071`.
+   The cross-runtime parity gate caught this as JSON-string
+   divergence even though the underlying f32 bit pattern was
+   identical. Fixed in 1.3.1 by quantizing to `u32` percent (0–100)
+   at the engine boundary, matching the existing
+   `DetectionDetail.confidence` convention.
+
+**Wire-format change between 1.3.0 and 1.3.1:**
+
+```diff
+- { "kind": "Tier3UAMatch", "confidence": 0.95 }
++ { "kind": "Tier3UAMatch", "confidence": 95 }
+```
+
+Any consumer that pinned 1.3.0 must update — `confidence` is now a
+percent integer, not a float. The cross-runtime stability is the
+load-bearing reason; see the Tier3UAMatch docstring.
+
+## 1.3.0 — 2026-05-18 (DEPRECATED — see 1.3.1)
 
 **Engine-Tier3-Ruleset-Wiring-1.** Replaces the
 `phase-1-d-impl-placeholder` ruleset hash with a real Tier 3 UA

package/dist/adapters.d.mts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision } from './types-ByrdPLL2.mjs';
+import { d as DidDocument, D as Decision } from './types-KPEcVvac.mjs';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/adapters.d.ts

@@ -1,4 +1,4 @@
-import { d as DidDocument, D as Decision } from './types-ByrdPLL2.js';
+import { d as DidDocument, D as Decision } from './types-KPEcVvac.js';
 import '@kya-os/checkpoint-shared';
 
 /**

package/dist/engine-edge.d.mts

@@ -1,5 +1,5 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.mjs';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.mjs';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-KPEcVvac.mjs';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineConfig, f as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, T as Tier3Action, g as VerificationMethod } from './types-KPEcVvac.mjs';
 export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**

package/dist/engine-edge.d.ts

@@ -1,5 +1,5 @@
-import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-ByrdPLL2.js';
-export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, f as VerificationMethod } from './types-ByrdPLL2.js';
+import { A as AgentRequest, C as ContextSpec, V as VerifyResult } from './types-KPEcVvac.js';
+export { a as A2ARequest, b as A2PRequest, B as BlockReason, c as ChallengeParams, D as Decision, d as DidDocument, E as EnforcementMode, e as EngineConfig, f as EngineInfo, H as HttpSignedRequest, I as InstructPayload, K as KeyType, M as McpIRequest, P as PlainHttpRequest, R as RedirectTarget, S as SuggestedAction, T as Tier3Action, g as VerificationMethod } from './types-KPEcVvac.js';
 export { DetectionDetail, McpIPayload } from '@kya-os/checkpoint-shared';
 
 /**

package/dist/engine-edge.js

@@ -1,511 +1,5 @@
 'use strict';
 
-var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// wasm/kya-os-engine-web/kya_os_engine.js
-var kya_os_engine_exports = {};
-__export(kya_os_engine_exports, {
-  default: () => kya_os_engine_default,
-  initSync: () => initSync,
-  verify: () => verify
-});
-function getUint8ArrayMemory0() {
-  if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
-    cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
-  }
-  return cachedUint8ArrayMemory0;
-}
-function decodeText(ptr, len) {
-  numBytesDecoded += len;
-  if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
-    cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
-    cachedTextDecoder.decode();
-    numBytesDecoded = len;
-  }
-  return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
-}
-function getStringFromWasm0(ptr, len) {
-  ptr = ptr >>> 0;
-  return decodeText(ptr, len);
-}
-function addHeapObject(obj) {
-  if (heap_next === heap.length) heap.push(heap.length + 1);
-  const idx = heap_next;
-  heap_next = heap[idx];
-  heap[idx] = obj;
-  return idx;
-}
-function getObject(idx) {
-  return heap[idx];
-}
-function passStringToWasm0(arg, malloc, realloc) {
-  if (realloc === void 0) {
-    const buf = cachedTextEncoder.encode(arg);
-    const ptr2 = malloc(buf.length, 1) >>> 0;
-    getUint8ArrayMemory0().subarray(ptr2, ptr2 + buf.length).set(buf);
-    WASM_VECTOR_LEN = buf.length;
-    return ptr2;
-  }
-  let len = arg.length;
-  let ptr = malloc(len, 1) >>> 0;
-  const mem = getUint8ArrayMemory0();
-  let offset = 0;
-  for (; offset < len; offset++) {
-    const code = arg.charCodeAt(offset);
-    if (code > 127) break;
-    mem[ptr + offset] = code;
-  }
-  if (offset !== len) {
-    if (offset !== 0) {
-      arg = arg.slice(offset);
-    }
-    ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
-    const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
-    const ret = cachedTextEncoder.encodeInto(arg, view);
-    offset += ret.written;
-    ptr = realloc(ptr, len, offset, 1) >>> 0;
-  }
-  WASM_VECTOR_LEN = offset;
-  return ptr;
-}
-function getDataViewMemory0() {
-  if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || cachedDataViewMemory0.buffer.detached === void 0 && cachedDataViewMemory0.buffer !== wasm.memory.buffer) {
-    cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
-  }
-  return cachedDataViewMemory0;
-}
-function isLikeNone(x) {
-  return x === void 0 || x === null;
-}
-function debugString(val) {
-  const type = typeof val;
-  if (type == "number" || type == "boolean" || val == null) {
-    return `${val}`;
-  }
-  if (type == "string") {
-    return `"${val}"`;
-  }
-  if (type == "symbol") {
-    const description = val.description;
-    if (description == null) {
-      return "Symbol";
-    } else {
-      return `Symbol(${description})`;
-    }
-  }
-  if (type == "function") {
-    const name = val.name;
-    if (typeof name == "string" && name.length > 0) {
-      return `Function(${name})`;
-    } else {
-      return "Function";
-    }
-  }
-  if (Array.isArray(val)) {
-    const length = val.length;
-    let debug = "[";
-    if (length > 0) {
-      debug += debugString(val[0]);
-    }
-    for (let i = 1; i < length; i++) {
-      debug += ", " + debugString(val[i]);
-    }
-    debug += "]";
-    return debug;
-  }
-  const builtInMatches = /\[object ([^\]]+)\]/.exec(toString.call(val));
-  let className;
-  if (builtInMatches && builtInMatches.length > 1) {
-    className = builtInMatches[1];
-  } else {
-    return toString.call(val);
-  }
-  if (className == "Object") {
-    try {
-      return "Object(" + JSON.stringify(val) + ")";
-    } catch (_) {
-      return "Object";
-    }
-  }
-  if (val instanceof Error) {
-    return `${val.name}: ${val.message}
-${val.stack}`;
-  }
-  return className;
-}
-function handleError(f, args) {
-  try {
-    return f.apply(this, args);
-  } catch (e) {
-    wasm.__wbindgen_export3(addHeapObject(e));
-  }
-}
-function getArrayU8FromWasm0(ptr, len) {
-  ptr = ptr >>> 0;
-  return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
-}
-function dropObject(idx) {
-  if (idx < 132) return;
-  heap[idx] = heap_next;
-  heap_next = idx;
-}
-function takeObject(idx) {
-  const ret = getObject(idx);
-  dropObject(idx);
-  return ret;
-}
-function verify(input_js, ctx_js) {
-  try {
-    const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-    wasm.verify(retptr, addHeapObject(input_js), addHeapObject(ctx_js));
-    var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-    var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-    var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-    if (r2) {
-      throw takeObject(r1);
-    }
-    return takeObject(r0);
-  } finally {
-    wasm.__wbindgen_add_to_stack_pointer(16);
-  }
-}
-async function __wbg_load(module, imports) {
-  if (typeof Response === "function" && module instanceof Response) {
-    if (typeof WebAssembly.instantiateStreaming === "function") {
-      try {
-        return await WebAssembly.instantiateStreaming(module, imports);
-      } catch (e) {
-        const validResponse = module.ok && EXPECTED_RESPONSE_TYPES.has(module.type);
-        if (validResponse && module.headers.get("Content-Type") !== "application/wasm") {
-          console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
-        } else {
-          throw e;
-        }
-      }
-    }
-    const bytes = await module.arrayBuffer();
-    return await WebAssembly.instantiate(bytes, imports);
-  } else {
-    const instance = await WebAssembly.instantiate(module, imports);
-    if (instance instanceof WebAssembly.Instance) {
-      return { instance, module };
-    } else {
-      return instance;
-    }
-  }
-}
-function __wbg_get_imports() {
-  const imports = {};
-  imports.wbg = {};
-  imports.wbg.__wbg_Error_e83987f665cf5504 = function(arg0, arg1) {
-    const ret = Error(getStringFromWasm0(arg0, arg1));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_Number_bb48ca12f395cd08 = function(arg0) {
-    const ret = Number(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_String_8f0eb39a4a4c2f66 = function(arg0, arg1) {
-    const ret = String(getObject(arg1));
-    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_bigint_get_as_i64_f3ebc5a755000afd = function(arg0, arg1) {
-    const v = getObject(arg1);
-    const ret = typeof v === "bigint" ? v : void 0;
-    getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
-  };
-  imports.wbg.__wbg___wbindgen_boolean_get_6d5a1ee65bab5f68 = function(arg0) {
-    const v = getObject(arg0);
-    const ret = typeof v === "boolean" ? v : void 0;
-    return isLikeNone(ret) ? 16777215 : ret ? 1 : 0;
-  };
-  imports.wbg.__wbg___wbindgen_debug_string_df47ffb5e35e6763 = function(arg0, arg1) {
-    const ret = debugString(getObject(arg1));
-    const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    const len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_in_bb933bd9e1b3bc0f = function(arg0, arg1) {
-    const ret = getObject(arg0) in getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_bigint_cb320707dcd35f0b = function(arg0) {
-    const ret = typeof getObject(arg0) === "bigint";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_function_ee8a6c5833c90377 = function(arg0) {
-    const ret = typeof getObject(arg0) === "function";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_object_c818261d21f283a4 = function(arg0) {
-    const val = getObject(arg0);
-    const ret = typeof val === "object" && val !== null;
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_string_fbb76cb2940daafd = function(arg0) {
-    const ret = typeof getObject(arg0) === "string";
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_is_undefined_2d472862bd29a478 = function(arg0) {
-    const ret = getObject(arg0) === void 0;
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_jsval_eq_6b13ab83478b1c50 = function(arg0, arg1) {
-    const ret = getObject(arg0) === getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_jsval_loose_eq_b664b38a2f582147 = function(arg0, arg1) {
-    const ret = getObject(arg0) == getObject(arg1);
-    return ret;
-  };
-  imports.wbg.__wbg___wbindgen_number_get_a20bf9b85341449d = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof obj === "number" ? obj : void 0;
-    getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
-  };
-  imports.wbg.__wbg___wbindgen_string_get_e4f06c90489ad01b = function(arg0, arg1) {
-    const obj = getObject(arg1);
-    const ret = typeof obj === "string" ? obj : void 0;
-    var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-    var len1 = WASM_VECTOR_LEN;
-    getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-    getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-  };
-  imports.wbg.__wbg___wbindgen_throw_b855445ff6a94295 = function(arg0, arg1) {
-    throw new Error(getStringFromWasm0(arg0, arg1));
-  };
-  imports.wbg.__wbg_call_e762c39fa8ea36bf = function() {
-    return handleError(function(arg0, arg1) {
-      const ret = getObject(arg0).call(getObject(arg1));
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_done_2042aa2670fb1db1 = function(arg0) {
-    const ret = getObject(arg0).done;
-    return ret;
-  };
-  imports.wbg.__wbg_entries_e171b586f8f6bdbf = function(arg0) {
-    const ret = Object.entries(getObject(arg0));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_get_7bed016f185add81 = function(arg0, arg1) {
-    const ret = getObject(arg0)[arg1 >>> 0];
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_get_efcb449f58ec27c2 = function() {
-    return handleError(function(arg0, arg1) {
-      const ret = Reflect.get(getObject(arg0), getObject(arg1));
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_get_with_ref_key_1dc361bd10053bfe = function(arg0, arg1) {
-    const ret = getObject(arg0)[getObject(arg1)];
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_instanceof_ArrayBuffer_70beb1189ca63b38 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof ArrayBuffer;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_instanceof_Map_8579b5e2ab5437c7 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof Map;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_instanceof_Uint8Array_20c8e73002f7af98 = function(arg0) {
-    let result;
-    try {
-      result = getObject(arg0) instanceof Uint8Array;
-    } catch (_) {
-      result = false;
-    }
-    const ret = result;
-    return ret;
-  };
-  imports.wbg.__wbg_isArray_96e0af9891d0945d = function(arg0) {
-    const ret = Array.isArray(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_isSafeInteger_d216eda7911dde36 = function(arg0) {
-    const ret = Number.isSafeInteger(getObject(arg0));
-    return ret;
-  };
-  imports.wbg.__wbg_iterator_e5822695327a3c39 = function() {
-    const ret = Symbol.iterator;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_length_69bca3cb64fc8748 = function(arg0) {
-    const ret = getObject(arg0).length;
-    return ret;
-  };
-  imports.wbg.__wbg_length_cdd215e10d9dd507 = function(arg0) {
-    const ret = getObject(arg0).length;
-    return ret;
-  };
-  imports.wbg.__wbg_new_1acc0b6eea89d040 = function() {
-    const ret = new Object();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_5a79be3ab53b8aa5 = function(arg0) {
-    const ret = new Uint8Array(getObject(arg0));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_68651c719dcda04e = function() {
-    const ret = /* @__PURE__ */ new Map();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_new_e17d9f43105b08be = function() {
-    const ret = new Array();
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_next_020810e0ae8ebcb0 = function() {
-    return handleError(function(arg0) {
-      const ret = getObject(arg0).next();
-      return addHeapObject(ret);
-    }, arguments);
-  };
-  imports.wbg.__wbg_next_2c826fe5dfec6b6a = function(arg0) {
-    const ret = getObject(arg0).next;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_prototypesetcall_2a6620b6922694b2 = function(arg0, arg1, arg2) {
-    Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
-  };
-  imports.wbg.__wbg_set_3f1d0b984ed272ed = function(arg0, arg1, arg2) {
-    getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
-  };
-  imports.wbg.__wbg_set_907fb406c34a251d = function(arg0, arg1, arg2) {
-    const ret = getObject(arg0).set(getObject(arg1), getObject(arg2));
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbg_set_c213c871859d6500 = function(arg0, arg1, arg2) {
-    getObject(arg0)[arg1 >>> 0] = takeObject(arg2);
-  };
-  imports.wbg.__wbg_value_692627309814bb8c = function(arg0) {
-    const ret = getObject(arg0).value;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_2241b6af4c4b2941 = function(arg0, arg1) {
-    const ret = getStringFromWasm0(arg0, arg1);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_4625c577ab2ec9ee = function(arg0) {
-    const ret = BigInt.asUintN(64, arg0);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_9ae0607507abb057 = function(arg0) {
-    const ret = arg0;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_cast_d6cd19b81560fd6e = function(arg0) {
-    const ret = arg0;
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_object_clone_ref = function(arg0) {
-    const ret = getObject(arg0);
-    return addHeapObject(ret);
-  };
-  imports.wbg.__wbindgen_object_drop_ref = function(arg0) {
-    takeObject(arg0);
-  };
-  return imports;
-}
-function __wbg_finalize_init(instance, module) {
-  wasm = instance.exports;
-  __wbg_init.__wbindgen_wasm_module = module;
-  cachedDataViewMemory0 = null;
-  cachedUint8ArrayMemory0 = null;
-  return wasm;
-}
-function initSync(module) {
-  if (wasm !== void 0) return wasm;
-  if (typeof module !== "undefined") {
-    if (Object.getPrototypeOf(module) === Object.prototype) {
-      ({ module } = module);
-    } else {
-      console.warn("using deprecated parameters for `initSync()`; pass a single object instead");
-    }
-  }
-  const imports = __wbg_get_imports();
-  if (!(module instanceof WebAssembly.Module)) {
-    module = new WebAssembly.Module(module);
-  }
-  const instance = new WebAssembly.Instance(module, imports);
-  return __wbg_finalize_init(instance, module);
-}
-async function __wbg_init(module_or_path) {
-  if (wasm !== void 0) return wasm;
-  if (typeof module_or_path !== "undefined") {
-    if (Object.getPrototypeOf(module_or_path) === Object.prototype) {
-      ({ module_or_path } = module_or_path);
-    } else {
-      console.warn("using deprecated parameters for the initialization function; pass a single object instead");
-    }
-  }
-  if (typeof module_or_path === "undefined") {
-    module_or_path = new URL("kya_os_engine_bg.wasm", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('engine-edge.js', document.baseURI).href)));
-  }
-  const imports = __wbg_get_imports();
-  if (typeof module_or_path === "string" || typeof Request === "function" && module_or_path instanceof Request || typeof URL === "function" && module_or_path instanceof URL) {
-    module_or_path = fetch(module_or_path);
-  }
-  const { instance, module } = await __wbg_load(await module_or_path, imports);
-  return __wbg_finalize_init(instance, module);
-}
-var wasm, cachedUint8ArrayMemory0, cachedTextDecoder, MAX_SAFARI_DECODE_BYTES, numBytesDecoded, heap, heap_next, WASM_VECTOR_LEN, cachedTextEncoder, cachedDataViewMemory0, EXPECTED_RESPONSE_TYPES, kya_os_engine_default;
-var init_kya_os_engine = __esm({
-  "wasm/kya-os-engine-web/kya_os_engine.js"() {
-    cachedUint8ArrayMemory0 = null;
-    cachedTextDecoder = new TextDecoder("utf-8", { ignoreBOM: true, fatal: true });
-    cachedTextDecoder.decode();
-    MAX_SAFARI_DECODE_BYTES = 2146435072;
-    numBytesDecoded = 0;
-    heap = new Array(128).fill(void 0);
-    heap.push(void 0, null, true, false);
-    heap_next = heap.length;
-    WASM_VECTOR_LEN = 0;
-    cachedTextEncoder = new TextEncoder();
-    if (!("encodeInto" in cachedTextEncoder)) {
-      cachedTextEncoder.encodeInto = function(arg, view) {
-        const buf = cachedTextEncoder.encode(arg);
-        view.set(buf);
-        return {
-          read: arg.length,
-          written: buf.length
-        };
-      };
-    }
-    cachedDataViewMemory0 = null;
-    EXPECTED_RESPONSE_TYPES = /* @__PURE__ */ new Set(["basic", "cors", "default"]);
-    kya_os_engine_default = __wbg_init;
-  }
-});
-
 // src/engine/edge.ts
 var initialised = null;
 function initEngineEdge(moduleOrPath) {
@@ -514,7 +8,7 @@ function initEngineEdge(moduleOrPath) {
 function ensureReady(moduleOrPath) {
   if (initialised) return initialised;
   const pending = (async () => {
-    const mod = await Promise.resolve().then(() => (init_kya_os_engine(), kya_os_engine_exports));
+    const mod = await import('@kya-os/checkpoint-wasm-runtime/wasm/kya-os-engine-web/kya_os_engine.js');
     await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
     return mod.verify;
   })();
@@ -527,8 +21,8 @@ function ensureReady(moduleOrPath) {
   return initialised;
 }
 async function engineVerifyEdge(input, ctx) {
-  const verify2 = await ensureReady();
-  return verify2(input, ctx);
+  const verify = await ensureReady();
+  return verify(input, ctx);
 }
 
 exports.engineVerifyEdge = engineVerifyEdge;