@kya-os/checkpoint-wasm-runtime 1.5.1 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/CHANGELOG.md +127 -0
  2. package/dist/engine-edge.d.mts +52 -16
  3. package/dist/engine-edge.d.ts +52 -16
  4. package/dist/engine-edge.js +11 -4
  5. package/dist/engine-edge.mjs +11 -4
  6. package/dist/index.d.mts +118 -1
  7. package/dist/index.d.ts +118 -1
  8. package/dist/orchestrator-edge.js +29 -13
  9. package/dist/orchestrator-edge.mjs +29 -13
  10. package/dist/orchestrator-node.js +18 -9
  11. package/dist/orchestrator-node.mjs +18 -9
  12. package/dist/orchestrator.d.mts +52 -16
  13. package/dist/orchestrator.d.ts +52 -16
  14. package/dist/orchestrator.js +29 -13
  15. package/dist/orchestrator.mjs +29 -13
  16. package/dist/policy.d.mts +148 -0
  17. package/dist/policy.d.ts +148 -0
  18. package/dist/policy.js +52 -0
  19. package/dist/policy.mjs +53 -0
  20. package/dist/reporter.d.mts +102 -0
  21. package/dist/reporter.d.ts +102 -0
  22. package/dist/reporter.js +125 -0
  23. package/dist/reporter.mjs +122 -0
  24. package/package.json +15 -5
  25. package/wasm/kya-os-engine/kya_os_engine_bg.wasm +0 -0
  26. package/wasm/kya-os-engine-bundler/kya_os_engine_bg.wasm +0 -0
  27. package/wasm/kya-os-engine-cedar/README.md +26 -0
  28. package/wasm/kya-os-engine-cedar/kya_os_engine.d.ts +77 -0
  29. package/wasm/kya-os-engine-cedar/kya_os_engine.js +636 -0
  30. package/wasm/kya-os-engine-cedar/kya_os_engine_bg.wasm +0 -0
  31. package/wasm/kya-os-engine-cedar/kya_os_engine_bg.wasm.d.ts +11 -0
  32. package/wasm/kya-os-engine-cedar/package.json +29 -0
  33. package/wasm/kya-os-engine-cedar-web/README.md +26 -0
  34. package/wasm/kya-os-engine-cedar-web/kya_os_engine.d.ts +117 -0
  35. package/wasm/kya-os-engine-cedar-web/kya_os_engine.js +694 -0
  36. package/wasm/kya-os-engine-cedar-web/kya_os_engine_bg.wasm +0 -0
  37. package/wasm/kya-os-engine-cedar-web/kya_os_engine_bg.wasm.d.ts +11 -0
  38. package/wasm/kya-os-engine-cedar-web/package.json +31 -0
  39. package/wasm/kya-os-engine-web/kya_os_engine_bg.wasm +0 -0
  40. package/wasm/agentshield_wasm.d.ts +0 -485
  41. package/wasm/agentshield_wasm.js +0 -1551
  42. package/wasm/agentshield_wasm_bg.wasm +0 -0
  43. package/wasm/agentshield_wasm_bg.wasm.d.ts +0 -97
@@ -77,20 +77,27 @@ function isBlockedIpv6(hostname) {
77
77
 
78
78
  // src/engine/edge.ts
79
79
  var initialised = null;
80
- function initEngineEdge(moduleOrPath) {
81
- return ensureReady(moduleOrPath).then(() => void 0);
80
+ var providedModule;
81
+ function initEngineEdge(wasmModule) {
82
+ if (wasmModule !== void 0 && providedModule === void 0) {
83
+ providedModule = wasmModule;
84
+ }
85
+ return ensureReady().then(() => void 0);
82
86
  }
83
- function ensureReady(moduleOrPath) {
87
+ function ensureReady() {
84
88
  if (initialised) return initialised;
85
89
  const pending = (async () => {
86
90
  const mod = await import('@kya-os/checkpoint-wasm-runtime/wasm/kya-os-engine-web/kya_os_engine.js');
87
- await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
91
+ await mod.default(
92
+ providedModule !== void 0 ? { module_or_path: providedModule } : void 0
93
+ );
88
94
  return mod.verify;
89
95
  })();
90
96
  initialised = pending;
91
97
  pending.catch(() => {
92
98
  if (initialised === pending) {
93
99
  initialised = null;
100
+ providedModule = void 0;
94
101
  }
95
102
  });
96
103
  return initialised;
@@ -191,21 +198,30 @@ function parseBodyAsObject(body) {
191
198
  function tryBuildMcpIFromLegacyHeader(req) {
192
199
  const header = getHeader(req, "kya-delegation");
193
200
  if (!header) return null;
194
- let parsed;
201
+ let parsed = void 0;
195
202
  try {
196
203
  parsed = JSON.parse(header);
197
204
  } catch {
198
- return null;
199
205
  }
200
- if (!parsed || typeof parsed !== "object") return null;
201
- const obj = parsed;
202
- const protectedSeg = obj.protected;
203
- const payloadSeg = obj.payload;
204
- const signatureSeg = obj.signature;
205
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
206
+ if (parsed && typeof parsed === "object") {
207
+ const obj = parsed;
208
+ const protectedSeg = obj.protected;
209
+ const payloadSeg = obj.payload;
210
+ const signatureSeg = obj.signature;
211
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
212
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
213
+ return buildMcpIRequestFromCompact(compact);
214
+ }
206
215
  return null;
207
216
  }
208
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
217
+ const trimmed = header.trim();
218
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
219
+ return buildMcpIRequestFromCompact(trimmed);
220
+ }
221
+ return null;
222
+ }
223
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
224
+ function buildMcpIRequestFromCompact(compact) {
209
225
  const raw = Array.from(Buffer.from(compact, "utf8"));
210
226
  const payload = parseJwsPayloadStruct(raw);
211
227
  if (!payload) return null;
@@ -75,20 +75,27 @@ function isBlockedIpv6(hostname) {
75
75
 
76
76
  // src/engine/edge.ts
77
77
  var initialised = null;
78
- function initEngineEdge(moduleOrPath) {
79
- return ensureReady(moduleOrPath).then(() => void 0);
78
+ var providedModule;
79
+ function initEngineEdge(wasmModule) {
80
+ if (wasmModule !== void 0 && providedModule === void 0) {
81
+ providedModule = wasmModule;
82
+ }
83
+ return ensureReady().then(() => void 0);
80
84
  }
81
- function ensureReady(moduleOrPath) {
85
+ function ensureReady() {
82
86
  if (initialised) return initialised;
83
87
  const pending = (async () => {
84
88
  const mod = await import('@kya-os/checkpoint-wasm-runtime/wasm/kya-os-engine-web/kya_os_engine.js');
85
- await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
89
+ await mod.default(
90
+ providedModule !== void 0 ? { module_or_path: providedModule } : void 0
91
+ );
86
92
  return mod.verify;
87
93
  })();
88
94
  initialised = pending;
89
95
  pending.catch(() => {
90
96
  if (initialised === pending) {
91
97
  initialised = null;
98
+ providedModule = void 0;
92
99
  }
93
100
  });
94
101
  return initialised;
@@ -189,21 +196,30 @@ function parseBodyAsObject(body) {
189
196
  function tryBuildMcpIFromLegacyHeader(req) {
190
197
  const header = getHeader(req, "kya-delegation");
191
198
  if (!header) return null;
192
- let parsed;
199
+ let parsed = void 0;
193
200
  try {
194
201
  parsed = JSON.parse(header);
195
202
  } catch {
196
- return null;
197
203
  }
198
- if (!parsed || typeof parsed !== "object") return null;
199
- const obj = parsed;
200
- const protectedSeg = obj.protected;
201
- const payloadSeg = obj.payload;
202
- const signatureSeg = obj.signature;
203
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
204
+ if (parsed && typeof parsed === "object") {
205
+ const obj = parsed;
206
+ const protectedSeg = obj.protected;
207
+ const payloadSeg = obj.payload;
208
+ const signatureSeg = obj.signature;
209
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
210
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
211
+ return buildMcpIRequestFromCompact(compact);
212
+ }
204
213
  return null;
205
214
  }
206
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
215
+ const trimmed = header.trim();
216
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
217
+ return buildMcpIRequestFromCompact(trimmed);
218
+ }
219
+ return null;
220
+ }
221
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
222
+ function buildMcpIRequestFromCompact(compact) {
207
223
  const raw = Array.from(Buffer.from(compact, "utf8"));
208
224
  const payload = parseJwsPayloadStruct(raw);
209
225
  if (!payload) return null;
@@ -194,21 +194,30 @@ function parseBodyAsObject(body) {
194
194
  function tryBuildMcpIFromLegacyHeader(req) {
195
195
  const header = getHeader(req, "kya-delegation");
196
196
  if (!header) return null;
197
- let parsed;
197
+ let parsed = void 0;
198
198
  try {
199
199
  parsed = JSON.parse(header);
200
200
  } catch {
201
- return null;
202
201
  }
203
- if (!parsed || typeof parsed !== "object") return null;
204
- const obj = parsed;
205
- const protectedSeg = obj.protected;
206
- const payloadSeg = obj.payload;
207
- const signatureSeg = obj.signature;
208
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
202
+ if (parsed && typeof parsed === "object") {
203
+ const obj = parsed;
204
+ const protectedSeg = obj.protected;
205
+ const payloadSeg = obj.payload;
206
+ const signatureSeg = obj.signature;
207
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
208
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
209
+ return buildMcpIRequestFromCompact(compact);
210
+ }
209
211
  return null;
210
212
  }
211
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
213
+ const trimmed = header.trim();
214
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
215
+ return buildMcpIRequestFromCompact(trimmed);
216
+ }
217
+ return null;
218
+ }
219
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
220
+ function buildMcpIRequestFromCompact(compact) {
212
221
  const raw = Array.from(Buffer.from(compact, "utf8"));
213
222
  const payload = parseJwsPayloadStruct(raw);
214
223
  if (!payload) return null;
@@ -173,21 +173,30 @@ function parseBodyAsObject(body) {
173
173
  function tryBuildMcpIFromLegacyHeader(req) {
174
174
  const header = getHeader(req, "kya-delegation");
175
175
  if (!header) return null;
176
- let parsed;
176
+ let parsed = void 0;
177
177
  try {
178
178
  parsed = JSON.parse(header);
179
179
  } catch {
180
- return null;
181
180
  }
182
- if (!parsed || typeof parsed !== "object") return null;
183
- const obj = parsed;
184
- const protectedSeg = obj.protected;
185
- const payloadSeg = obj.payload;
186
- const signatureSeg = obj.signature;
187
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
181
+ if (parsed && typeof parsed === "object") {
182
+ const obj = parsed;
183
+ const protectedSeg = obj.protected;
184
+ const payloadSeg = obj.payload;
185
+ const signatureSeg = obj.signature;
186
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
187
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
188
+ return buildMcpIRequestFromCompact(compact);
189
+ }
188
190
  return null;
189
191
  }
190
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
192
+ const trimmed = header.trim();
193
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
194
+ return buildMcpIRequestFromCompact(trimmed);
195
+ }
196
+ return null;
197
+ }
198
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
199
+ function buildMcpIRequestFromCompact(compact) {
191
200
  const raw = Array.from(Buffer.from(compact, "utf8"));
192
201
  const payload = parseJwsPayloadStruct(raw);
193
202
  if (!payload) return null;
@@ -222,11 +222,44 @@ interface RenderedResponse {
222
222
  * no sync wasm load).
223
223
  *
224
224
  * This module loads the `wasm-pack --target web` artifact via the
225
- * async `__wbg_init` default export, then exposes the same typed
226
- * `engineVerifyEdge(input, ctx) Promise<VerifyResult>` shape with
227
- * a small lazy-init wrapper. First call awaits initialisation;
228
- * subsequent calls resolve synchronously on the JS side (the
229
- * underlying wasm `verify` is sync).
225
+ * async `__wbg_init` default export. The web target's `init()`
226
+ * accepts a pre-instantiated `WebAssembly.Module` argument — the
227
+ * canonical Cloudflare-Workers + wasm-bindgen pattern.
228
+ *
229
+ * # Why the caller MUST pass `wasmModule` on Cloudflare Workers
230
+ *
231
+ * Both `--target web` (URL fetch) and `--target bundler` (auto-
232
+ * instantiated `__wbg_set_wasm(wasm)`) have failure modes on wrangler:
233
+ *
234
+ * - `--target web` falls back to `new URL('<wasm>', import.meta.url)`
235
+ * when `init()` is called with no arg. Cloudflare Workers don't
236
+ * materialise `import.meta.url` the way browsers do → throws
237
+ * `TypeError: Invalid URL string`. (Broke production 2026-05-23,
238
+ * captured via dev tail in run 26352287112.)
239
+ *
240
+ * - `--target bundler` expects the host bundler to AUTO-INSTANTIATE
241
+ * `import * as wasm from './foo.wasm'` so `wasm` is the
242
+ * `Instance.exports` object. Webpack does this. **Wrangler does
243
+ * NOT** — wrangler gives you a raw `WebAssembly.Module`, and the
244
+ * bundler-target shim's `__wbg_set_wasm(rawModule)` happily
245
+ * accepts it, then every export lookup (`wasm.__wbindgen_add_
246
+ * to_stack_pointer`, etc.) returns undefined → throws
247
+ * `TypeError: wasm.__wbindgen_add_to_stack_pointer is not a function`.
248
+ * (Broke production 2026-05-24 after switching to bundler target
249
+ * in PR #2785; captured via prod tail.)
250
+ *
251
+ * The fix is the standard Cloudflare-Workers + wasm-bindgen pattern:
252
+ * the consumer statically imports the `.wasm` file (wrangler then
253
+ * bundles it + hands the worker a `WebAssembly.Module`), then passes
254
+ * it to `init(wasmModule)`. The web target's init detects the Module
255
+ * input + calls `WebAssembly.instantiate(Module, imports)` internally
256
+ * to produce a real `Instance` whose exports populate the JS shim's
257
+ * `wasm` binding correctly.
258
+ *
259
+ * Vercel Edge / webpack consumers MAY omit the argument — webpack's
260
+ * async-WASM support handles the URL fetch correctly. But the typed
261
+ * signature here marks `wasmModule` optional for backward compat;
262
+ * Cloudflare-Workers consumers MUST pass it.
230
263
  *
231
264
  * **Why this matters for the consolidation narrative.** Phase A
232
265
  * shipped Node-only. Without an edge build, the first Vercel-edge
@@ -240,18 +273,21 @@ interface RenderedResponse {
240
273
 
241
274
  /**
242
275
  * Initialise the edge wasm module. Idempotent — subsequent calls
243
- * return the same in-flight or resolved promise. Host wrappers can
244
- * call this at startup to eagerly load the wasm and avoid first-
245
- * request latency, but it's not required: `engineVerifyEdge`
246
- * lazily initialises on first call.
247
- *
248
- * @param moduleOrPath Optional pre-fetched `WebAssembly.Module` or
249
- * a URL / Request the wasm-bindgen loader will
250
- * fetch. Defaults to the bundled artifact via
251
- * `import.meta.url`. Cloudflare Workers / Vercel
252
- * Edge typically pass a pre-bundled `Module`.
276
+ * return the same in-flight or resolved promise. Host wrappers
277
+ * should call this once at startup with the `wasmModule` they
278
+ * statically imported from the package's `./wasm/kya-os-engine-web/`
279
+ * subpath (see CLAUDE.md for the wrangler/webpack import pattern).
280
+ *
281
+ * @param wasmModule REQUIRED on Cloudflare Workers (wrangler hands
282
+ * the consumer a `WebAssembly.Module` from the
283
+ * static `.wasm` import; pass it here so the
284
+ * web-target's `init()` instantiates it). OPTIONAL
285
+ * on Vercel Edge / webpack webpack's async-WASM
286
+ * support resolves the URL fetch correctly, but
287
+ * passing the module explicitly is recommended
288
+ * for cross-runtime consistency.
253
289
  */
254
- declare function initEngineEdge(moduleOrPath?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
290
+ declare function initEngineEdge(wasmModule?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
255
291
 
256
292
  /**
257
293
  * HTTP-to-`AgentRequest` translator — Phase C.1.
@@ -222,11 +222,44 @@ interface RenderedResponse {
222
222
  * no sync wasm load).
223
223
  *
224
224
  * This module loads the `wasm-pack --target web` artifact via the
225
- * async `__wbg_init` default export, then exposes the same typed
226
- * `engineVerifyEdge(input, ctx) Promise<VerifyResult>` shape with
227
- * a small lazy-init wrapper. First call awaits initialisation;
228
- * subsequent calls resolve synchronously on the JS side (the
229
- * underlying wasm `verify` is sync).
225
+ * async `__wbg_init` default export. The web target's `init()`
226
+ * accepts a pre-instantiated `WebAssembly.Module` argument — the
227
+ * canonical Cloudflare-Workers + wasm-bindgen pattern.
228
+ *
229
+ * # Why the caller MUST pass `wasmModule` on Cloudflare Workers
230
+ *
231
+ * Both `--target web` (URL fetch) and `--target bundler` (auto-
232
+ * instantiated `__wbg_set_wasm(wasm)`) have failure modes on wrangler:
233
+ *
234
+ * - `--target web` falls back to `new URL('<wasm>', import.meta.url)`
235
+ * when `init()` is called with no arg. Cloudflare Workers don't
236
+ * materialise `import.meta.url` the way browsers do → throws
237
+ * `TypeError: Invalid URL string`. (Broke production 2026-05-23,
238
+ * captured via dev tail in run 26352287112.)
239
+ *
240
+ * - `--target bundler` expects the host bundler to AUTO-INSTANTIATE
241
+ * `import * as wasm from './foo.wasm'` so `wasm` is the
242
+ * `Instance.exports` object. Webpack does this. **Wrangler does
243
+ * NOT** — wrangler gives you a raw `WebAssembly.Module`, and the
244
+ * bundler-target shim's `__wbg_set_wasm(rawModule)` happily
245
+ * accepts it, then every export lookup (`wasm.__wbindgen_add_
246
+ * to_stack_pointer`, etc.) returns undefined → throws
247
+ * `TypeError: wasm.__wbindgen_add_to_stack_pointer is not a function`.
248
+ * (Broke production 2026-05-24 after switching to bundler target
249
+ * in PR #2785; captured via prod tail.)
250
+ *
251
+ * The fix is the standard Cloudflare-Workers + wasm-bindgen pattern:
252
+ * the consumer statically imports the `.wasm` file (wrangler then
253
+ * bundles it + hands the worker a `WebAssembly.Module`), then passes
254
+ * it to `init(wasmModule)`. The web target's init detects the Module
255
+ * input + calls `WebAssembly.instantiate(Module, imports)` internally
256
+ * to produce a real `Instance` whose exports populate the JS shim's
257
+ * `wasm` binding correctly.
258
+ *
259
+ * Vercel Edge / webpack consumers MAY omit the argument — webpack's
260
+ * async-WASM support handles the URL fetch correctly. But the typed
261
+ * signature here marks `wasmModule` optional for backward compat;
262
+ * Cloudflare-Workers consumers MUST pass it.
230
263
  *
231
264
  * **Why this matters for the consolidation narrative.** Phase A
232
265
  * shipped Node-only. Without an edge build, the first Vercel-edge
@@ -240,18 +273,21 @@ interface RenderedResponse {
240
273
 
241
274
  /**
242
275
  * Initialise the edge wasm module. Idempotent — subsequent calls
243
- * return the same in-flight or resolved promise. Host wrappers can
244
- * call this at startup to eagerly load the wasm and avoid first-
245
- * request latency, but it's not required: `engineVerifyEdge`
246
- * lazily initialises on first call.
247
- *
248
- * @param moduleOrPath Optional pre-fetched `WebAssembly.Module` or
249
- * a URL / Request the wasm-bindgen loader will
250
- * fetch. Defaults to the bundled artifact via
251
- * `import.meta.url`. Cloudflare Workers / Vercel
252
- * Edge typically pass a pre-bundled `Module`.
276
+ * return the same in-flight or resolved promise. Host wrappers
277
+ * should call this once at startup with the `wasmModule` they
278
+ * statically imported from the package's `./wasm/kya-os-engine-web/`
279
+ * subpath (see CLAUDE.md for the wrangler/webpack import pattern).
280
+ *
281
+ * @param wasmModule REQUIRED on Cloudflare Workers (wrangler hands
282
+ * the consumer a `WebAssembly.Module` from the
283
+ * static `.wasm` import; pass it here so the
284
+ * web-target's `init()` instantiates it). OPTIONAL
285
+ * on Vercel Edge / webpack webpack's async-WASM
286
+ * support resolves the URL fetch correctly, but
287
+ * passing the module explicitly is recommended
288
+ * for cross-runtime consistency.
253
289
  */
254
- declare function initEngineEdge(moduleOrPath?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
290
+ declare function initEngineEdge(wasmModule?: WebAssembly.Module | URL | string | Request | BufferSource): Promise<void>;
255
291
 
256
292
  /**
257
293
  * HTTP-to-`AgentRequest` translator — Phase C.1.
@@ -173,21 +173,30 @@ function parseBodyAsObject(body) {
173
173
  function tryBuildMcpIFromLegacyHeader(req) {
174
174
  const header = getHeader(req, "kya-delegation");
175
175
  if (!header) return null;
176
- let parsed;
176
+ let parsed = void 0;
177
177
  try {
178
178
  parsed = JSON.parse(header);
179
179
  } catch {
180
- return null;
181
180
  }
182
- if (!parsed || typeof parsed !== "object") return null;
183
- const obj = parsed;
184
- const protectedSeg = obj.protected;
185
- const payloadSeg = obj.payload;
186
- const signatureSeg = obj.signature;
187
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
181
+ if (parsed && typeof parsed === "object") {
182
+ const obj = parsed;
183
+ const protectedSeg = obj.protected;
184
+ const payloadSeg = obj.payload;
185
+ const signatureSeg = obj.signature;
186
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
187
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
188
+ return buildMcpIRequestFromCompact(compact);
189
+ }
188
190
  return null;
189
191
  }
190
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
192
+ const trimmed = header.trim();
193
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
194
+ return buildMcpIRequestFromCompact(trimmed);
195
+ }
196
+ return null;
197
+ }
198
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
199
+ function buildMcpIRequestFromCompact(compact) {
191
200
  const raw = Array.from(Buffer.from(compact, "utf8"));
192
201
  const payload = parseJwsPayloadStruct(raw);
193
202
  if (!payload) return null;
@@ -404,20 +413,27 @@ function defaultLogger(msg) {
404
413
 
405
414
  // src/engine/edge.ts
406
415
  var initialised = null;
407
- function initEngineEdge(moduleOrPath) {
408
- return ensureReady(moduleOrPath).then(() => void 0);
416
+ var providedModule;
417
+ function initEngineEdge(wasmModule) {
418
+ if (wasmModule !== void 0 && providedModule === void 0) {
419
+ providedModule = wasmModule;
420
+ }
421
+ return ensureReady().then(() => void 0);
409
422
  }
410
- function ensureReady(moduleOrPath) {
423
+ function ensureReady() {
411
424
  if (initialised) return initialised;
412
425
  const pending = (async () => {
413
426
  const mod = await import('@kya-os/checkpoint-wasm-runtime/wasm/kya-os-engine-web/kya_os_engine.js');
414
- await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
427
+ await mod.default(
428
+ providedModule !== void 0 ? { module_or_path: providedModule } : void 0
429
+ );
415
430
  return mod.verify;
416
431
  })();
417
432
  initialised = pending;
418
433
  pending.catch(() => {
419
434
  if (initialised === pending) {
420
435
  initialised = null;
436
+ providedModule = void 0;
421
437
  }
422
438
  });
423
439
  return initialised;
@@ -171,21 +171,30 @@ function parseBodyAsObject(body) {
171
171
  function tryBuildMcpIFromLegacyHeader(req) {
172
172
  const header = getHeader(req, "kya-delegation");
173
173
  if (!header) return null;
174
- let parsed;
174
+ let parsed = void 0;
175
175
  try {
176
176
  parsed = JSON.parse(header);
177
177
  } catch {
178
- return null;
179
178
  }
180
- if (!parsed || typeof parsed !== "object") return null;
181
- const obj = parsed;
182
- const protectedSeg = obj.protected;
183
- const payloadSeg = obj.payload;
184
- const signatureSeg = obj.signature;
185
- if (typeof protectedSeg !== "string" || typeof payloadSeg !== "string" || typeof signatureSeg !== "string") {
179
+ if (parsed && typeof parsed === "object") {
180
+ const obj = parsed;
181
+ const protectedSeg = obj.protected;
182
+ const payloadSeg = obj.payload;
183
+ const signatureSeg = obj.signature;
184
+ if (typeof protectedSeg === "string" && typeof payloadSeg === "string" && typeof signatureSeg === "string") {
185
+ const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
186
+ return buildMcpIRequestFromCompact(compact);
187
+ }
186
188
  return null;
187
189
  }
188
- const compact = `${protectedSeg}.${payloadSeg}.${signatureSeg}`;
190
+ const trimmed = header.trim();
191
+ if (COMPACT_JWS_PATTERN.test(trimmed)) {
192
+ return buildMcpIRequestFromCompact(trimmed);
193
+ }
194
+ return null;
195
+ }
196
+ var COMPACT_JWS_PATTERN = /^[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*\.[A-Za-z0-9_-]+=*$/;
197
+ function buildMcpIRequestFromCompact(compact) {
189
198
  const raw = Array.from(Buffer.from(compact, "utf8"));
190
199
  const payload = parseJwsPayloadStruct(raw);
191
200
  if (!payload) return null;
@@ -402,20 +411,27 @@ function defaultLogger(msg) {
402
411
 
403
412
  // src/engine/edge.ts
404
413
  var initialised = null;
405
- function initEngineEdge(moduleOrPath) {
406
- return ensureReady(moduleOrPath).then(() => void 0);
414
+ var providedModule;
415
+ function initEngineEdge(wasmModule) {
416
+ if (wasmModule !== void 0 && providedModule === void 0) {
417
+ providedModule = wasmModule;
418
+ }
419
+ return ensureReady().then(() => void 0);
407
420
  }
408
- function ensureReady(moduleOrPath) {
421
+ function ensureReady() {
409
422
  if (initialised) return initialised;
410
423
  const pending = (async () => {
411
424
  const mod = await import('@kya-os/checkpoint-wasm-runtime/wasm/kya-os-engine-web/kya_os_engine.js');
412
- await mod.default(moduleOrPath !== void 0 ? { module_or_path: moduleOrPath } : void 0);
425
+ await mod.default(
426
+ providedModule !== void 0 ? { module_or_path: providedModule } : void 0
427
+ );
413
428
  return mod.verify;
414
429
  })();
415
430
  initialised = pending;
416
431
  pending.catch(() => {
417
432
  if (initialised === pending) {
418
433
  initialised = null;
434
+ providedModule = void 0;
419
435
  }
420
436
  });
421
437
  return initialised;