# @kya-os/agentshield-express

> **DEPRECATED — renamed to `@kya-os/checkpoint-express`.**

See the [agent-shield repo's Phase D/E rename context](https://github.com/Know-That-Ai/agent-shield/issues/2483).

## Migration

```diff
- "@kya-os/agentshield-express": "^0.2.1"
+ "@kya-os/checkpoint-express": "^1.0.0"
```

```diff
- import { agentShield } from '@kya-os/agentshield-express';
+ import { withCheckpoint } from '@kya-os/checkpoint-express';

  const app = express();
- app.use(agentShield({ apiKey: process.env.AGENTSHIELD_API_KEY }));
+ app.use(withCheckpoint({ tenantHost: 'your.tenant.example' }));
```

The new `withCheckpoint` factory ships under the renamed package. Every
verification decision flows through the Rust `kya-os-engine` via WASM;
the legacy TS pattern-matching + JS-side policy evaluation paths
(`agentShield`, `createAgentShieldMiddleware`,
`createEnhancedAgentShieldMiddleware`, `applyPolicy`, and friends) were
retired in Phase E. The names still export from
`@kya-os/checkpoint-express` during the deprecation window — but as
runtime throw-stubs that point at `withCheckpoint`.

## Enhanced middleware migration (session tracking + Redis storage)

`createEnhancedAgentShieldMiddleware` was split into composable
primitives. The storage adapters (`MemoryStorageAdapter`,
`RedisStorageAdapter`, `createStorageAdapter`) still ship under the new
package; wire them into `withCheckpoint` via the `onResult` callback:

```ts
import { withCheckpoint, createStorageAdapter } from '@kya-os/checkpoint-express';

const storage = createStorageAdapter({ type: 'redis', ...redisConfig });

app.use(
  withCheckpoint({
    tenantHost: 'your.tenant.example',
    onResult: async (result, req) => {
      await storage.recordEvent({
        verdict: result.decision.kind,
        agentDid: result.agentDid,
        ts: Date.now(),
        // ... whatever event shape your dashboards expect.
      });
    },
  })
);
```

## Why renamed?

Brand consolidation. The platform is "Checkpoint"; "AgentShield" was an
earlier product name. The `@kya-os/` npm scope stays; only the
package-name suffix flips. Engine string in dashboards has been
`checkpoint-engine-wasm` since Phase 0.1 — this is the npm catch-up.

For full context, see [issue #2483](https://github.com/Know-That-Ai/agent-shield/issues/2483).