@astrasyncai/verification-gateway 5.10.0 → 5.12.0

package/dist/bin/astrasync.js

@@ -36,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "5.10.0";
+    SDK_VERSION = "5.12.0";
   }
 });
 
@@ -4095,7 +4095,6 @@ var init_upgrade = __esm({
   "src/cli/upgrade.ts"() {
     "use strict";
     init_http();
-    init_pdlss_parser();
     UpgradeFlow = class {
       constructor(config, callbacks, trigger) {
         this.config = config;
@@ -4155,27 +4154,23 @@ var init_upgrade = __esm({
        */
       async continueUpgrade(apiKey, kydId) {
         const { print, prompt } = this.callbacks;
-        print("\n[3/5] Migrate local policy to cloud");
-        print(`  Policy: ${this.config.policyPath}`);
-        print(`  Name:   ${this.config.policy.name}`);
-        print(`  Rules:  ${this.config.policy.purposes.length} purpose rules`);
-        if (this.config.policy.scope) {
-          const scope = this.config.policy.scope;
-          const domains = [
-            ...(scope.allowedDomains || []).length ? [`${scope.allowedDomains.length} allowed`] : [],
-            ...(scope.blockedDomains || []).length ? [`${scope.blockedDomains.length} blocked`] : []
-          ];
-          if (domains.length) print(`  Scope:  ${domains.join(", ")} domains`);
-        }
-        print("");
-        print("  Uploading YAML -> Cloud PDLSS boundary...");
-        const uploadResult = await this.uploadPolicy(apiKey);
-        if (!uploadResult.success) {
-          print(`  Upload failed: ${uploadResult.error}`);
-          return uploadResult;
-        }
-        print("  Policy uploaded. Same rules, now with trust scoring and audit.");
-        print(`  Agent registered: ${uploadResult.agentId}`);
+        print("\n[3/5] Link your agent");
+        print(
+          `  Local policy ${this.config.policyPath} stays on this machine (${this.config.policy.purposes.length} purpose rules).`
+        );
+        print("  Register the agent in the AstraSync dashboard (or with `astrasync register`) and");
+        print("  paste its ASTRA- id so synced decisions are attributed to it.\n");
+        const agentInput = (await prompt("  Agent ASTRA- id (Enter to skip): ")).trim();
+        let agentId;
+        if (agentInput) {
+          if (!/^ASTRA-[A-Za-z0-9_-]+$/.test(agentInput)) {
+            return { success: false, error: `Not an ASTRA- agent id: ${agentInput}` };
+          }
+          agentId = agentInput;
+          print(`  Agent: ${agentId}`);
+        } else {
+          print("  No agent linked \u2014 decisions sync under your API key only.");
+        }
         if (kydId) {
           print(`  Developer: ${kydId}`);
         }
@@ -4186,23 +4181,23 @@ var init_upgrade = __esm({
         const mode = modeInput.trim().toLowerCase() === "online" ? "online" : "hybrid";
         print(`
 [5/5] Activating ${mode} verification`);
-        await this.writeLocalConfig(apiKey, uploadResult.agentId, mode, kydId);
+        await this.writeLocalConfig(apiKey, agentId, mode, kydId);
         print(`  Config written to ${this.configDir}/config`);
         print(`  Mode: ${mode}`);
         print("  Done!\n");
-        print(`  Your agent (${uploadResult.agentId}) is verified on the AstraSync network.`);
+        if (agentId) print(`  Your agent (${agentId}) is verified on the AstraSync network.`);
         if (mode === "hybrid") {
           print("  Local evaluation active for speed. Cloud sync for audit and trust scoring.");
         } else {
           print("  Trust scoring, audit trails, and blockchain recording are active.");
         }
         print(`
-  Dashboard: ${this.platformUrl}/agents/${uploadResult.agentId}
+  Dashboard: ${this.platformUrl}/agents${agentId ? `/${agentId}` : ""}
 `);
         return {
           success: true,
           apiKey,
-          agentId: uploadResult.agentId,
+          agentId,
           kydId,
           mode
         };
@@ -4255,44 +4250,6 @@ var init_upgrade = __esm({
           return { valid: true, error: `Could not reach platform (proceeding anyway)` };
         }
       }
-      /**
-       * Upload local policy to the AstraSync cloud.
-       * YAML -> cloud PDLSS boundary, 1:1 mapping, no lossy transformation.
-       */
-      async uploadPolicy(apiKey) {
-        const policyYaml = toYaml(this.config.policy);
-        try {
-          const response = await sdkFetch(`${this.platformUrl}/api/v1/agents/policies/upload`, {
-            method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              Authorization: `Bearer ${apiKey}`
-            },
-            body: JSON.stringify({
-              policy: policyYaml,
-              policyObject: this.config.policy,
-              format: "yaml",
-              source: "local-guard-upgrade",
-              name: this.config.policy.name
-            })
-          });
-          if (!response.ok) {
-            const body = await response.text();
-            return { success: false, error: `Upload failed (${response.status}): ${body}` };
-          }
-          const data = await response.json();
-          return {
-            success: true,
-            agentId: data.agentId || "ASTRA-PENDING",
-            kydId: data.kydId
-          };
-        } catch (err) {
-          return {
-            success: false,
-            error: `Network error: ${err instanceof Error ? err.message : String(err)}`
-          };
-        }
-      }
       /**
        * Write the config file for the chosen mode.
        */
@@ -5100,6 +5057,20 @@ var init_well_known = __esm({
   }
 });
 
+// src/failure-posture.ts
+var REJECTED_IDENTITY_DIMENSIONS, UNKNOWN_AGENT_GUIDANCE;
+var init_failure_posture = __esm({
+  "src/failure-posture.ts"() {
+    "use strict";
+    REJECTED_IDENTITY_DIMENSIONS = /* @__PURE__ */ new Set([
+      "identity.invalid_agent_id",
+      "identity.unknown_agent",
+      "agent.lookup"
+    ]);
+    UNKNOWN_AGENT_GUIDANCE = "Register your agent with AstraSync (or, inside an MCP host, add the AstraSync MCP connector for keyless, human-approved registration), then present the canonical ASTRA-* id issued after owner approval.";
+  }
+});
+
 // src/verify.ts
 async function performInitCheck(apiBaseUrl, debug, strictInit, apiKey) {
   initCheckPerformed = true;
@@ -5298,11 +5269,43 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // coercing the absent recommendation to a policy 'deny'. Misconfig is
     // deterministic and intentionally NOT marked retryable.
     ...isApiError && { retryable: true },
+    ...options.httpStatus !== void 0 && { httpStatus: options.httpStatus },
+    ...options.retryAfterMs !== void 0 && { retryAfterMs: options.retryAfterMs },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
+async function readJsonSafe(response) {
+  try {
+    const parsed = await response.json();
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rejectedIdentityGuidance(failures) {
+  const f = failures?.find((x) => REJECTED_IDENTITY_DIMENSIONS.has(x.dimension));
+  if (!f) return void 0;
+  if (f.dimension === "agent.lookup") {
+    return `The presented agent identifier is not registered with AstraSync. ${UNKNOWN_AGENT_GUIDANCE}`;
+  }
+  return f.guidance ? `${f.message} ${f.guidance}` : f.message;
+}
+function parseRetryAfterMs(response) {
+  const raw = response.headers?.get?.("retry-after");
+  if (!raw) return void 0;
+  const trimmed = raw.trim();
+  let ms;
+  if (/^\d+(\.\d+)?$/.test(trimmed)) {
+    ms = Number(trimmed) * 1e3;
+  } else {
+    const at = Date.parse(trimmed);
+    if (Number.isNaN(at)) return void 0;
+    ms = at - Date.now();
+  }
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, Math.round(ms)));
+}
 async function callVerifyAccessAPI(config, request2) {
   const { credentials, ...requestData } = request2;
   const body = {
@@ -5359,7 +5362,8 @@ async function callVerifyAccessAPI(config, request2) {
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
-    const data = await response.json();
+    const data = await readJsonSafe(response);
+    const retryAfterMs = parseRetryAfterMs(response);
     if (response.status === 410) {
       return {
         success: true,
@@ -5397,6 +5401,23 @@ async function callVerifyAccessAPI(config, request2) {
         }
       };
     }
+    if (response.status === 404 && credentials.astraId && (data?.error === "AGENT_NOT_FOUND" || typeof data?.message === "string" && /agent/i.test(data.message))) {
+      return {
+        success: true,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        access: {
+          allowed: false,
+          reason: "unknown_agent",
+          failures: [
+            {
+              dimension: "identity.unknown_agent",
+              message: "The presented agent identifier is not registered with AstraSync.",
+              guidance: UNKNOWN_AGENT_GUIDANCE
+            }
+          ]
+        }
+      };
+    }
     if (!response.ok) {
       if (response.status === 401) {
         return {
@@ -5411,9 +5432,11 @@ async function callVerifyAccessAPI(config, request2) {
       }
       return {
         success: false,
-        error: data.message || data.error || `API returned ${response.status}`,
+        error: typeof data?.message === "string" && data.message || typeof data?.error === "string" && data.error || `API returned ${response.status}`,
         correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
-        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        httpStatus: response.status,
+        ...retryAfterMs !== void 0 && { retryAfterMs }
       };
     }
     return data;
@@ -5485,12 +5508,14 @@ async function verify(config, request2, options) {
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
       remediation: apiResponse.remediation,
+      httpStatus: apiResponse.httpStatus,
+      retryAfterMs: apiResponse.retryAfterMs,
       urls
     });
   }
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
-    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true;
+    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
@@ -5502,7 +5527,10 @@ async function verify(config, request2, options) {
       requiresStepUp: apiResponse.access?.requiresStepUp,
       requiresApproval: apiResponse.access?.requiresApproval,
       guidance: {
-        message: apiResponse.access?.reason || "Access denied by PDLSS policy",
+        // 5.12.0: a presented-but-rejected id (malformed / unknown) carries
+        // actionable registration guidance on its failure — surface it
+        // instead of the bare machine reason ('unknown_agent').
+        message: rejectedIdentityGuidance(aggregatedFailures) ?? (apiResponse.access?.reason || "Access denied by PDLSS policy"),
         registrationUrl: urls?.registrationUrl ?? "",
         documentationUrl: urls?.documentationUrl ?? "",
         // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
@@ -5602,7 +5630,7 @@ async function verify(config, request2, options) {
       registrationUrl: urls?.registrationUrl ?? "",
       documentationUrl: urls?.documentationUrl ?? ""
     };
-  } else if (result.recommendation === "step_up_required") {
+  } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
   }
@@ -5612,7 +5640,7 @@ async function verify(config, request2, options) {
   }
   return result;
 }
-var DEFAULT_CONFIG, initCheckPerformed, deprecationWarningShown, verificationCache, DEFAULT_CACHE_TTL_SECONDS;
+var DEFAULT_CONFIG, initCheckPerformed, deprecationWarningShown, verificationCache, DEFAULT_CACHE_TTL_SECONDS, MAX_RETRY_AFTER_MS;
 var init_verify = __esm({
   "src/verify.ts"() {
     "use strict";
@@ -5620,6 +5648,7 @@ var init_verify = __esm({
     init_trust_levels();
     init_version();
     init_well_known();
+    init_failure_posture();
     DEFAULT_CONFIG = {
       apiBaseUrl: "https://astrasync.ai/api",
       // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
@@ -5633,6 +5662,7 @@ var init_verify = __esm({
     deprecationWarningShown = false;
     verificationCache = /* @__PURE__ */ new Map();
     DEFAULT_CACHE_TTL_SECONDS = 60;
+    MAX_RETRY_AFTER_MS = 15 * 60 * 1e3;
   }
 });
 
@@ -5755,12 +5785,223 @@ var init_classify = __esm({
 });
 
 // src/edge-core/events.ts
+async function withBudget(promise, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(void 0), ms);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+var destKeyOf, BeaconBuffer, beaconBuffer;
 var init_events = __esm({
   "src/edge-core/events.ts"() {
     "use strict";
+    init_http();
     init_metadata_capture();
-    init_verify();
+    init_version();
     init_request();
+    destKeyOf = (d) => `${d.apiBaseUrl}\0${d.apiKey ?? ""}\0${d.counterparty}\0${d.adapter ?? ""}`;
+    BeaconBuffer = class {
+      constructor(options = {}) {
+        this.queue = [];
+        this.droppedSinceLast = 0;
+        this.droppedTotal = 0;
+        this.deliveredTotal = 0;
+        this.backoffUntil = 0;
+        this.collapse = /* @__PURE__ */ new Map();
+        /** Keys the backend answered 401 for — later batches go unauthenticated. */
+        this.rejectedKeys = /* @__PURE__ */ new Set();
+        this.opts = {
+          maxItems: options.maxItems ?? 1e3,
+          maxBatch: options.maxBatch ?? 100,
+          maxAttempts: options.maxAttempts ?? 3,
+          collapseWindowMs: options.collapseWindowMs ?? 6e4,
+          collapseMaxKeys: options.collapseMaxKeys ?? 1e3,
+          requestTimeoutMs: options.requestTimeoutMs ?? 1e4,
+          retryBackoffMs: options.retryBackoffMs ?? 1e3,
+          now: options.now ?? Date.now
+        };
+      }
+      /**
+       * Queue one beacon. With a `collapseKey`, a repeat inside the window is
+       * merged into a held aggregate (sent when the window closes) instead of
+       * becoming its own item.
+       */
+      enqueue(dest, item, collapseKey) {
+        const now = this.opts.now();
+        if (collapseKey) {
+          const entry = this.collapse.get(collapseKey);
+          if (entry && now - entry.firstSeenAt < this.opts.collapseWindowMs) {
+            for (const target of [entry.first, entry.held]) {
+              if (target && !target.inFlight && this.queue.includes(target)) {
+                target.item.repeatCount = (target.item.repeatCount ?? 1) + 1;
+                return;
+              }
+            }
+            const held = this.push(
+              dest,
+              { ...item, repeatCount: 1 },
+              entry.firstSeenAt + this.opts.collapseWindowMs
+            );
+            entry.held = held;
+            return;
+          }
+          this.collapse.delete(collapseKey);
+          if (this.collapse.size >= this.opts.collapseMaxKeys) {
+            const oldest = this.collapse.keys().next().value;
+            if (oldest !== void 0) this.collapse.delete(oldest);
+          }
+          const fresh = { firstSeenAt: now };
+          this.collapse.set(collapseKey, fresh);
+          fresh.first = this.push(dest, item, now);
+          return;
+        }
+        this.push(dest, item, now);
+      }
+      /**
+       * Deliver every eligible queued item. Concurrent callers share ONE
+       * in-flight drain (it survives the caller's budget and a Lambda freeze),
+       * so nothing in flight is ever sent twice; items queued while it runs are
+       * picked up by the same drain.
+       */
+      flush() {
+        if (!this.inFlight) {
+          this.inFlight = this.drain().finally(() => {
+            this.inFlight = void 0;
+          });
+        }
+        return this.inFlight;
+      }
+      /** Counters for tests and diagnostics. */
+      stats() {
+        return {
+          queueDepth: this.queue.length,
+          droppedSinceLast: this.droppedSinceLast,
+          droppedTotal: this.droppedTotal,
+          deliveredTotal: this.deliveredTotal,
+          flushing: this.inFlight !== void 0
+        };
+      }
+      push(dest, item, eligibleAt) {
+        while (this.queue.length >= this.opts.maxItems) this.dropOldest();
+        const entry = {
+          dest,
+          destKey: destKeyOf(dest),
+          item,
+          attempts: 0,
+          eligibleAt,
+          inFlight: false
+        };
+        this.queue.push(entry);
+        return entry;
+      }
+      dropOldest() {
+        if (this.queue.shift()) this.countDropped(1);
+      }
+      countDropped(n) {
+        this.droppedSinceLast += n;
+        this.droppedTotal += n;
+      }
+      async drain() {
+        for (; ; ) {
+          const now = this.opts.now();
+          if (now < this.backoffUntil) return;
+          const batch = this.takeBatch(now);
+          if (batch.length === 0) return;
+          const ok = await this.send(batch);
+          if (!ok) return;
+        }
+      }
+      /** Oldest eligible item + up to maxBatch-1 more for the same destination. */
+      takeBatch(now) {
+        const first = this.queue.find((q) => q.eligibleAt <= now);
+        if (!first) return [];
+        const batch = [];
+        const rest = [];
+        for (const q of this.queue) {
+          if (batch.length < this.opts.maxBatch && q.destKey === first.destKey && q.eligibleAt <= now) {
+            q.inFlight = true;
+            batch.push(q);
+          } else {
+            rest.push(q);
+          }
+        }
+        this.queue = rest;
+        return batch;
+      }
+      /** POST one batch. Returns false when the drain should pause (backoff). */
+      async send(batch) {
+        const dest = batch[0].dest;
+        const useKey = dest.apiKey && !this.rejectedKeys.has(dest.apiKey) ? dest.apiKey : void 0;
+        const reportedDropped = this.droppedSinceLast;
+        const meta = {
+          droppedSinceLast: reportedDropped,
+          queueDepth: this.queue.length,
+          adapter: dest.adapter ?? "edge-core",
+          version: SDK_VERSION
+        };
+        const controller = typeof AbortController !== "undefined" ? new AbortController() : void 0;
+        const response = await withBudget(
+          sdkFetch(`${dest.apiBaseUrl}/verification-activity/edge-events`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              ...useKey && { Authorization: `Bearer ${useKey}` }
+            },
+            body: JSON.stringify({ events: batch.map((q) => q.item), meta }),
+            ...controller && { signal: controller.signal }
+          }),
+          this.opts.requestTimeoutMs
+        );
+        if (!response) controller?.abort();
+        const status = response?.status;
+        for (const q of batch) q.inFlight = false;
+        if (status !== void 0 && status >= 200 && status < 300) {
+          this.droppedSinceLast = Math.max(0, this.droppedSinceLast - reportedDropped);
+          this.deliveredTotal += batch.length;
+          return true;
+        }
+        if (status === 401 && useKey) {
+          this.rejectedKeys.add(useKey);
+          this.requeue(batch, false);
+          return true;
+        }
+        if (status === 429) {
+          const retryAfter = Number(response?.headers.get("retry-after"));
+          const waitMs = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 120) * 1e3 : 3e4;
+          this.backoffUntil = this.opts.now() + waitMs;
+          this.requeue(batch, false);
+          return false;
+        }
+        if (status !== void 0 && status >= 400 && status < 500) {
+          this.countDropped(batch.length);
+          return true;
+        }
+        this.backoffUntil = this.opts.now() + this.opts.retryBackoffMs;
+        this.requeue(batch, true);
+        return false;
+      }
+      /** Put a failed batch back at the head of the queue (order preserved). */
+      requeue(batch, countAttempt) {
+        const keep = [];
+        for (const q of batch) {
+          if (countAttempt) q.attempts += 1;
+          if (q.attempts >= this.opts.maxAttempts) this.countDropped(1);
+          else keep.push(q);
+        }
+        this.queue = [...keep, ...this.queue];
+        while (this.queue.length > this.opts.maxItems) this.dropOldest();
+      }
+    };
+    beaconBuffer = new BeaconBuffer();
   }
 });
 
@@ -5792,6 +6033,7 @@ var init_express = __esm({
     init_well_known();
     init_metadata_capture();
     init_anonymous_beacon();
+    init_failure_posture();
     DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
   }
 });
@@ -5807,6 +6049,7 @@ var init_nextjs = __esm({
     init_pdlss_pre_check();
     init_metadata_capture();
     init_anonymous_beacon();
+    init_failure_posture();
     init_http_pdlss();
     init_approval_gate();
     init_verified_hop();
@@ -6128,6 +6371,7 @@ var init_mcp2 = __esm({
     init_approval_gate();
     init_stepup_poll();
     init_well_known();
+    init_failure_posture();
     init_mcp_server();
   }
 });
@@ -6216,6 +6460,7 @@ var init_src = __esm({
     "use strict";
     init_trust_levels();
     init_verify();
+    init_failure_posture();
     init_stepup_poll();
     init_settlement();
     init_express();
@@ -6238,6 +6483,8 @@ var init_src = __esm({
     init_runtime_signatures();
     init_verified_hop();
     init_http();
+    init_pdlss_parser();
+    init_schema();
     init_version();
   }
 });
@@ -7116,7 +7363,15 @@ var init_settings_installer = __esm({
       "~/.claude/settings.json",
       "~/.claude/settings.local.json",
       "**/.astrasync/**",
-      "~/.astrasync/**"
+      "~/.astrasync/**",
+      // 5.11.0 fleet mode: enrolment + signed-policy cache (user scope is inside
+      // ~/.astrasync already; listed explicitly so the intent survives edits) and
+      // the machine-scope enrolment dirs. `//` = absolute from filesystem root;
+      // Windows paths are matched in POSIX form (C:\ → /c/).
+      "~/.astrasync/fleet/**",
+      "//etc/astrasync/**",
+      "//Library/Application Support/AstraSync/**",
+      "//c/ProgramData/AstraSync/**"
     ];
     GUARD_PERMISSION_DENY_RULES = PERMISSION_DENY_PATHS.map(
       (p) => `Edit(${p})`
@@ -7158,6 +7413,545 @@ var init_settings_installer2 = __esm({
   }
 });
 
+// src/fleet/client.ts
+function base(url) {
+  return url.replace(/\/+$/, "");
+}
+async function call(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await sdkFetch(url, { ...init, signal: controller.signal });
+    const text = await res.text();
+    let body = text;
+    try {
+      body = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    return { status: res.status, body, headers: res.headers };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function apiError(status, body, what) {
+  const b = body ?? {};
+  const code = b.code ?? (typeof b.error === "string" ? b.error : void 0);
+  return new FleetApiError(`${what} failed (${status}${code ? ` ${code}` : ""})`, status, code);
+}
+async function enrolDevice(apiBaseUrl, request2, timeoutMs = 15e3) {
+  const r = await call(
+    `${base(apiBaseUrl)}/fleet/enrol`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(request2)
+    },
+    timeoutMs
+  );
+  if (r.status !== 201 && r.status !== 200) throw apiError(r.status, r.body, "Enrolment");
+  const data = r.body;
+  if (!data?.deviceId || !data.credential || !data.jwks || !data.policyJws) {
+    throw new FleetApiError("Enrolment response is missing required fields", r.status);
+  }
+  return data;
+}
+var FleetApiError;
+var init_client2 = __esm({
+  "src/fleet/client.ts"() {
+    "use strict";
+    init_http();
+    FleetApiError = class extends Error {
+      constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "FleetApiError";
+      }
+    };
+  }
+});
+
+// src/fleet/enrolment-store.ts
+function machineScopeDir(platform2 = process.platform, env = process.env) {
+  if (platform2 === "darwin") return "/Library/Application Support/AstraSync";
+  if (platform2 === "win32") return (0, import_path5.join)(env.ProgramData || "C:\\ProgramData", "AstraSync");
+  return "/etc/astrasync";
+}
+function fleetPaths(options = {}) {
+  const home = options.home ?? (0, import_os.homedir)();
+  const machineDir = options.machineDir ?? options.env?.ASTRASYNC_FLEET_MACHINE_DIR ?? machineScopeDir(options.platform, options.env);
+  const userDir = (0, import_path5.join)(home, ".astrasync", "fleet");
+  return {
+    machineDevice: (0, import_path5.join)(machineDir, "fleet.json"),
+    machinePolicy: (0, import_path5.join)(machineDir, "policy.jws"),
+    userDir,
+    userDevice: (0, import_path5.join)(userDir, "device.json"),
+    userPolicy: (0, import_path5.join)(userDir, "policy.jws"),
+    userKeyChain: (0, import_path5.join)(userDir, "keychain.json"),
+    state: (0, import_path5.join)(userDir, "state.json")
+  };
+}
+function isEnrolment(value) {
+  const v = value;
+  return !!v && typeof v.deviceId === "string" && typeof v.credential === "string" && typeof v.apiBaseUrl === "string" && !!v.org && typeof v.org.ownerId === "string" && !!v.jwks && Array.isArray(v.jwks.keys);
+}
+function loadEnrolment(paths) {
+  const candidates = [
+    [paths.machineDevice, "machine"],
+    [paths.userDevice, "user"]
+  ];
+  for (const [path2, scope] of candidates) {
+    if (!(0, import_fs6.existsSync)(path2)) continue;
+    try {
+      const parsed = JSON.parse((0, import_fs6.readFileSync)(path2, "utf-8"));
+      if (isEnrolment(parsed)) return { enrolment: parsed, scope };
+    } catch {
+    }
+    return { corrupt: true, path: path2 };
+  }
+  return null;
+}
+function writeFileMode(path2, content, mode) {
+  (0, import_fs6.mkdirSync)((0, import_path5.dirname)(path2), { recursive: true, mode: 448 });
+  (0, import_fs6.writeFileSync)(path2, content, { encoding: "utf-8", mode });
+  try {
+    (0, import_fs6.chmodSync)(path2, mode);
+  } catch {
+  }
+}
+function saveEnrolment(paths, enrolment, scope) {
+  const path2 = scope === "machine" ? paths.machineDevice : paths.userDevice;
+  writeFileMode(path2, JSON.stringify(enrolment, null, 2), scope === "machine" ? 420 : 384);
+  return path2;
+}
+function readCachedPolicies(paths) {
+  const out = [];
+  for (const p of [paths.userPolicy, paths.machinePolicy]) {
+    try {
+      if ((0, import_fs6.existsSync)(p)) out.push((0, import_fs6.readFileSync)(p, "utf-8").trim());
+    } catch {
+    }
+  }
+  return out.filter(Boolean);
+}
+function writeCachedPolicy(paths, jws) {
+  writeFileMode(paths.userPolicy, jws, 384);
+}
+function readKeyChain(paths) {
+  try {
+    const parsed = JSON.parse((0, import_fs6.readFileSync)(paths.userKeyChain, "utf-8"));
+    return Array.isArray(parsed) ? parsed.filter((j) => typeof j === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function writeKeyChain(paths, chain) {
+  writeFileMode(paths.userKeyChain, JSON.stringify(chain), 384);
+}
+function writeMachinePolicy(paths, jws) {
+  writeFileMode(paths.machinePolicy, jws, 420);
+}
+function readState(paths) {
+  try {
+    const parsed = JSON.parse((0, import_fs6.readFileSync)(paths.state, "utf-8"));
+    const c = parsed.counts;
+    return {
+      ...parsed,
+      counts: { allow: c?.allow ?? 0, deny: c?.deny ?? 0, ask: c?.ask ?? 0 }
+    };
+  } catch {
+    return { counts: { allow: 0, deny: 0, ask: 0 } };
+  }
+}
+function writeState(paths, state) {
+  try {
+    writeFileMode(paths.state, JSON.stringify(state, null, 2), 384);
+  } catch {
+  }
+}
+var import_fs6, import_os, import_path5;
+var init_enrolment_store = __esm({
+  "src/fleet/enrolment-store.ts"() {
+    "use strict";
+    import_fs6 = require("fs");
+    import_os = require("os");
+    import_path5 = require("path");
+  }
+});
+
+// src/fleet/types.ts
+var FLEET_POLICY_TYP, FLEET_POLICY_AUD, FLEET_POLICY_ISS, FLEET_KEYS_TYP, FLEET_KEYS_AUD, DEFAULT_HEARTBEAT_INTERVAL_SEC;
+var init_types3 = __esm({
+  "src/fleet/types.ts"() {
+    "use strict";
+    FLEET_POLICY_TYP = "fleet-policy+jwt";
+    FLEET_POLICY_AUD = "astrasync:fleet-policy";
+    FLEET_POLICY_ISS = "astrasync.ai";
+    FLEET_KEYS_TYP = "fleet-keys+jwt";
+    FLEET_KEYS_AUD = "astrasync:fleet-keys";
+    DEFAULT_HEARTBEAT_INTERVAL_SEC = 900;
+  }
+});
+
+// src/fleet/policy-verify.ts
+function sha256Hex(text) {
+  return (0, import_crypto.createHash)("sha256").update(text, "utf8").digest("hex");
+}
+function parseSettings(raw) {
+  if (!raw || typeof raw !== "object") throw new FleetPolicyError("settings missing");
+  const s = raw;
+  if (s.posture !== "active" && s.posture !== "passive") {
+    throw new FleetPolicyError("settings.posture must be active or passive");
+  }
+  if (s.failOpen !== void 0 && typeof s.failOpen !== "boolean") {
+    throw new FleetPolicyError("settings.failOpen must be a boolean");
+  }
+  if (s.governMcp !== void 0 && typeof s.governMcp !== "boolean") {
+    throw new FleetPolicyError("settings.governMcp must be a boolean");
+  }
+  if (s.skipTools !== void 0 && !(Array.isArray(s.skipTools) && s.skipTools.every((t) => typeof t === "string"))) {
+    throw new FleetPolicyError("settings.skipTools must be a string array");
+  }
+  const num = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+  return {
+    posture: s.posture,
+    failOpen: s.failOpen === true,
+    ...typeof s.governMcp === "boolean" && { governMcp: s.governMcp },
+    ...Array.isArray(s.skipTools) && { skipTools: s.skipTools },
+    ...num(s.heartbeatIntervalSec) && { heartbeatIntervalSec: num(s.heartbeatIntervalSec) },
+    ...num(s.staleAfterSec) && { staleAfterSec: num(s.staleAfterSec) }
+  };
+}
+async function verifyFleetPolicy(jws, jwks, options) {
+  let payloadBytes;
+  let header;
+  try {
+    const keySet = (0, import_jose2.createLocalJWKSet)(jwks);
+    const result = await (0, import_jose2.compactVerify)(jws, keySet, { algorithms: ["ES256"] });
+    payloadBytes = result.payload;
+    header = result.protectedHeader;
+  } catch (err) {
+    throw new FleetPolicyError(
+      `signature verification failed (${err instanceof Error ? err.message : String(err)})`
+    );
+  }
+  if (header.typ !== FLEET_POLICY_TYP) throw new FleetPolicyError(`unexpected typ ${header.typ}`);
+  let claims;
+  try {
+    claims = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    throw new FleetPolicyError("payload is not JSON");
+  }
+  if (claims.aud !== FLEET_POLICY_AUD) throw new FleetPolicyError(`unexpected aud ${claims.aud}`);
+  if (claims.iss !== FLEET_POLICY_ISS) throw new FleetPolicyError(`unexpected iss ${claims.iss}`);
+  if (!options.expectedSubs.includes(claims.sub)) {
+    throw new FleetPolicyError("policy was issued for a different organisation or device");
+  }
+  if (!Number.isInteger(claims.ver) || claims.ver < 1) {
+    throw new FleetPolicyError("ver must be a positive integer");
+  }
+  if (options.minVer !== void 0 && claims.ver < options.minVer) {
+    throw new FleetPolicyError(
+      `policy version ${claims.ver} is older than the accepted version ${options.minVer} (rollback)`
+    );
+  }
+  if (typeof claims.yaml !== "string" || sha256Hex(claims.yaml) !== claims.sha256) {
+    throw new FleetPolicyError("policy hash mismatch");
+  }
+  const settings = parseSettings(claims.settings);
+  const parsed = parseYaml(claims.yaml);
+  if (!parsed.policy) {
+    const first = parsed.validation.errors[0];
+    throw new FleetPolicyError(
+      `signed policy is invalid${first ? ` (${first.path}: ${first.message})` : ""}`
+    );
+  }
+  return { kid: header.kid, claims: { ...claims, settings }, policy: parsed.policy, settings, jws };
+}
+async function resolveFleetJwks(pinned, chain, ownerId) {
+  let trusted = pinned;
+  let lastSeq = 0;
+  for (const link of chain) {
+    try {
+      const { payload, protectedHeader } = await (0, import_jose2.compactVerify)(
+        link,
+        (0, import_jose2.createLocalJWKSet)(trusted),
+        { algorithms: ["ES256"] }
+      );
+      if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;
+      const c = JSON.parse(new TextDecoder().decode(payload));
+      if (c.aud !== FLEET_KEYS_AUD || c.iss !== FLEET_POLICY_ISS || c.sub !== ownerId) continue;
+      if (!Number.isInteger(c.seq) || c.seq <= lastSeq) continue;
+      const keys = Array.isArray(c.keys) ? c.keys.filter((k) => k && k.kty === "EC" && k.crv === "P-256" && !("d" in k)) : [];
+      if (keys.length === 0) continue;
+      trusted = { keys };
+      lastSeq = c.seq;
+    } catch {
+    }
+  }
+  return trusted;
+}
+async function pickNewestValid(candidates, jwks, options) {
+  let best = null;
+  let lastError = new FleetPolicyError("no cached fleet policy");
+  for (const jws of candidates) {
+    try {
+      const v = await verifyFleetPolicy(jws, jwks, options);
+      if (!best || v.claims.ver > best.claims.ver) best = v;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new FleetPolicyError(String(err));
+    }
+  }
+  if (!best) throw lastError;
+  return best;
+}
+var import_crypto, import_jose2, FleetPolicyError;
+var init_policy_verify = __esm({
+  "src/fleet/policy-verify.ts"() {
+    "use strict";
+    import_crypto = require("crypto");
+    import_jose2 = require("jose");
+    init_pdlss_parser();
+    init_types3();
+    FleetPolicyError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FleetPolicyError";
+      }
+    };
+  }
+});
+
+// src/fleet/cli.ts
+function machineFingerprint() {
+  const candidates = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
+  let raw = "";
+  for (const c of candidates) {
+    try {
+      if ((0, import_fs7.existsSync)(c)) {
+        raw = (0, import_fs7.readFileSync)(c, "utf-8").trim();
+        if (raw) break;
+      }
+    } catch {
+    }
+  }
+  if (!raw) raw = `${(0, import_os2.hostname)()}|${(0, import_os2.platform)()}|${(0, import_os2.arch)()}`;
+  return (0, import_crypto2.createHash)("sha256").update(`astrasync-fleet:${raw}`).digest("hex");
+}
+async function runEnroll(options) {
+  const print = options.print ?? ((l) => console.log(l));
+  const token = options.token.trim();
+  if (!token)
+    throw new Error("Usage: astrasync guard enroll <token> [--api-base-url <url>] [--system]");
+  const apiBaseUrl = (options.apiBaseUrl ?? DEFAULT_FLEET_API_BASE_URL).replace(/\/+$/, "");
+  const paths = options.paths ?? fleetPaths();
+  const response = await enrolDevice(apiBaseUrl, {
+    token,
+    fingerprint: options.fingerprint ?? machineFingerprint(),
+    hostname: (0, import_os2.hostname)(),
+    os: { platform: (0, import_os2.platform)(), release: (0, import_os2.release)(), arch: (0, import_os2.arch)() },
+    guardVersion: SDK_VERSION,
+    adapters: options.adapters ?? [
+      { kind: "claude-code", managed: false },
+      { kind: "codex", managed: false }
+    ]
+  });
+  const enrolment = {
+    version: 1,
+    deviceId: response.deviceId,
+    credential: response.credential,
+    org: response.org,
+    apiBaseUrl: response.apiBaseUrl || apiBaseUrl,
+    jwks: response.jwks,
+    heartbeatIntervalSec: response.heartbeatIntervalSec || DEFAULT_HEARTBEAT_INTERVAL_SEC,
+    enrolledAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const verified = await verifyFleetPolicy(response.policyJws, enrolment.jwks, {
+    expectedSubs: [enrolment.org.ownerId, enrolment.deviceId]
+  });
+  const scope = options.system ? "machine" : "user";
+  const savedTo = saveEnrolment(paths, enrolment, scope);
+  if (options.system) writeMachinePolicy(paths, response.policyJws);
+  writeCachedPolicy(paths, response.policyJws);
+  writeKeyChain(paths, []);
+  const state = readState(paths);
+  writeState(paths, {
+    ...state,
+    appliedSha256: verified.claims.sha256,
+    maxVer: Math.max(state.maxVer ?? 0, verified.claims.ver),
+    revoked: false
+  });
+  print(
+    `Enrolled in ${enrolment.org.name ?? enrolment.org.ownerId} (device ${enrolment.deviceId}).`
+  );
+  print(`  Enrolment: ${savedTo} (${scope} scope)`);
+  print(`  Policy:    v${verified.claims.ver}, posture ${verified.settings.posture}`);
+  print(
+    "  Local policy.yaml / guard.json files are now ignored \u2014 the organisation policy governs."
+  );
+  return enrolment;
+}
+async function getFleetStatus(paths = fleetPaths()) {
+  const loaded = loadEnrolment(paths);
+  if (!loaded) return { enrolled: false };
+  if ("corrupt" in loaded) return { enrolled: true, corrupt: loaded.path };
+  const { enrolment, scope } = loaded;
+  const state = readState(paths);
+  let policy;
+  try {
+    const jwks = await resolveFleetJwks(enrolment.jwks, readKeyChain(paths), enrolment.org.ownerId);
+    const v = await pickNewestValid(readCachedPolicies(paths), jwks, {
+      expectedSubs: [enrolment.org.ownerId, enrolment.deviceId],
+      minVer: state.maxVer
+    });
+    policy = {
+      ver: v.claims.ver,
+      sha256: v.claims.sha256,
+      posture: v.settings.posture,
+      failOpen: v.settings.failOpen
+    };
+  } catch (err) {
+    policy = { error: err instanceof Error ? err.message : String(err) };
+  }
+  return {
+    enrolled: true,
+    scope,
+    org: enrolment.org,
+    deviceId: enrolment.deviceId,
+    apiBaseUrl: enrolment.apiBaseUrl,
+    policy,
+    lastHeartbeatAt: state.lastHeartbeatAt,
+    revoked: state.revoked === true,
+    lastError: state.lastError,
+    pendingCounts: state.counts
+  };
+}
+function formatFleetStatus(status) {
+  if (!status.enrolled) return ["Fleet: not enrolled (local policy mode)."];
+  if (status.corrupt) {
+    return [`Fleet: enrolment file ${status.corrupt} is unreadable \u2014 the guard fails closed.`];
+  }
+  const lines = [
+    `Fleet: enrolled in ${status.org?.name ?? status.org?.ownerId} (${status.scope} scope)`,
+    `  Device:    ${status.deviceId}`,
+    `  Platform:  ${status.apiBaseUrl}`
+  ];
+  if (status.policy && "error" in status.policy) {
+    lines.push(`  Policy:    NO VALID SIGNED POLICY \u2014 ${status.policy.error} (guard denies)`);
+  } else if (status.policy) {
+    lines.push(
+      `  Policy:    v${status.policy.ver} (${status.policy.sha256.slice(0, 12)}\u2026), posture ${status.policy.posture}${status.policy.failOpen ? ", fail-open" : ""}`
+    );
+  }
+  lines.push(`  Heartbeat: ${status.lastHeartbeatAt ?? "never"}`);
+  if (status.revoked) {
+    lines.push("  Status:    REVOKED by the organisation \u2014 enforcing the last good policy");
+  }
+  if (status.lastError) lines.push(`  Last sync error: ${status.lastError}`);
+  return lines;
+}
+function managedHookCommand(target, os2) {
+  const bin = target === "claude" ? "astrasync-claude-hook" : "astrasync-codex-hook";
+  if (os2 === "win32") return `"C:\\Program Files\\nodejs\\${bin}.cmd"`;
+  return `/usr/local/bin/${bin}`;
+}
+function buildClaudeManagedSettings(os2) {
+  return {
+    allowManagedHooksOnly: true,
+    env: { ASTRASYNC_FLEET_REQUIRED: "1" },
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: HOOK_MATCHER,
+          hooks: [{ type: "command", command: managedHookCommand("claude", os2), timeout: 10 }]
+        }
+      ]
+    },
+    permissions: { deny: [...GUARD_PERMISSION_DENY_RULES] }
+  };
+}
+function tomlString(value) {
+  return JSON.stringify(value);
+}
+function buildCodexRequirementsToml(os2) {
+  const command = os2 === "win32" ? `set ASTRASYNC_FLEET_REQUIRED=1&& ${managedHookCommand("codex", os2)}` : `ASTRASYNC_FLEET_REQUIRED=1 ${managedHookCommand("codex", os2)}`;
+  return [
+    "# AstraSync Local Guard \u2014 managed hook (generated by `astrasync guard managed-settings --codex`)",
+    `# Install at: ${MANAGED_SETTINGS_LOCATIONS.codex[os2]}`,
+    "allow_managed_hooks_only = true",
+    "",
+    "[features]",
+    "hooks = true",
+    "",
+    "[[hooks.PreToolUse]]",
+    `matcher = ${tomlString(CODEX_HOOK_MATCHER)}`,
+    "",
+    "[[hooks.PreToolUse.hooks]]",
+    'type = "command"',
+    `command = ${tomlString(command)}`,
+    "timeout = 10",
+    'statusMessage = "AstraSync Local Guard"',
+    ""
+  ].join("\n");
+}
+function buildManagedSettingsFiles(targets) {
+  const out = [];
+  for (const target of targets) {
+    for (const os2 of ["darwin", "linux", "win32"]) {
+      const content = target === "claude" ? `${JSON.stringify(buildClaudeManagedSettings(os2), null, 2)}
+` : buildCodexRequirementsToml(os2);
+      out.push({
+        target,
+        os: os2,
+        installPath: MANAGED_SETTINGS_LOCATIONS[target][os2],
+        fileName: `${target}-${os2}-${target === "claude" ? "managed-settings.json" : "requirements.toml"}`,
+        content
+      });
+    }
+  }
+  return out;
+}
+function writeManagedSettings(files, outDir) {
+  (0, import_fs7.mkdirSync)(outDir, { recursive: true });
+  return files.map((f) => {
+    const p = (0, import_path6.join)(outDir, f.fileName);
+    (0, import_fs7.writeFileSync)(p, f.content, "utf-8");
+    return p;
+  });
+}
+var import_crypto2, import_fs7, import_os2, import_path6, DEFAULT_FLEET_API_BASE_URL, MANAGED_SETTINGS_LOCATIONS;
+var init_cli = __esm({
+  "src/fleet/cli.ts"() {
+    "use strict";
+    import_crypto2 = require("crypto");
+    import_fs7 = require("fs");
+    import_os2 = require("os");
+    import_path6 = require("path");
+    init_settings_installer();
+    init_settings_installer2();
+    init_version();
+    init_client2();
+    init_enrolment_store();
+    init_policy_verify();
+    init_types3();
+    DEFAULT_FLEET_API_BASE_URL = "https://astrasync.ai/api";
+    MANAGED_SETTINGS_LOCATIONS = {
+      // code.claude.com/docs/en/managed-settings
+      claude: {
+        darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
+        linux: "/etc/claude-code/managed-settings.json",
+        win32: "C:\\Program Files\\ClaudeCode\\managed-settings.json"
+      },
+      // learn.chatgpt.com/docs/enterprise/managed-configuration
+      codex: {
+        darwin: "/etc/codex/requirements.toml",
+        linux: "/etc/codex/requirements.toml",
+        win32: "%ProgramData%\\OpenAI\\Codex\\requirements.toml"
+      }
+    };
+  }
+});
+
 // src/cli/guard.ts
 var guard_exports = {};
 function createPrompt() {
@@ -7296,6 +8090,9 @@ async function cmdStatus() {
     }
   });
   console.log("\nAstraSync Local Guard Status\n");
+  for (const line of formatFleetStatus(await getFleetStatus(fleetPaths()))) {
+    console.log(`  ${line}`);
+  }
   if (upgraded) {
     const config = JSON.parse(fs.readFileSync(`${DEFAULT_CONFIG_DIR}/config`, "utf-8"));
     console.log(`  Mode:     ${config.mode}`);
@@ -7651,6 +8448,66 @@ function printClaudeCodeStatus() {
     }
   }
 }
+function flagValue(flag) {
+  const i = process.argv.indexOf(flag);
+  return i !== -1 ? process.argv[i + 1] : void 0;
+}
+function positionalAfter(command) {
+  const argv = process.argv;
+  const start = argv.indexOf(command) + 1;
+  for (let i = start; i < argv.length; i++) {
+    if (argv[i].startsWith("--")) {
+      if (argv[i] === "--api-base-url" || argv[i] === "--out") i++;
+      continue;
+    }
+    return argv[i];
+  }
+  return void 0;
+}
+async function cmdEnroll() {
+  const token = positionalAfter("enroll") ?? "";
+  try {
+    await runEnroll({
+      token,
+      apiBaseUrl: flagValue("--api-base-url"),
+      system: process.argv.includes("--system")
+    });
+  } catch (err) {
+    console.error(`Enrolment failed: ${err instanceof Error ? err.message : String(err)}`);
+    if (process.argv.includes("--system")) {
+      console.error(
+        "  (--system writes the machine-scope enrolment and needs administrator rights)"
+      );
+    }
+    process.exit(1);
+  }
+}
+async function cmdFleetStatus() {
+  const status = await getFleetStatus(fleetPaths());
+  for (const line of formatFleetStatus(status)) console.log(line);
+}
+async function cmdManagedSettings() {
+  const targets = [];
+  if (process.argv.includes("--claude")) targets.push("claude");
+  if (process.argv.includes("--codex")) targets.push("codex");
+  if (targets.length === 0) targets.push("claude", "codex");
+  const files = buildManagedSettingsFiles(targets);
+  const outDir = flagValue("--out");
+  if (outDir) {
+    const written = writeManagedSettings(files, outDir);
+    console.log("Managed-settings templates written:");
+    files.forEach((f, i) => console.log(`  ${written[i]}  \u2192  deploy to ${f.installPath}`));
+  } else {
+    for (const f of files) {
+      console.log(`===== ${f.target} \xB7 ${f.os} \u2192 ${f.installPath}`);
+      console.log(f.content);
+    }
+  }
+  console.log(
+    "Hook commands assume npm\u2019s default global prefix; adjust if your MDM installs elsewhere."
+  );
+  console.log("Machines must also be enrolled: astrasync guard enroll <token> --system");
+}
 async function main() {
   const command = process.argv[2] === "guard" ? process.argv[3] : process.argv[2];
   switch (command) {
@@ -7687,6 +8544,16 @@ async function main() {
     case "uninstall-codex":
       await cmdUninstallCodex();
       break;
+    case "enroll":
+    case "enrol":
+      await cmdEnroll();
+      break;
+    case "fleet-status":
+      await cmdFleetStatus();
+      break;
+    case "managed-settings":
+      await cmdManagedSettings();
+      break;
     default:
       console.log("AstraSync Local Guard\n");
       console.log("Usage: astrasync guard <command>\n");
@@ -7707,6 +8574,10 @@ async function main() {
       console.log("  install-codex          Install the Local Guard hook for OpenAI Codex CLI");
       console.log("                         (same flags; policy shared with Claude Code)");
       console.log("  uninstall-codex        Remove the Codex hook (--project for project scope)");
+      console.log("  enroll <token>         Enrol this machine in your organisation fleet");
+      console.log("                         (--api-base-url <url>, --system for machine scope)");
+      console.log("  fleet-status           Show fleet enrolment, signed policy and heartbeat");
+      console.log("  managed-settings       Print MDM templates (--claude, --codex, --out <dir>)");
       console.log("");
       process.exit(command ? 1 : 0);
   }
@@ -7727,6 +8598,8 @@ var init_guard = __esm({
     init_git_hooks();
     init_settings_installer();
     init_settings_installer2();
+    init_cli();
+    init_enrolment_store();
     DEFAULT_POLICY_PATH = "./local-policy.yaml";
     DEFAULT_CONFIG_DIR = ".astrasync";
     main().catch((err) => {
@@ -7759,6 +8632,10 @@ COMMANDS:
   verify <id>           Look up an agent by ASTRA ID or UUID
   health                Check API health
   guard <subcommand>    Local Guard CLI (setup, start, status, install-claude-code, ...)
+  guard enroll <token>  Enrol this machine in your organisation's fleet
+                        (--api-base-url <url>, --system for machine scope)
+  guard fleet-status    Fleet enrolment, signed policy and heartbeat state
+  guard managed-settings  MDM templates for Claude Code / Codex (--claude, --codex, --out <dir>)
 
 REGISTER OPTIONS:
   --name <name>                 Agent name (required)