@astrasyncai/verification-gateway 5.10.0 → 5.12.0

package/dist/codex/index.mjs

@@ -279,7 +279,8 @@ var CodexAdapter = class {
 };
 
 // src/codex/hook.ts
-import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join5 } from "path";
 
 // src/gateway/types.ts
 var HIGH_RISK_COMMANDS = [
@@ -4005,7 +4006,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.10.0";
+var SDK_VERSION = "5.12.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4032,6 +4033,14 @@ function getCachedWellKnownUrls(apiBaseUrl) {
   return cache.get(apiBaseUrl)?.data;
 }
 
+// src/failure-posture.ts
+var REJECTED_IDENTITY_DIMENSIONS = /* @__PURE__ */ new Set([
+  "identity.invalid_agent_id",
+  "identity.unknown_agent",
+  "agent.lookup"
+]);
+var UNKNOWN_AGENT_GUIDANCE = "Register your agent with AstraSync (or, inside an MCP host, add the AstraSync MCP connector for keyless, human-approved registration), then present the canonical ASTRA-* id issued after owner approval.";
+
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
@@ -4243,11 +4252,44 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // coercing the absent recommendation to a policy 'deny'. Misconfig is
     // deterministic and intentionally NOT marked retryable.
     ...isApiError && { retryable: true },
+    ...options.httpStatus !== void 0 && { httpStatus: options.httpStatus },
+    ...options.retryAfterMs !== void 0 && { retryAfterMs: options.retryAfterMs },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
+async function readJsonSafe(response) {
+  try {
+    const parsed = await response.json();
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rejectedIdentityGuidance(failures) {
+  const f = failures?.find((x) => REJECTED_IDENTITY_DIMENSIONS.has(x.dimension));
+  if (!f) return void 0;
+  if (f.dimension === "agent.lookup") {
+    return `The presented agent identifier is not registered with AstraSync. ${UNKNOWN_AGENT_GUIDANCE}`;
+  }
+  return f.guidance ? `${f.message} ${f.guidance}` : f.message;
+}
+var MAX_RETRY_AFTER_MS = 15 * 60 * 1e3;
+function parseRetryAfterMs(response) {
+  const raw = response.headers?.get?.("retry-after");
+  if (!raw) return void 0;
+  const trimmed = raw.trim();
+  let ms;
+  if (/^\d+(\.\d+)?$/.test(trimmed)) {
+    ms = Number(trimmed) * 1e3;
+  } else {
+    const at = Date.parse(trimmed);
+    if (Number.isNaN(at)) return void 0;
+    ms = at - Date.now();
+  }
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, Math.round(ms)));
+}
 async function callVerifyAccessAPI(config, request) {
   const { credentials, ...requestData } = request;
   const body = {
@@ -4304,7 +4346,8 @@ async function callVerifyAccessAPI(config, request) {
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
-    const data = await response.json();
+    const data = await readJsonSafe(response);
+    const retryAfterMs = parseRetryAfterMs(response);
     if (response.status === 410) {
       return {
         success: true,
@@ -4342,6 +4385,23 @@ async function callVerifyAccessAPI(config, request) {
         }
       };
     }
+    if (response.status === 404 && credentials.astraId && (data?.error === "AGENT_NOT_FOUND" || typeof data?.message === "string" && /agent/i.test(data.message))) {
+      return {
+        success: true,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        access: {
+          allowed: false,
+          reason: "unknown_agent",
+          failures: [
+            {
+              dimension: "identity.unknown_agent",
+              message: "The presented agent identifier is not registered with AstraSync.",
+              guidance: UNKNOWN_AGENT_GUIDANCE
+            }
+          ]
+        }
+      };
+    }
     if (!response.ok) {
       if (response.status === 401) {
         return {
@@ -4356,9 +4416,11 @@ async function callVerifyAccessAPI(config, request) {
       }
       return {
         success: false,
-        error: data.message || data.error || `API returned ${response.status}`,
+        error: typeof data?.message === "string" && data.message || typeof data?.error === "string" && data.error || `API returned ${response.status}`,
         correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
-        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        httpStatus: response.status,
+        ...retryAfterMs !== void 0 && { retryAfterMs }
       };
     }
     return data;
@@ -4430,12 +4492,14 @@ async function verify(config, request, options) {
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
       remediation: apiResponse.remediation,
+      httpStatus: apiResponse.httpStatus,
+      retryAfterMs: apiResponse.retryAfterMs,
       urls
     });
   }
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
-    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true;
+    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
@@ -4447,7 +4511,10 @@ async function verify(config, request, options) {
       requiresStepUp: apiResponse.access?.requiresStepUp,
       requiresApproval: apiResponse.access?.requiresApproval,
       guidance: {
-        message: apiResponse.access?.reason || "Access denied by PDLSS policy",
+        // 5.12.0: a presented-but-rejected id (malformed / unknown) carries
+        // actionable registration guidance on its failure — surface it
+        // instead of the bare machine reason ('unknown_agent').
+        message: rejectedIdentityGuidance(aggregatedFailures) ?? (apiResponse.access?.reason || "Access denied by PDLSS policy"),
         registrationUrl: urls?.registrationUrl ?? "",
         documentationUrl: urls?.documentationUrl ?? "",
         // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
@@ -4547,7 +4614,7 @@ async function verify(config, request, options) {
       registrationUrl: urls?.registrationUrl ?? "",
       documentationUrl: urls?.documentationUrl ?? ""
     };
-  } else if (result.recommendation === "step_up_required") {
+  } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
   }
@@ -4576,6 +4643,217 @@ var DEFAULT_EDGE_CONFIG = Object.freeze({
 var DEFAULT_TTL_MS = 60 * 1e3;
 var DEFAULT_MAX_STALE_MS = 24 * 60 * 60 * 1e3;
 
+// src/edge-core/events.ts
+async function withBudget(promise, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(void 0), ms);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+var destKeyOf = (d) => `${d.apiBaseUrl}\0${d.apiKey ?? ""}\0${d.counterparty}\0${d.adapter ?? ""}`;
+var BeaconBuffer = class {
+  constructor(options = {}) {
+    this.queue = [];
+    this.droppedSinceLast = 0;
+    this.droppedTotal = 0;
+    this.deliveredTotal = 0;
+    this.backoffUntil = 0;
+    this.collapse = /* @__PURE__ */ new Map();
+    /** Keys the backend answered 401 for — later batches go unauthenticated. */
+    this.rejectedKeys = /* @__PURE__ */ new Set();
+    this.opts = {
+      maxItems: options.maxItems ?? 1e3,
+      maxBatch: options.maxBatch ?? 100,
+      maxAttempts: options.maxAttempts ?? 3,
+      collapseWindowMs: options.collapseWindowMs ?? 6e4,
+      collapseMaxKeys: options.collapseMaxKeys ?? 1e3,
+      requestTimeoutMs: options.requestTimeoutMs ?? 1e4,
+      retryBackoffMs: options.retryBackoffMs ?? 1e3,
+      now: options.now ?? Date.now
+    };
+  }
+  /**
+   * Queue one beacon. With a `collapseKey`, a repeat inside the window is
+   * merged into a held aggregate (sent when the window closes) instead of
+   * becoming its own item.
+   */
+  enqueue(dest, item, collapseKey) {
+    const now = this.opts.now();
+    if (collapseKey) {
+      const entry = this.collapse.get(collapseKey);
+      if (entry && now - entry.firstSeenAt < this.opts.collapseWindowMs) {
+        for (const target of [entry.first, entry.held]) {
+          if (target && !target.inFlight && this.queue.includes(target)) {
+            target.item.repeatCount = (target.item.repeatCount ?? 1) + 1;
+            return;
+          }
+        }
+        const held = this.push(
+          dest,
+          { ...item, repeatCount: 1 },
+          entry.firstSeenAt + this.opts.collapseWindowMs
+        );
+        entry.held = held;
+        return;
+      }
+      this.collapse.delete(collapseKey);
+      if (this.collapse.size >= this.opts.collapseMaxKeys) {
+        const oldest = this.collapse.keys().next().value;
+        if (oldest !== void 0) this.collapse.delete(oldest);
+      }
+      const fresh = { firstSeenAt: now };
+      this.collapse.set(collapseKey, fresh);
+      fresh.first = this.push(dest, item, now);
+      return;
+    }
+    this.push(dest, item, now);
+  }
+  /**
+   * Deliver every eligible queued item. Concurrent callers share ONE
+   * in-flight drain (it survives the caller's budget and a Lambda freeze),
+   * so nothing in flight is ever sent twice; items queued while it runs are
+   * picked up by the same drain.
+   */
+  flush() {
+    if (!this.inFlight) {
+      this.inFlight = this.drain().finally(() => {
+        this.inFlight = void 0;
+      });
+    }
+    return this.inFlight;
+  }
+  /** Counters for tests and diagnostics. */
+  stats() {
+    return {
+      queueDepth: this.queue.length,
+      droppedSinceLast: this.droppedSinceLast,
+      droppedTotal: this.droppedTotal,
+      deliveredTotal: this.deliveredTotal,
+      flushing: this.inFlight !== void 0
+    };
+  }
+  push(dest, item, eligibleAt) {
+    while (this.queue.length >= this.opts.maxItems) this.dropOldest();
+    const entry = {
+      dest,
+      destKey: destKeyOf(dest),
+      item,
+      attempts: 0,
+      eligibleAt,
+      inFlight: false
+    };
+    this.queue.push(entry);
+    return entry;
+  }
+  dropOldest() {
+    if (this.queue.shift()) this.countDropped(1);
+  }
+  countDropped(n) {
+    this.droppedSinceLast += n;
+    this.droppedTotal += n;
+  }
+  async drain() {
+    for (; ; ) {
+      const now = this.opts.now();
+      if (now < this.backoffUntil) return;
+      const batch = this.takeBatch(now);
+      if (batch.length === 0) return;
+      const ok = await this.send(batch);
+      if (!ok) return;
+    }
+  }
+  /** Oldest eligible item + up to maxBatch-1 more for the same destination. */
+  takeBatch(now) {
+    const first = this.queue.find((q) => q.eligibleAt <= now);
+    if (!first) return [];
+    const batch = [];
+    const rest = [];
+    for (const q of this.queue) {
+      if (batch.length < this.opts.maxBatch && q.destKey === first.destKey && q.eligibleAt <= now) {
+        q.inFlight = true;
+        batch.push(q);
+      } else {
+        rest.push(q);
+      }
+    }
+    this.queue = rest;
+    return batch;
+  }
+  /** POST one batch. Returns false when the drain should pause (backoff). */
+  async send(batch) {
+    const dest = batch[0].dest;
+    const useKey = dest.apiKey && !this.rejectedKeys.has(dest.apiKey) ? dest.apiKey : void 0;
+    const reportedDropped = this.droppedSinceLast;
+    const meta = {
+      droppedSinceLast: reportedDropped,
+      queueDepth: this.queue.length,
+      adapter: dest.adapter ?? "edge-core",
+      version: SDK_VERSION
+    };
+    const controller = typeof AbortController !== "undefined" ? new AbortController() : void 0;
+    const response = await withBudget(
+      sdkFetch(`${dest.apiBaseUrl}/verification-activity/edge-events`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...useKey && { Authorization: `Bearer ${useKey}` }
+        },
+        body: JSON.stringify({ events: batch.map((q) => q.item), meta }),
+        ...controller && { signal: controller.signal }
+      }),
+      this.opts.requestTimeoutMs
+    );
+    if (!response) controller?.abort();
+    const status = response?.status;
+    for (const q of batch) q.inFlight = false;
+    if (status !== void 0 && status >= 200 && status < 300) {
+      this.droppedSinceLast = Math.max(0, this.droppedSinceLast - reportedDropped);
+      this.deliveredTotal += batch.length;
+      return true;
+    }
+    if (status === 401 && useKey) {
+      this.rejectedKeys.add(useKey);
+      this.requeue(batch, false);
+      return true;
+    }
+    if (status === 429) {
+      const retryAfter = Number(response?.headers.get("retry-after"));
+      const waitMs = Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter, 120) * 1e3 : 3e4;
+      this.backoffUntil = this.opts.now() + waitMs;
+      this.requeue(batch, false);
+      return false;
+    }
+    if (status !== void 0 && status >= 400 && status < 500) {
+      this.countDropped(batch.length);
+      return true;
+    }
+    this.backoffUntil = this.opts.now() + this.opts.retryBackoffMs;
+    this.requeue(batch, true);
+    return false;
+  }
+  /** Put a failed batch back at the head of the queue (order preserved). */
+  requeue(batch, countAttempt) {
+    const keep = [];
+    for (const q of batch) {
+      if (countAttempt) q.attempts += 1;
+      if (q.attempts >= this.opts.maxAttempts) this.countDropped(1);
+      else keep.push(q);
+    }
+    this.queue = [...keep, ...this.queue];
+    while (this.queue.length > this.opts.maxItems) this.dropOldest();
+  }
+};
+var beaconBuffer = new BeaconBuffer();
+
 // src/adapters/express.ts
 var DEFAULT_ROUTES_REFRESH_MS = 5 * 60 * 1e3;
 
@@ -5173,22 +5451,118 @@ var AstraSyncGateway = class {
 };
 
 // src/claude-code/guard-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// src/fleet/enrolment-store.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
-function resolveGuardConfig(env, payloadCwd, home = homedir()) {
+import { dirname as dirname2, join as join2 } from "path";
+function machineScopeDir(platform = process.platform, env = process.env) {
+  if (platform === "darwin") return "/Library/Application Support/AstraSync";
+  if (platform === "win32") return join2(env.ProgramData || "C:\\ProgramData", "AstraSync");
+  return "/etc/astrasync";
+}
+function fleetPaths(options = {}) {
+  const home = options.home ?? homedir();
+  const machineDir = options.machineDir ?? options.env?.ASTRASYNC_FLEET_MACHINE_DIR ?? machineScopeDir(options.platform, options.env);
+  const userDir = join2(home, ".astrasync", "fleet");
+  return {
+    machineDevice: join2(machineDir, "fleet.json"),
+    machinePolicy: join2(machineDir, "policy.jws"),
+    userDir,
+    userDevice: join2(userDir, "device.json"),
+    userPolicy: join2(userDir, "policy.jws"),
+    userKeyChain: join2(userDir, "keychain.json"),
+    state: join2(userDir, "state.json")
+  };
+}
+function isEnrolment(value) {
+  const v = value;
+  return !!v && typeof v.deviceId === "string" && typeof v.credential === "string" && typeof v.apiBaseUrl === "string" && !!v.org && typeof v.org.ownerId === "string" && !!v.jwks && Array.isArray(v.jwks.keys);
+}
+function loadEnrolment(paths) {
+  const candidates = [
+    [paths.machineDevice, "machine"],
+    [paths.userDevice, "user"]
+  ];
+  for (const [path, scope] of candidates) {
+    if (!existsSync3(path)) continue;
+    try {
+      const parsed = JSON.parse(readFileSync3(path, "utf-8"));
+      if (isEnrolment(parsed)) return { enrolment: parsed, scope };
+    } catch {
+    }
+    return { corrupt: true, path };
+  }
+  return null;
+}
+function writeFileMode(path, content, mode) {
+  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync2(path, content, { encoding: "utf-8", mode });
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+function readCachedPolicies(paths) {
+  const out = [];
+  for (const p of [paths.userPolicy, paths.machinePolicy]) {
+    try {
+      if (existsSync3(p)) out.push(readFileSync3(p, "utf-8").trim());
+    } catch {
+    }
+  }
+  return out.filter(Boolean);
+}
+function writeCachedPolicy(paths, jws) {
+  writeFileMode(paths.userPolicy, jws, 384);
+}
+function readKeyChain(paths) {
+  try {
+    const parsed = JSON.parse(readFileSync3(paths.userKeyChain, "utf-8"));
+    return Array.isArray(parsed) ? parsed.filter((j) => typeof j === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function writeKeyChain(paths, chain) {
+  writeFileMode(paths.userKeyChain, JSON.stringify(chain), 384);
+}
+function readState(paths) {
+  try {
+    const parsed = JSON.parse(readFileSync3(paths.state, "utf-8"));
+    const c = parsed.counts;
+    return {
+      ...parsed,
+      counts: { allow: c?.allow ?? 0, deny: c?.deny ?? 0, ask: c?.ask ?? 0 }
+    };
+  } catch {
+    return { counts: { allow: 0, deny: 0, ask: 0 } };
+  }
+}
+function writeState(paths, state) {
+  try {
+    writeFileMode(paths.state, JSON.stringify(state, null, 2), 384);
+  } catch {
+  }
+}
+
+// src/claude-code/guard-config.ts
+function resolveGuardConfig(env, payloadCwd, home = homedir2()) {
   const candidateRoots = [env.CLAUDE_PROJECT_DIR, payloadCwd, home].filter(
     (root) => typeof root === "string" && root.length > 0
   );
   for (const root of candidateRoots) {
-    const guardDir = join2(root, ".astrasync");
-    const policyFile = join2(guardDir, "policy.yaml");
-    if (!existsSync3(policyFile)) continue;
+    const guardDir = join3(root, ".astrasync");
+    const policyFile = join3(guardDir, "policy.yaml");
+    if (!existsSync4(policyFile)) continue;
     let settings = {};
-    const settingsFile = join2(guardDir, "guard.json");
-    if (existsSync3(settingsFile)) {
+    const settingsFile = join3(guardDir, "guard.json");
+    if (existsSync4(settingsFile)) {
       try {
-        settings = JSON.parse(readFileSync3(settingsFile, "utf-8"));
+        settings = JSON.parse(readFileSync4(settingsFile, "utf-8"));
       } catch {
         settings = {};
       }
@@ -5197,6 +5571,408 @@ function resolveGuardConfig(env, payloadCwd, home = homedir()) {
   }
   return null;
 }
+var FLEET_ENROL_INSTRUCTION = "This machine must be enrolled: run `astrasync guard enroll <token>` (token from your organisation admin)";
+function resolveFleet(env, home = homedir2(), paths = fleetPaths({ home, env })) {
+  const loaded = loadEnrolment(paths);
+  if (loaded && "corrupt" in loaded) {
+    return {
+      kind: "fleet-missing",
+      reason: `fleet enrolment at ${loaded.path} is unreadable \u2014 ${FLEET_ENROL_INSTRUCTION}`,
+      paths
+    };
+  }
+  if (loaded) return { kind: "fleet", enrolment: loaded.enrolment, scope: loaded.scope, paths };
+  if (env.ASTRASYNC_FLEET_REQUIRED === "1") {
+    return { kind: "fleet-missing", reason: FLEET_ENROL_INSTRUCTION, paths };
+  }
+  return null;
+}
+
+// src/fleet/hook-runner.ts
+import { join as join4 } from "path";
+
+// src/fleet/client.ts
+var FleetApiError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "FleetApiError";
+  }
+};
+function base(url) {
+  return url.replace(/\/+$/, "");
+}
+async function call(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await sdkFetch(url, { ...init, signal: controller.signal });
+    const text = await res.text();
+    let body = text;
+    try {
+      body = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    return { status: res.status, body, headers: res.headers };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function apiError(status, body, what) {
+  const b = body ?? {};
+  const code = b.code ?? (typeof b.error === "string" ? b.error : void 0);
+  return new FleetApiError(`${what} failed (${status}${code ? ` ${code}` : ""})`, status, code);
+}
+function deviceHeaders(enrolment) {
+  return { Authorization: `Device ${enrolment.credential}` };
+}
+function policyEtag(sha256, kid) {
+  return `${sha256}.${kid ?? ""}`;
+}
+async function fetchFleetPolicy(enrolment, ifNoneMatch, timeoutMs = 1500) {
+  const headers = deviceHeaders(enrolment);
+  if (ifNoneMatch) headers["If-None-Match"] = `"${ifNoneMatch}"`;
+  const r = await call(`${base(enrolment.apiBaseUrl)}/fleet/policy`, { headers }, timeoutMs);
+  if (r.status === 304) return { status: "unchanged" };
+  if (r.status !== 200) throw apiError(r.status, r.body, "Policy fetch");
+  const data = r.body;
+  if (!data?.policyJws) throw new FleetApiError("Policy response has no policyJws", r.status);
+  return {
+    status: "ok",
+    policyJws: data.policyJws,
+    sha256: data.sha256 ?? "",
+    version: data.version ?? 0,
+    keyChain: Array.isArray(data.keyChain) ? data.keyChain.filter((j) => typeof j === "string") : []
+  };
+}
+async function sendHeartbeat(enrolment, request, timeoutMs = 1500) {
+  const r = await call(
+    `${base(enrolment.apiBaseUrl)}/fleet/heartbeat`,
+    {
+      method: "POST",
+      headers: { ...deviceHeaders(enrolment), "Content-Type": "application/json" },
+      body: JSON.stringify(request)
+    },
+    timeoutMs
+  );
+  if (r.status !== 200) throw apiError(r.status, r.body, "Heartbeat");
+  return r.body;
+}
+
+// src/fleet/policy-verify.ts
+import { createHash as createHash4 } from "crypto";
+import { compactVerify, createLocalJWKSet } from "jose";
+
+// src/fleet/types.ts
+var FLEET_POLICY_TYP = "fleet-policy+jwt";
+var FLEET_POLICY_AUD = "astrasync:fleet-policy";
+var FLEET_POLICY_ISS = "astrasync.ai";
+var FLEET_KEYS_TYP = "fleet-keys+jwt";
+var FLEET_KEYS_AUD = "astrasync:fleet-keys";
+var DEFAULT_HEARTBEAT_INTERVAL_SEC = 900;
+
+// src/fleet/policy-verify.ts
+var FleetPolicyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FleetPolicyError";
+  }
+};
+function sha256Hex(text) {
+  return createHash4("sha256").update(text, "utf8").digest("hex");
+}
+function parseSettings(raw) {
+  if (!raw || typeof raw !== "object") throw new FleetPolicyError("settings missing");
+  const s = raw;
+  if (s.posture !== "active" && s.posture !== "passive") {
+    throw new FleetPolicyError("settings.posture must be active or passive");
+  }
+  if (s.failOpen !== void 0 && typeof s.failOpen !== "boolean") {
+    throw new FleetPolicyError("settings.failOpen must be a boolean");
+  }
+  if (s.governMcp !== void 0 && typeof s.governMcp !== "boolean") {
+    throw new FleetPolicyError("settings.governMcp must be a boolean");
+  }
+  if (s.skipTools !== void 0 && !(Array.isArray(s.skipTools) && s.skipTools.every((t) => typeof t === "string"))) {
+    throw new FleetPolicyError("settings.skipTools must be a string array");
+  }
+  const num = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : void 0;
+  return {
+    posture: s.posture,
+    failOpen: s.failOpen === true,
+    ...typeof s.governMcp === "boolean" && { governMcp: s.governMcp },
+    ...Array.isArray(s.skipTools) && { skipTools: s.skipTools },
+    ...num(s.heartbeatIntervalSec) && { heartbeatIntervalSec: num(s.heartbeatIntervalSec) },
+    ...num(s.staleAfterSec) && { staleAfterSec: num(s.staleAfterSec) }
+  };
+}
+async function verifyFleetPolicy(jws, jwks, options) {
+  let payloadBytes;
+  let header;
+  try {
+    const keySet = createLocalJWKSet(jwks);
+    const result = await compactVerify(jws, keySet, { algorithms: ["ES256"] });
+    payloadBytes = result.payload;
+    header = result.protectedHeader;
+  } catch (err) {
+    throw new FleetPolicyError(
+      `signature verification failed (${err instanceof Error ? err.message : String(err)})`
+    );
+  }
+  if (header.typ !== FLEET_POLICY_TYP) throw new FleetPolicyError(`unexpected typ ${header.typ}`);
+  let claims;
+  try {
+    claims = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    throw new FleetPolicyError("payload is not JSON");
+  }
+  if (claims.aud !== FLEET_POLICY_AUD) throw new FleetPolicyError(`unexpected aud ${claims.aud}`);
+  if (claims.iss !== FLEET_POLICY_ISS) throw new FleetPolicyError(`unexpected iss ${claims.iss}`);
+  if (!options.expectedSubs.includes(claims.sub)) {
+    throw new FleetPolicyError("policy was issued for a different organisation or device");
+  }
+  if (!Number.isInteger(claims.ver) || claims.ver < 1) {
+    throw new FleetPolicyError("ver must be a positive integer");
+  }
+  if (options.minVer !== void 0 && claims.ver < options.minVer) {
+    throw new FleetPolicyError(
+      `policy version ${claims.ver} is older than the accepted version ${options.minVer} (rollback)`
+    );
+  }
+  if (typeof claims.yaml !== "string" || sha256Hex(claims.yaml) !== claims.sha256) {
+    throw new FleetPolicyError("policy hash mismatch");
+  }
+  const settings = parseSettings(claims.settings);
+  const parsed = parseYaml(claims.yaml);
+  if (!parsed.policy) {
+    const first = parsed.validation.errors[0];
+    throw new FleetPolicyError(
+      `signed policy is invalid${first ? ` (${first.path}: ${first.message})` : ""}`
+    );
+  }
+  return { kid: header.kid, claims: { ...claims, settings }, policy: parsed.policy, settings, jws };
+}
+async function resolveFleetJwks(pinned, chain, ownerId) {
+  let trusted = pinned;
+  let lastSeq = 0;
+  for (const link of chain) {
+    try {
+      const { payload, protectedHeader } = await compactVerify(
+        link,
+        createLocalJWKSet(trusted),
+        { algorithms: ["ES256"] }
+      );
+      if (protectedHeader.typ !== FLEET_KEYS_TYP) continue;
+      const c = JSON.parse(new TextDecoder().decode(payload));
+      if (c.aud !== FLEET_KEYS_AUD || c.iss !== FLEET_POLICY_ISS || c.sub !== ownerId) continue;
+      if (!Number.isInteger(c.seq) || c.seq <= lastSeq) continue;
+      const keys = Array.isArray(c.keys) ? c.keys.filter((k) => k && k.kty === "EC" && k.crv === "P-256" && !("d" in k)) : [];
+      if (keys.length === 0) continue;
+      trusted = { keys };
+      lastSeq = c.seq;
+    } catch {
+    }
+  }
+  return trusted;
+}
+async function pickNewestValid(candidates, jwks, options) {
+  let best = null;
+  let lastError = new FleetPolicyError("no cached fleet policy");
+  for (const jws of candidates) {
+    try {
+      const v = await verifyFleetPolicy(jws, jwks, options);
+      if (!best || v.claims.ver > best.claims.ver) best = v;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new FleetPolicyError(String(err));
+    }
+  }
+  if (!best) throw lastError;
+  return best;
+}
+
+// src/fleet/runtime.ts
+var FLEET_SYNC_BUDGET_MS = 1500;
+function expectedSubs(enrolment) {
+  return [enrolment.org.ownerId, enrolment.deviceId];
+}
+function fleetJwks(ctx, chain = readKeyChain(ctx.paths)) {
+  return resolveFleetJwks(ctx.enrolment.jwks, chain, ctx.enrolment.org.ownerId);
+}
+async function acceptFetched(ctx, fetched, verifyOpts) {
+  const jwks = await fleetJwks(ctx, fetched.keyChain);
+  const verified = await verifyFleetPolicy(fetched.policyJws, jwks, verifyOpts);
+  if (fetched.keyChain.length > 0) writeKeyChain(ctx.paths, fetched.keyChain);
+  writeCachedPolicy(ctx.paths, fetched.policyJws);
+  return verified;
+}
+function remember(paths, state, verified) {
+  state.appliedSha256 = verified.claims.sha256;
+  state.maxVer = Math.max(state.maxVer ?? 0, verified.claims.ver);
+  writeState(paths, state);
+}
+async function loadFleetPolicy(ctx, options = {}) {
+  const state = readState(ctx.paths);
+  const verifyOpts = { expectedSubs: expectedSubs(ctx.enrolment), minVer: state.maxVer };
+  const cached = readCachedPolicies(ctx.paths);
+  let cacheError = null;
+  if (cached.length > 0) {
+    try {
+      const verified = await pickNewestValid(cached, await fleetJwks(ctx), verifyOpts);
+      if (verified.claims.sha256 !== state.appliedSha256 || verified.claims.ver !== state.maxVer) {
+        remember(ctx.paths, state, verified);
+      }
+      return verified;
+    } catch (err) {
+      cacheError = err instanceof Error ? err : new FleetPolicyError(String(err));
+    }
+  }
+  try {
+    const fetched = await fetchFleetPolicy(
+      ctx.enrolment,
+      null,
+      options.fetchTimeoutMs ?? FLEET_SYNC_BUDGET_MS
+    );
+    if (fetched.status === "ok") {
+      const verified = await acceptFetched(ctx, fetched, verifyOpts);
+      remember(ctx.paths, state, verified);
+      return verified;
+    }
+  } catch (err) {
+    if (err instanceof FleetApiError && err.code === "DEVICE_REVOKED") {
+      state.revoked = true;
+      writeState(ctx.paths, state);
+    }
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new FleetPolicyError(
+      cacheError ? `${cacheError.message}; refresh failed (${detail})` : `no fleet policy (${detail})`
+    );
+  }
+  throw cacheError ?? new FleetPolicyError("no fleet policy available");
+}
+async function recordDecisionAndHeartbeat(ctx, applied, decision, options) {
+  const now = options.now ?? Date.now;
+  const state = readState(ctx.paths);
+  if (decision) state.counts[decision] += 1;
+  const intervalSec = applied.settings.heartbeatIntervalSec ?? ctx.enrolment.heartbeatIntervalSec ?? DEFAULT_HEARTBEAT_INTERVAL_SEC;
+  const last = state.lastHeartbeatAt ? Date.parse(state.lastHeartbeatAt) : 0;
+  if (now() - last < intervalSec * 1e3) {
+    writeState(ctx.paths, state);
+    return "throttled";
+  }
+  const deadline = now() + (options.budgetMs ?? FLEET_SYNC_BUDGET_MS);
+  const remaining = () => Math.max(1, deadline - now());
+  state.lastHeartbeatAt = new Date(now()).toISOString();
+  let outcome = "sent";
+  try {
+    const hb = await sendHeartbeat(
+      ctx.enrolment,
+      {
+        appliedSha256: applied.claims.sha256,
+        guardVersion: options.guardVersion,
+        adapters: [{ kind: options.adapterKind, managed: true }],
+        posture: applied.settings.posture,
+        decisionCounts: { ...state.counts }
+      },
+      remaining()
+    );
+    state.counts = { allow: 0, deny: 0, ask: 0 };
+    state.revoked = false;
+    delete state.lastError;
+    const policyChanged = !!hb.activeSha256 && hb.activeSha256 !== applied.claims.sha256;
+    const keyChanged = !!hb.activeKid && !!applied.kid && hb.activeKid !== applied.kid;
+    if (policyChanged || keyChanged) {
+      const fetched = await fetchFleetPolicy(
+        ctx.enrolment,
+        policyEtag(applied.claims.sha256, applied.kid),
+        remaining()
+      );
+      if (fetched.status === "ok") {
+        const verified = await acceptFetched(ctx, fetched, {
+          expectedSubs: expectedSubs(ctx.enrolment),
+          minVer: Math.max(state.maxVer ?? 0, applied.claims.ver)
+        });
+        state.appliedSha256 = verified.claims.sha256;
+        state.maxVer = Math.max(state.maxVer ?? 0, verified.claims.ver);
+        outcome = "refreshed";
+      }
+    }
+  } catch (err) {
+    if (err instanceof FleetApiError && err.code === "DEVICE_REVOKED") {
+      state.revoked = true;
+      outcome = "revoked";
+    } else {
+      state.lastError = err instanceof Error ? err.message : String(err);
+      outcome = "failed";
+    }
+  }
+  writeState(ctx.paths, state);
+  return outcome;
+}
+
+// src/fleet/hook-runner.ts
+var PREFIX = "AstraSync Local Guard (organisation fleet policy)";
+async function runFleetHook(args) {
+  if (args.resolution.kind === "fleet-missing") {
+    return { output: args.denyOutput(`${PREFIX}: ${args.resolution.reason}`), exitCode: 0 };
+  }
+  const ctx = { enrolment: args.resolution.enrolment, paths: args.resolution.paths };
+  let verified;
+  try {
+    verified = await loadFleetPolicy(ctx);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return {
+      output: args.denyOutput(`${PREFIX}: no valid signed policy \u2014 ${detail}`),
+      exitCode: 0
+    };
+  }
+  const { settings } = verified;
+  const decide = async (output) => {
+    try {
+      const outcome = await recordDecisionAndHeartbeat(ctx, verified, args.classify(output), {
+        guardVersion: SDK_VERSION,
+        adapterKind: args.adapterKind,
+        now: args.now
+      });
+      args.onHeartbeat?.(outcome);
+    } catch {
+    }
+    return { output, exitCode: 0 };
+  };
+  let payload;
+  try {
+    payload = JSON.parse(args.payloadJson);
+  } catch {
+    if (settings.failOpen) return decide(null);
+    return decide(args.denyOutput(`${PREFIX}: could not parse hook payload`));
+  }
+  try {
+    const gatewayConfig = {
+      mode: "local",
+      policy: verified.policy,
+      posture: settings.posture,
+      traceEnabled: true,
+      tracePath: join4(args.resolution.paths.userDir, "traces"),
+      debug: false
+    };
+    const gateway = args.gatewayFactory ? args.gatewayFactory(gatewayConfig) : new AstraSyncGateway(gatewayConfig);
+    await gateway.initialize();
+    const adapter = args.createAdapter({
+      ...settings.skipTools && { skipTools: settings.skipTools },
+      ...typeof settings.governMcp === "boolean" && { governMcp: settings.governMcp }
+    });
+    await adapter.initialize({ gateway, adapterOptions: {} });
+    const output = await adapter.evaluatePayload(payload);
+    await adapter.shutdown();
+    await gateway.shutdown();
+    return decide(output);
+  } catch (err) {
+    if (settings.failOpen) return decide(null);
+    const detail = err instanceof Error ? err.message : String(err);
+    return decide(args.denyOutput(`${PREFIX}: policy evaluation failed (${detail})`));
+  }
+}
 
 // src/codex/hook.ts
 var MAX_STDIN_BYTES = 1024 * 1024;
@@ -5214,6 +5990,19 @@ function denyOutput(reason) {
 }
 async function processCodexHookPayload(payloadJson, options = {}) {
   const env = options.env ?? process.env;
+  const fleet = resolveFleet(env, options.home ?? homedir3(), options.fleetPaths);
+  if (fleet) {
+    return runFleetHook({
+      resolution: fleet,
+      payloadJson,
+      adapterKind: "codex",
+      createAdapter: (adapterOptions) => new CodexAdapter(adapterOptions),
+      denyOutput,
+      classify: (output) => output?.hookSpecificOutput?.permissionDecision === "deny" ? "deny" : output?.hookSpecificOutput?.permissionDecision === "ask" ? "ask" : "allow",
+      gatewayFactory: options.gatewayFactory,
+      now: options.now
+    });
+  }
   if (env.ASTRASYNC_GUARD_DISABLE === "1") {
     return { output: null, exitCode: 0 };
   }
@@ -5246,7 +6035,7 @@ async function processCodexHookPayload(payloadJson, options = {}) {
       policyFile: resolved.policyFile,
       posture: resolved.settings.posture ?? "active",
       traceEnabled: true,
-      tracePath: join3(resolved.guardDir, "traces"),
+      tracePath: join5(resolved.guardDir, "traces"),
       debug: false,
       ...mode === "hybrid" && {
         apiBaseUrl: resolved.settings.apiBaseUrl,
@@ -5321,8 +6110,8 @@ if (typeof __require !== "undefined" && __require.main === module) {
 }
 
 // src/claude-code/settings-installer.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3 } from "path";
 var ASTRASYNC_HOOK_MARKER = "astrasync-claude-hook";
 var HOOK_MATCHER = "Bash|PowerShell|Write|Edit|MultiEdit|NotebookEdit|Read|Glob|Grep|WebFetch|WebSearch|Task|Agent|mcp__.*";
 var HOOK_TIMEOUT_SECONDS = 10;
@@ -5332,14 +6121,14 @@ function isGuardEntry(entry, marker2) {
   );
 }
 function readSettings(settingsPath) {
-  if (!existsSync4(settingsPath)) return {};
-  const content = readFileSync4(settingsPath, "utf-8").trim();
+  if (!existsSync5(settingsPath)) return {};
+  const content = readFileSync5(settingsPath, "utf-8").trim();
   if (!content) return {};
   return JSON.parse(content);
 }
 function writeSettings(settingsPath, settings) {
-  mkdirSync3(dirname2(settingsPath), { recursive: true });
-  writeFileSync2(settingsPath, `${JSON.stringify(settings, null, 2)}
+  mkdirSync4(dirname3(settingsPath), { recursive: true });
+  writeFileSync3(settingsPath, `${JSON.stringify(settings, null, 2)}
 `, "utf-8");
 }
 function buildHookEntry(hookCommand, matcher = HOOK_MATCHER, extraHookFields = {}) {
@@ -5374,7 +6163,7 @@ function installClaudeHooks(settingsPath, hookCommand, marker2 = ASTRASYNC_HOOK_
   return { installed: true, alreadyPresent: false, updated: false };
 }
 function uninstallClaudeHooks(settingsPath, marker2 = ASTRASYNC_HOOK_MARKER) {
-  if (!existsSync4(settingsPath)) return false;
+  if (!existsSync5(settingsPath)) return false;
   let settings;
   try {
     settings = readSettings(settingsPath);
@@ -5400,7 +6189,15 @@ var PERMISSION_DENY_PATHS = [
   "~/.claude/settings.json",
   "~/.claude/settings.local.json",
   "**/.astrasync/**",
-  "~/.astrasync/**"
+  "~/.astrasync/**",
+  // 5.11.0 fleet mode: enrolment + signed-policy cache (user scope is inside
+  // ~/.astrasync already; listed explicitly so the intent survives edits) and
+  // the machine-scope enrolment dirs. `//` = absolute from filesystem root;
+  // Windows paths are matched in POSIX form (C:\ → /c/).
+  "~/.astrasync/fleet/**",
+  "//etc/astrasync/**",
+  "//Library/Application Support/AstraSync/**",
+  "//c/ProgramData/AstraSync/**"
 ];
 var GUARD_PERMISSION_DENY_RULES = PERMISSION_DENY_PATHS.map(
   (p) => `Edit(${p})`